Function at 0x4110b0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1a90
call fcn.00416c10
mov dword [esp + 0x1a78], 0
mov dword [esp + 0x1a70], 0
mov dword [esp + 0x1a6c], 0
mov dword [esp + 0x1a68], 0
mov dword [esp + 0x1a64], 0
mov dword [esp + 0x1a60], 0
mov dword [esp + 0x1a5c], 0
mov dword [esp + 0x1a58], 0
mov dword [esp + 0x1a54], 0
mov dword [esp + 0x1a50], 0
mov dword [esp + 0x1a4c], 0
mov dword [esp + 0x1a48], 0
mov dword [esp + 0x1a44], 0
mov dword [esp + 0x1a40], 0
mov dword [esp + 0x1a3c], 0
mov dword [esp + 0x1a38], 0
mov dword [esp + 0x19fc], 0
lea eax, [esp + 0x17f2]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x15e8]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x13de]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x11d4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea ebx, [esp + 0xfca]
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0xdc0]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0xbb6]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x9ac]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x7a2]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x598]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x38e]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea esi, [esp + 0xbc]
mov dword [esp], esi
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 0
call fcn.00417480
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov word [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0xffffffff
call fcn.004106f0
mov dword [esp + 0x1a80], eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x48], 0x7994e1d0
jmp 0x411400
mov dword [esp + 0x48], 0x322c07d3
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
cmp eax, 0x7f11b27e
jg 0x411420
cmp eax, 0x87e06bd6
jg 0x411430
cmp eax, 0x843904e3
jne 0x411400
jmp 0x412a61
cmp eax, 0x7f11b27f
jne 0x411400
jmp 0x4113f3
cmp eax, 0x8d2b9f00
jg 0x411448
cmp eax, 0x87e06bd7
jne 0x411400
mov dword [esp + 0x48], 0x322c07d3
jmp 0x411400
cmp eax, 0x9f7613fb
jg 0x411460
cmp eax, 0x8d2b9f01
jne 0x411400
mov dword [esp + 0x48], 0x31483795
jmp 0x411400
cmp eax, 0xa68a1127
jg 0x411491
cmp eax, 0x9f7613fc
jne 0x411400
mov dword [esp], ecx
mov edi, ecx
call fcn.0040f700
test eax, eax
mov eax, 0x66a00c46
jne 0x411486
mov eax, 0x8d2b9f01
mov dword [esp + 0x48], eax
mov ecx, edi
jmp 0x411400
cmp eax, 0xb5e1d89e
jg 0x4114a8
cmp eax, 0xa68a1128
jne 0x411400
jmp 0x412586
cmp eax, 0xb6f73bdf
jg 0x4114e7
cmp eax, 0xb5e1d89f
jne 0x411400
mov dword [esp], ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
call fcn.00411090
mov ecx, edi
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1a7c], eax
mov dword [esp + 0x48], 0x7f11b27f
jmp 0x411400
cmp eax, 0xb9a74d8b
jg 0x4114fe
cmp eax, 0xb6f73be0
jne 0x411400
jmp 0x4125ad
cmp eax, 0x7994e1cf
jg 0x41162d
cmp eax, 0x78f2329a
jg 0x411655
cmp eax, 0x66a00c45
jg 0x41169c
cmp eax, 0x58bbcafe
jg 0x4116bf
cmp eax, 0x58873cd8
jg 0x411709
cmp eax, 0x4c7bc96b
jg 0x411719
cmp eax, 0x4a961ed7
jg 0x411731
cmp eax, 0x3f28da28
jg 0x411749
cmp eax, 0x3eaaab07
jg 0x411772
cmp eax, 0x322c07d2
jg 0x411813
cmp eax, 0x31483794
jg 0x411839
cmp eax, 0x286daf1c
jg 0x411860
cmp eax, 0x21e1c074
jg 0x4118c7
cmp eax, 0x2112976f
jg 0x4118df
cmp eax, 0x1c76a0c6
jg 0x411979
cmp eax, 0x16eaaf2e
jg 0x41255b
cmp eax, 0xd4dabe1
jg 0x412577
cmp eax, 0x6df6a8d
jg 0x41259e
cmp eax, 0x3b143ae
jg 0x4125e0
cmp eax, 0x1ffb0d4
jg 0x412667
cmp eax, 0xea4186f3
jg 0x412774
cmp eax, 0xe44b79fb
jg 0x4127a0
cmp eax, 0xe0042ccf
jg 0x4127bc
cmp eax, 0xc91eb4e0
jg 0x4127e9
cmp eax, 0xb9a74d8c
je 0x4128be
cmp eax, 0xb9b3e3b7
jne 0x41298c
mov dword [esp + 0x48], 0x31483795
lea ecx, [esp + 0x54]
jmp 0x411400
cmp eax, 0x7994e1d0
jne 0x411400
mov eax, 0xa68a1128
cmp dword [esp + 0x1a80], 0
js 0x41164c
mov eax, 0x9f7613fc
mov dword [esp + 0x48], eax
jmp 0x411400
cmp eax, 0x78f2329b
jne 0x411400
mov edi, ecx
lea eax, [esp + 0x598]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
mov eax, 0x3b143af
jne 0x411486
mov eax, 0x58873cd9
jmp 0x411486
cmp eax, 0x66a00c46
jne 0x411400
mov dword [esp + 0x1a7c], 0
mov dword [esp + 0x48], 0x7f11b27f
jmp 0x411400
cmp eax, 0x58bbcaff
jne 0x411400
mov edi, ecx
lea eax, [esp + 0xbb6]
mov dword [esp + 4], eax
lea eax, [esp + 0x38e]
mov dword [esp], eax
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esp, 0xc
test eax, eax
mov eax, 0x1ffb0d5
je 0x411486
mov eax, 0x4c7bc96c
jmp 0x411486
cmp eax, 0x58873cd9
jne 0x411400
jmp 0x412586
cmp eax, 0x4c7bc96c
jne 0x411400
mov dword [esp + 0x48], 0xe44b79fc
jmp 0x411400
cmp eax, 0x4a961ed8
jne 0x411400
mov dword [esp + 0x48], 0xea4186f4
jmp 0x411400
cmp eax, 0x3f28da29
jne 0x411400
mov al, byte [esp + 0x1a86]
test al, al
mov eax, 0xd4dabe2
jne 0x411769
mov eax, 0x78f2329b
mov dword [esp + 0x48], eax
jmp 0x411400
cmp eax, 0x3eaaab08
jne 0x411400
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4c9e64]
sub esp, 0x10
lea eax, [esp + 0x9ac]
mov dword [esp + 0x1a48], eax
mov dword [esp + 0x1a4c], 0
mov dword [esp + 0x1a54], 1
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
mov ecx, edi
cmp eax, 1
setne byte [esp + 0x1a87]
mov dword [esp + 0x48], 0xe0042cd0
jmp 0x411400
cmp eax, 0x322c07d3
jne 0x411400
mov eax, dword [esp + 0x1a7c]
mov dword [esp + 0x1a88], eax
mov dword [esp + 0x48], 0x843904e3
jmp 0x411400
cmp eax, 0x31483795
jne 0x411400
cmp dword [esp + 0x54], 6
setb al
mov byte [esp + 0x1a86], al
mov dword [esp + 0x48], 0x3f28da29
jmp 0x411400
cmp eax, 0x286daf1d
jne 0x411400
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4c9e64]
sub esp, 0x10
mov ecx, edi
mov dword [esp + 0x50], 1
mov dword [esp + 0x48], 0xb5e1d89f
jmp 0x411400
cmp eax, 0x21e1c075
jne 0x411400
mov dword [esp + 0x48], 0xb5e1d89f
jmp 0x411400
cmp eax, 0x21129770
lea ecx, [esp + 0x54]
jne 0x411400
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4c9e64]
sub esp, 0x10
lea eax, [esp + 0x9ac]
mov dword [esp + 0x1a48], eax
mov dword [esp + 0x1a4c], 0
mov dword [esp + 0x1a54], 1
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
mov ecx, edi
mov dword [esp + 0x48], 0x3eaaab08
jmp 0x411400
cmp eax, 0x1c76a0c7
lea ecx, [esp + 0x54]
jne 0x411400
mov eax, dword [0x4c9cac]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a34]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cbc]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a30]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cc0]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a2c]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cac]
mov ecx, dword [0x4c9cd0]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a28]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9ca0]
mov ecx, dword [0x4c9ce0]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a24]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cac]
mov ecx, dword [0x4c9ce4]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a20]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cf0]
mov ecx, dword [0x4c9ce8]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a1c]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cec]
mov ecx, dword [0x4c9ce8]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a18]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cec]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a78]
lea edi, [esp + 0x1a14]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [esp + 0x1a78]
mov dword [esp], eax
call dword [0x4c9e50]
sub esp, 4
call fcn.004175ef
and eax, 0xf
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], esi
call fcn.00404b20
mov dword [esp + 0x64], eax
lea ecx, [eax + 1]
mov dword [esp + 0x64], ecx
mov word [esp + eax*2 + 0xbc], 0x2e
mov eax, dword [esp + 0x64]
lea edi, [esp + eax*2 + 0xbc]
call fcn.004175ef
and eax, 1
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], esi
call fcn.00404b20
mov dword [esp + 0x64], eax
lea ecx, [eax + 1]
mov dword [esp + 0x64], ecx
mov word [esp + eax*2 + 0xbc], 0x2e
mov eax, dword [esp + 0x64]
lea edi, [esp + eax*2 + 0xbc]
call fcn.004175ef
and eax, 5
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], esi
call fcn.00404b20
mov dword [esp + 0x64], eax
lea ecx, [eax + 1]
mov dword [esp + 0x64], ecx
mov word [esp + eax*2 + 0xbc], 0x2e
mov eax, dword [esp + 0x64]
lea edi, [esp + eax*2 + 0xbc]
call fcn.004175ef
mov ecx, eax
xor ecx, 0xfffffff3
and ecx, eax
mov dword [esp + 4], edi
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], esi
call fcn.00404b20
mov dword [esp + 0x64], eax
mov eax, dword [0x4c7e84]
movzx eax, byte [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [0x4c7e84]
movzx eax, byte [eax + ecx + 1]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7e84]
mov edx, dword [esp + 0x60]
lea edx, [ecx + edx + 2]
inc ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea edi, [esp + 0x84]
mov dword [esp], edi
mov dword [esp + 4], 0x10
call fcn.004027e0
mov eax, dword [0x4c9cc8]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a10], eax
mov eax, dword [0x4c9cf8]
mov ecx, dword [0x4c9ca8]
mov edx, dword [esp + 0x1a78]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0xc], 0
call dword [0x4c9e44]
sub esp, 0x10
mov eax, dword [0x4c9cc4]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a78]
lea edx, [esp + 0x11d4]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9ca4]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 1
call dword [0x4c9e3c]
sub esp, 0xc
mov eax, dword [0x4c9cf4]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x10
call dword [0x4c9e38]
sub esp, 0x10
mov eax, dword [0x4c9ccc]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a0c], eax
mov eax, dword [esp + 0x1a28]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a28]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a20]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a20]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a0c]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a30]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a30]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a2c]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a2c]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a34]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a14]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
call fcn.004175ef
mov ecx, eax
mov edx, 0xcccccccd
mul edx
shr edx, 2
lea eax, [edx + edx*4]
sub ecx, eax
mov eax, dword [ecx*4 + 0x4c7e88]
mov dword [esp + 0x19fc], eax
movzx eax, word [eax]
mov dword [esp + 0x60], eax
not eax
mov ecx, dword [esp + 0x19fc]
add eax, eax
neg eax
movzx eax, word [ecx + eax]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x19fc]
mov edx, dword [esp + 0x60]
lea edi, [ecx + edx*2 + 4]
add ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x17f2]
mov edi, eax
mov dword [esp], edi
call fcn.00402be0
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
lea eax, [esp + 0x9ac]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00404610
mov eax, dword [esp + 0x60]
mov ecx, 0x104
sub ecx, eax
lea eax, [esp + eax*2 + 0x9ac]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.00404610
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
lea eax, [esp + 0x7a2]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00404610
mov eax, dword [esp + 0x60]
mov ecx, 0x104
sub ecx, eax
lea eax, [esp + eax*2 + 0x7a2]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str.32.exe
call fcn.00404610
mov eax, dword [0x4c7e9c]
movzx eax, byte [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [0x4c7e9c]
movzx eax, byte [eax + ecx + 1]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7e9c]
mov edx, dword [esp + 0x60]
lea edx, [ecx + edx + 2]
inc ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea edi, [esp + 0x74]
mov dword [esp], edi
mov dword [esp + 4], 0x10
call fcn.004027e0
mov eax, dword [0x4c9cd4]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a08], eax
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a78]
lea edx, [esp + 0x9ac]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cb4]
mov ecx, dword [esp + 0x1a78]
lea edx, [esp + 0x7a2]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cb0]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], str.Microsoft
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cec]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x10
call dword [0x4c9e38]
sub esp, 0x10
mov eax, dword [0x4c9cd8]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a04], eax
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x42151a
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [esp + 0x1a04]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [0x4c7ea0]
movzx eax, word [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [0x4c7ea0]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7ea0]
mov edx, dword [esp + 0x60]
lea edi, [ecx + edx*2 + 4]
add ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x94]
mov edi, eax
mov dword [esp], edi
call fcn.00402be0
mov eax, dword [0x4c9cdc]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a00], eax
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cb8]
mov ecx, dword [esp + 0x1a78]
lea edx, [esp + 0xbb6]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [esp + 0x1a00]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a08]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a14]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a34]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a1c]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a18]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a18]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a1c]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a24]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a24]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a10]
mov ecx, dword [esp + 0x1a78]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a78]
mov dword [esp], eax
call dword [0x4c9e58]
sub esp, 4
mov dword [esp + 0x1a38], 0x3c
mov dword [esp + 0x1a3c], 0x40
mov dword [esp + 0x1a40], 0
mov dword [esp + 0x1a44], 0x42151e
mov dword [esp + 0x1a50], 0
mov dword [esp + 0x1a58], 0
lea edi, [esp + 0x184]
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x421528
mov dword [esp + 4], 0x104
call fcn.00404610
mov dword [esp], ebx
call fcn.00404b20
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
lea eax, [esp + 0x18a]
mov dword [esp], eax
mov dword [esp + 4], 0x101
call fcn.00404610
mov eax, dword [0x4c7ea4]
movzx eax, word [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [0x4c7ea4]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7ea4]
mov edx, dword [esp + 0x60]
lea edi, [ecx + edx*2 + 4]
mov dword [esp + 0x44], edi
add ecx, 2
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x15e8]
mov edi, eax
mov dword [esp], edi
call fcn.00402be0
mov dword [esp + 0x1a48], edi
lea eax, [esp + 0x184]
mov dword [esp + 0x1a4c], eax
mov dword [esp + 0x1a54], 0
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
cmp eax, 1
mov eax, 0x6df6a8e
jne 0x41254e
mov eax, 0x16eaaf2f
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x54]
jmp 0x411400
cmp eax, 0x16eaaf2f
lea ecx, [esp + 0x54]
jne 0x411400
mov dword [esp + 0x48], 0x3eaaab08
jmp 0x411400
cmp eax, 0xd4dabe2
lea ecx, [esp + 0x54]
jne 0x411400
mov dword [esp + 0x1a7c], 0xffffffff
mov dword [esp + 0x48], 0x7f11b27f
jmp 0x411400
cmp eax, 0x6df6a8e
lea ecx, [esp + 0x54]
jne 0x411400
lea eax, [esp + 0xbb6]
mov dword [esp], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
lea eax, [esp + 0x38e]
mov dword [esp], eax
call fcn.0040f620
mov ecx, edi
mov dword [esp + 0x48], 0xb5e1d89f
jmp 0x411400
cmp eax, 0x3b143af
lea ecx, [esp + 0x54]
jne 0x411400
lea eax, [esp + 0x38e]
mov dword [esp + 8], eax
lea eax, [esp + 0x598]
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
sub esp, 0x10
lea eax, [esp + 0x13de]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00404220
mov dword [esp], edi
call fcn.00404b20
mov dword [esp + 0x58], eax
mov dword [esp], 0
call fcn.00412a70
mov dword [esp], eax
call fcn.00417612
lea ecx, [esp + 0x54]
mov dword [esp + 0x48], 0x1ffb0d5
jmp 0x411400
cmp eax, 0x1ffb0d5
lea ecx, [esp + 0x54]
jne 0x411400
lea eax, [esp + 0xdc0]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
lea eax, [esp + 0xbb6]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00405230
mov dword [esp], edi
call fcn.00404b20
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x13de]
mov dword [esp + 8], eax
lea eax, [esp + 0xbb6]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00404610
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x58]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0xbb6]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404610
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x4c]
mov edx, 0xe81abdac
sub edx, eax
sub edx, ecx
add edx, 0x17e54358
lea eax, [esp + eax*2 + 0xbb6]
lea eax, [eax + ecx*2]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.00404610
lea ecx, [esp + 0x54]
mov dword [esp + 0x48], 0x58bbcaff
jmp 0x411400
cmp eax, 0xea4186f4
lea ecx, [esp + 0x54]
jne 0x411400
mov eax, 0xe44b79fc
cmp dword [esp + 0x1a78], 0
je 0x412797
mov eax, 0x1c76a0c7
mov dword [esp + 0x48], eax
jmp 0x411400
cmp eax, 0xe44b79fc
lea ecx, [esp + 0x54]
jne 0x411400
mov dword [esp + 0x48], 0xc91eb4e1
jmp 0x411400
cmp eax, 0xe0042cd0
lea ecx, [esp + 0x54]
jne 0x411400
mov al, byte [esp + 0x1a87]
test al, al
mov eax, 0xb6f73be0
jne 0x4127e0
mov eax, 0xb9a74d8c
mov dword [esp + 0x48], eax
jmp 0x411400
cmp eax, 0xc91eb4e1
lea ecx, [esp + 0x54]
jne 0x411400
lea eax, [esp + 0x11d4]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00405230
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x13de]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x104
call fcn.00404610
mov dword [esp], edi
call fcn.00404b20
mov ecx, dword [esp + 0x58]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0xfca]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404610
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [0x4c9e60]
sub esp, 8
lea ecx, [esp + 0x54]
mov dword [esp + 0x1a78], eax
mov dword [esp + 0x48], 0x4a961ed8
jmp 0x411400
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x184]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], edi
mov dword [esp + 0xc], 6
mov dword [esp + 8], str._q__u
mov dword [esp + 4], 0x104
call fcn.00404610
mov dword [esp], ebx
call fcn.00404b20
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
lea eax, [esp + 0x190]
mov dword [esp], eax
mov dword [esp + 4], 0xfe
call fcn.00404610
lea eax, [esp + 0x15e8]
mov dword [esp + 0x1a48], eax
mov dword [esp + 0x1a4c], edi
mov dword [esp + 0x1a54], 0
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
cmp eax, 1
mov eax, 0x21e1c075
jne 0x41254e
mov eax, 0x286daf1d
jmp 0x41254e
cmp eax, 0xc5b8da56
lea ecx, [esp + 0x54]
jne 0x411400
lea eax, [esp + 0x11d4]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00405230
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x13de]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x104
call fcn.00404610
mov dword [esp], edi
call fcn.00404b20
mov ecx, dword [esp + 0x58]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0xfca]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404610
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [0x4c9e60]
sub esp, 8
lea ecx, [esp + 0x54]
mov dword [esp + 0x1a78], eax
mov dword [esp + 0x48], 0xc91eb4e1
jmp 0x411400
mov eax, dword [esp + 0x1a88]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret