Function at 0x412e10
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1cb8
call fcn.0041a460
mov dword [esp + 0x1c9c], 0
mov dword [esp + 0x1c98], 0
mov dword [esp + 0x1c94], 0
mov dword [esp + 0x1c90], 0
mov dword [esp + 0x1c8c], 0
mov dword [esp + 0x1c88], 0
mov dword [esp + 0x1c84], 0
mov dword [esp + 0x1c80], 0
mov dword [esp + 0x1c7c], 0
mov dword [esp + 0x1c78], 0
mov dword [esp + 0x1c74], 0
mov dword [esp + 0x1c70], 0
mov dword [esp + 0x1c6c], 0
mov dword [esp + 0x1c68], 0
mov dword [esp + 0x1c64], 0
mov dword [esp + 0x1c60], 0
mov dword [esp + 0x1c5c], 0
mov dword [esp + 0x1c58], 0
mov dword [esp + 0x1c1c], 0
lea eax, [esp + 0x1a12]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x1808]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x15fe]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x13f4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x11ea]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea edi, [esp + 0xfe0]
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea ebx, [esp + 0xdd6]
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0xbcc]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x9c2]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x7b8]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea esi, [esp + 0x5ae]
mov dword [esp], esi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0x19a]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.0041acd0
lea eax, [esp + 0xd2]
mov dword [esp], eax
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 0
call fcn.0041acd0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov word [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0xffffffff
call fcn.004126b0
mov dword [esp + 0x1ca4], eax
mov dword [esp + 0x54], 0x31bf06e3
jmp 0x4131c0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esp, 0xc
test eax, eax
sete byte [esp + 0x1cac]
mov dword [esp + 0x54], 0x327408c5
nop
nop
nop
mov eax, dword [esp + 0x54]
cmp eax, 0x8d15a5db
jg 0x4131e0
cmp eax, 0x82c0ef5f
jne 0x4131c0
jmp 0x413193
cmp eax, 0x9ef83c7e
jg 0x413200
cmp eax, 0x8d15a5dc
jne 0x4131c0
mov dword [esp + 0x54], 0x7a8b2792
jmp 0x4131c0
cmp eax, 0x7b82b4ca
jg 0x41327d
cmp eax, 0x7a8b2791
jg 0x413295
cmp eax, 0x75874261
jg 0x4132bd
cmp eax, 0x6e026cae
jg 0x4132e6
cmp eax, 0x6d3b7034
jg 0x4132fe
cmp eax, 0x6b0199eb
jg 0x4133e6
cmp eax, 0x69ffc32f
jg 0x413411
cmp eax, 0x68a2a437
jg 0x41343c
cmp eax, 0x9fae2329
jg 0x413454
cmp eax, 0x9ef83c7f
jne 0x4131c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x54], 0x18639acc
jmp 0x4131c0
cmp eax, 0x7b82b4cb
jne 0x4131c0
mov dword [esp + 0x54], 0x7aef254
jmp 0x4131c0
cmp eax, 0x7a8b2792
jne 0x4131c0
cmp dword [esp + 0x1c94], 0
sete byte [esp + 0x1cad]
mov dword [esp + 0x54], 0x75874262
jmp 0x4131c0
cmp eax, 0x75874262
jne 0x4131c0
mov al, byte [esp + 0x1cad]
test al, al
mov eax, 0xb6d6e277
jne 0x4132dd
mov eax, 0x2d514f1a
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x6e026caf
jne 0x4131c0
mov dword [esp + 0x54], 0xca10542b
jmp 0x4131c0
cmp eax, 0x6d3b7035
jne 0x4131c0
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.004062f0
mov dword [esp], edi
call fcn.00405bd0
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x15fe]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x104
call fcn.00405760
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x6c]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0xdd6]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00405760
mov eax, dword [esp + 0x6c]
mov ecx, 0x104
sub ecx, eax
mov edx, dword [esp + 0x58]
sub ecx, edx
lea eax, [esp + eax*2 + 0xdd6]
lea eax, [eax + edx*2]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.00405760
mov dword [esp + 0x54], 0x481a385a
jmp 0x4131c0
cmp eax, 0x6b0199ec
jne 0x4131c0
mov eax, dword [esp + 0x1c98]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
sub esp, 4
mov dword [esp + 0x54], 0xfff335c1
jmp 0x4131c0
cmp eax, 0x69ffc330
jne 0x4131c0
mov eax, dword [esp + 0x1c9c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 0x54], 0xca7ea8e9
jmp 0x4131c0
cmp eax, 0x68a2a438
jne 0x4131c0
mov dword [esp + 0x54], 0xa516e232
jmp 0x4131c0
cmp eax, 0xa516e231
jg 0x413486
cmp eax, 0x9fae232a
jne 0x4131c0
mov eax, dword [esp + 0x1c98]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 0x54], 0xa516e232
jmp 0x4131c0
cmp eax, 0x6620975f
jg 0x4135ae
cmp eax, 0x65c77b47
jg 0x4135d7
cmp eax, 0x6357e1f1
jg 0x413634
cmp eax, 0x5ce86dd1
jg 0x41364c
cmp eax, 0x566b76e6
jg 0x413664
cmp eax, 0x52882881
jg 0x41367c
cmp eax, 0x4fea9811
jg 0x413694
cmp eax, 0x4f276824
jg 0x4136d5
cmp eax, 0x4bf23e45
jg 0x4136fd
cmp eax, 0x481a3859
jg 0x413715
cmp eax, 0x475564e0
jg 0x41372d
cmp eax, 0x452172fc
jg 0x413759
cmp eax, 0x4492ff2a
jg 0x413771
cmp eax, 0x3bf6a2e5
jg 0x413789
cmp eax, 0x394c1fd8
jg 0x4138ee
cmp eax, 0x36971289
jg 0x41391a
cmp eax, 0x327408c4
jg 0x413932
cmp eax, 0x31bf06e2
jg 0x41395b
cmp eax, 0x2d514f19
jg 0x413983
cmp eax, 0x2b44a7d7
jg 0x41453a
cmp eax, 0x274e4b0f
jg 0x414563
cmp eax, 0x247b9654
jg 0x414588
cmp eax, 0xa55972af
jg 0x414595
cmp eax, 0xa516e232
jne 0x4131c0
mov eax, dword [esp + 0x1c98]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 0x54], 0x4bf23e46
jmp 0x4131c0
cmp eax, 0x66209760
jne 0x4131c0
mov al, byte [esp + 0x1cae]
test al, al
mov eax, 0x14c3be8a
jne 0x4135ce
mov eax, 0x3bf6a2e6
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x65c77b48
jne 0x4131c0
lea eax, [esp + 0x1808]
mov dword [esp + 0x1c68], eax
lea eax, [esp + 0x3a4]
mov dword [esp + 0x1c6c], eax
mov dword [esp + 0x1c74], 0
lea eax, [esp + 0x1c58]
mov dword [esp], eax
call dword [0x4ceea8]
sub esp, 4
cmp eax, 1
mov eax, 0xffe33436
jne 0x41362b
mov eax, 0xe6c4d7e8
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x6357e1f2
jne 0x4131c0
mov dword [esp + 0x54], 0x5ce86dd2
jmp 0x4131c0
cmp eax, 0x5ce86dd2
jne 0x4131c0
mov dword [esp + 0x54], 0x452172fd
jmp 0x4131c0
cmp eax, 0x566b76e7
jne 0x4131c0
mov dword [esp + 0x54], 0x475564e1
jmp 0x4131c0
cmp eax, 0x52882882
jne 0x4131c0
mov dword [esp + 0x54], 0xc25855af
jmp 0x4131c0
cmp eax, 0x4fea9812
jne 0x4131c0
mov eax, dword [esp + 0x1c9c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0x68], eax
test eax, eax
setne byte [esp + 0x1cae]
mov dword [esp + 0x54], 0x66209760
jmp 0x4131c0
cmp eax, 0x4f276825
jne 0x4131c0
mov eax, 0x69ffc330
cmp dword [esp + 0x1c9c], 0
jne 0x4136f4
mov eax, 0xca7ea8e9
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x4bf23e46
jne 0x4131c0
mov dword [esp + 0x54], 0x4f276825
jmp 0x4131c0
cmp eax, 0x481a385a
jne 0x4131c0
mov dword [esp + 0x54], 0x82c0ef5f
jmp 0x4131c0
cmp eax, 0x475564e1
jne 0x4131c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], esi
call fcn.00411550
mov dword [esp + 0x54], 0xa7e1dfcc
jmp 0x4131c0
cmp eax, 0x452172fd
jne 0x4131c0
mov dword [esp + 0x54], 0xb7bee436
jmp 0x4131c0
cmp eax, 0x4492ff2b
jne 0x4131c0
mov dword [esp + 0x54], 0xcec508bd
jmp 0x4131c0
cmp eax, 0x3bf6a2e6
jne 0x4131c0
mov dword [esp + 0x1c58], 0x3c
mov dword [esp + 0x1c5c], 0x40
mov dword [esp + 0x1c60], 0
mov dword [esp + 0x1c64], 0x425550
mov dword [esp + 0x1c70], 0
mov dword [esp + 0x1c78], 0
lea eax, [esp + 0x3a4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
lea eax, [esp + 0x3a4]
mov dword [esp], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x42555a
mov dword [esp + 4], 0x104
call fcn.00405760
lea eax, [esp + 0x11ea]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x11ea]
mov dword [esp + 8], eax
lea eax, [esp + 0x3aa]
mov dword [esp], eax
mov dword [esp + 4], 0x101
call fcn.00405760
mov eax, dword [0x4cceb4]
movzx eax, word [eax]
mov dword [esp + 0x74], eax
mov ecx, dword [0x4cceb4]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x70], eax
mov ecx, dword [0x4cceb4]
mov edx, dword [esp + 0x74]
lea eax, [ecx + edx*2 + 4]
mov dword [esp + 0x50], eax
add ecx, 2
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x1808]
mov dword [esp], eax
call fcn.00403ac0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
mov dword [esp + 0x1c98], eax
mov ecx, 0xede3839c
test eax, eax
je 0x4138e5
mov ecx, 0x65c77b48
mov dword [esp + 0x54], ecx
jmp 0x4131c0
cmp eax, 0x394c1fd9
jne 0x4131c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], esi
call fcn.00411550
mov dword [esp + 0x54], 0x475564e1
jmp 0x4131c0
cmp eax, 0x3697128a
jne 0x4131c0
mov dword [esp + 0x54], 0x52882882
jmp 0x4131c0
cmp eax, 0x327408c5
jne 0x4131c0
mov al, byte [esp + 0x1cac]
test al, al
mov eax, 0x6d3b7035
jne 0x413952
mov eax, 0xcfe39462
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x31bf06e3
jne 0x4131c0
mov eax, 0xaa2830fa
cmp dword [esp + 0x1ca4], 0
js 0x41397a
mov eax, 0xcca36117
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x2d514f1a
jne 0x4131c0
mov eax, dword [0x4ceccc]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4cecf4]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c54]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4cecdc]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4cecf4]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c50]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4cece0]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4cecf4]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4ceccc]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4cecf0]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4cecc0]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4ced00]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4ceccc]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4ced04]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c40]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4ced10]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4ced08]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c3c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4ced0c]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4ced08]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c38]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [0x4ced0c]
mov dword [esp + 0x50], eax
mov ecx, dword [0x4cecf4]
mov edx, dword [esp + 0x1c94]
lea eax, [esp + 0x1c34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
call dword [0x4cee94]
sub esp, 0x18
mov eax, dword [esp + 0x1c94]
mov dword [esp], eax
call dword [0x4cee90]
sub esp, 4
call fcn.0041ae3f
and eax, 0xf
lea ecx, [esp + 0xd2]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.0041b7f4
lea eax, [esp + 0xd2]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0x78], eax
lea ecx, [eax + 1]
mov dword [esp + 0x78], ecx
mov word [esp + eax*2 + 0xd2], 0x2e
mov eax, dword [esp + 0x78]
lea eax, [esp + eax*2 + 0xd2]
mov dword [esp + 0x50], eax
call fcn.0041ae3f
and eax, 1
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.0041b7f4
lea eax, [esp + 0xd2]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0x78], eax
lea ecx, [eax + 1]
mov dword [esp + 0x78], ecx
mov word [esp + eax*2 + 0xd2], 0x2e
mov eax, dword [esp + 0x78]
lea eax, [esp + eax*2 + 0xd2]
mov dword [esp + 0x50], eax
call fcn.0041ae3f
mov ecx, eax
xor ecx, 0xfffffffa
and ecx, eax
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.0041b7f4
lea eax, [esp + 0xd2]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0x78], eax
mov ecx, eax
neg ecx
mov edx, 1
sub edx, ecx
mov dword [esp + 0x78], edx
mov word [esp + eax*2 + 0xd2], 0x2e
mov eax, dword [esp + 0x78]
lea eax, [esp + eax*2 + 0xd2]
mov dword [esp + 0x50], eax
call fcn.0041ae3f
and eax, 0xc
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.0041b7f4
lea eax, [esp + 0xd2]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0x78], eax
mov eax, dword [0x4cce94]
movzx eax, byte [eax]
mov dword [esp + 0x74], eax
mov ecx, dword [0x4cce94]
movzx eax, byte [eax + ecx + 1]
mov dword [esp + 0x70], eax
mov ecx, dword [0x4cce94]
mov edx, dword [esp + 0x74]
lea edx, [ecx + edx + 2]
inc ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea eax, [esp + 0x98]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004033d0
mov eax, dword [0x4cece8]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee8c]
sub esp, 8
mov dword [esp + 0x1c30], eax
mov eax, dword [0x4ced18]
mov ecx, dword [0x4cecc8]
mov edx, dword [esp + 0x1c94]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0xc], 0
call dword [0x4cee84]
sub esp, 0x10
mov eax, dword [0x4cece4]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0xd2]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [0x4ceccc]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0x13f4]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [0x4cecc4]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 1
call dword [0x4cee7c]
sub esp, 0xc
mov eax, dword [0x4ced14]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0x98]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x10
call dword [0x4cee78]
sub esp, 0x10
mov eax, dword [0x4cecec]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee8c]
sub esp, 8
mov dword [esp + 0x1c2c], eax
mov eax, dword [esp + 0x1c48]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c48]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c40]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c40]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c2c]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee88]
sub esp, 8
mov eax, dword [esp + 0x1c50]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c50]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c4c]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c4c]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c54]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c34]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
call fcn.0041ae3f
mov ecx, eax
mov edx, 0xcccccccd
mul edx
shr edx, 2
lea eax, [edx + edx*4]
sub ecx, eax
mov eax, dword [ecx*4 + 0x4cce98]
mov dword [esp + 0x1c1c], eax
movzx eax, word [eax]
mov dword [esp + 0x74], eax
not eax
mov ecx, dword [esp + 0x1c1c]
add eax, eax
neg eax
movzx eax, word [ecx + eax]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x1c1c]
mov edx, dword [esp + 0x74]
lea eax, [ecx + edx*2 + 4]
mov dword [esp + 0x50], eax
add ecx, 2
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x1a12]
mov dword [esp], eax
call fcn.00403ac0
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1a12]
mov dword [esp + 8], eax
lea eax, [esp + 0xbcc]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00405760
mov eax, dword [esp + 0x74]
mov ecx, 0x104
sub ecx, eax
lea eax, [esp + eax*2 + 0xbcc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.00405760
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1a12]
mov dword [esp + 8], eax
lea eax, [esp + 0x9c2]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00405760
mov eax, dword [esp + 0x74]
mov ecx, 0x104
sub ecx, eax
lea eax, [esp + eax*2 + 0x9c2]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str.32.exe
call fcn.00405760
mov eax, dword [0x4cceac]
movzx eax, byte [eax]
mov dword [esp + 0x74], eax
mov ecx, dword [0x4cceac]
movzx eax, byte [eax + ecx + 1]
mov dword [esp + 0x70], eax
mov ecx, dword [0x4cceac]
mov edx, dword [esp + 0x74]
lea edx, [ecx + edx + 2]
inc ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea eax, [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004033d0
mov eax, dword [0x4cecf4]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee8c]
sub esp, 8
mov dword [esp + 0x1c28], eax
mov eax, dword [0x4ceccc]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0xbcc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [0x4cecd4]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0x9c2]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [0x4cecd0]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], str.Microsoft
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [0x4ced0c]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0x88]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x10
call dword [0x4cee78]
sub esp, 0x10
mov eax, dword [0x4cecf8]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee8c]
sub esp, 8
mov dword [esp + 0x1c24], eax
mov eax, dword [0x4ceccc]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x42554c
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [esp + 0x1c24]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee88]
sub esp, 8
mov eax, dword [0x4cceb0]
movzx eax, word [eax]
mov dword [esp + 0x74], eax
mov ecx, dword [0x4cceb0]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x70], eax
mov ecx, dword [0x4cceb0]
mov edx, dword [esp + 0x74]
lea eax, [ecx + edx*2 + 4]
mov dword [esp + 0x50], eax
add ecx, 2
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0xa8]
mov dword [esp], eax
call fcn.00403ac0
mov eax, dword [0x4cecfc]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee8c]
sub esp, 8
mov dword [esp + 0x1c20], eax
mov eax, dword [0x4ceccc]
mov ecx, dword [esp + 0x1c94]
lea edx, [esp + 0xa8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [0x4cecd8]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee80]
sub esp, 0xc
mov eax, dword [esp + 0x1c20]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee88]
sub esp, 8
mov eax, dword [esp + 0x1c28]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee88]
sub esp, 8
mov eax, dword [esp + 0x1c34]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c54]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c3c]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c38]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c38]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c3c]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c44]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee74]
sub esp, 8
mov eax, dword [esp + 0x1c44]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee70]
sub esp, 8
mov eax, dword [esp + 0x1c30]
mov ecx, dword [esp + 0x1c94]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4cee88]
sub esp, 8
mov eax, dword [esp + 0x1c94]
mov dword [esp], eax
call dword [0x4cee98]
sub esp, 4
lea eax, [esp + 0x19a]
mov dword [esp], eax
mov dword [esp + 4], 0x20a
call fcn.00406760
lea eax, [esp + 0x19a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4ceed0]
sub esp, 0xc
mov dword [esp + 0x1c9c], eax
mov ecx, 0x566b76e7
test eax, eax
je 0x414531
mov ecx, 0xbeee4e0
mov dword [esp + 0x54], ecx
jmp 0x4131c0
cmp eax, 0x2b44a7d8
jne 0x4131c0
mov al, byte [esp + 0x1cab]
test al, al
mov eax, 0x6b0199ec
jne 0x41455a
mov eax, 0xfff335c1
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x274e4b10
jne 0x4131c0
mov eax, 0xa7519dea
cmp dword [esp + 0x60], 6
jb 0x41457f
mov eax, 0xeecb446c
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x247b9655
jne 0x4131c0
jmp 0x4145c6
cmp eax, 0xa7519de9
jg 0x4145b4
cmp eax, 0xa55972b0
jne 0x4131c0
mov dword [esp + 0x54], 0x7b82b4cb
jmp 0x4131c0
cmp eax, 0xa7e1dfcb
jg 0x4145de
cmp eax, 0xa7519dea
jne 0x4131c0
mov dword [esp + 0x1ca0], 0xffffffff
mov dword [esp + 0x54], 0xb0516381
jmp 0x4131c0
cmp eax, 0xaa2830f9
jg 0x4145fd
cmp eax, 0xa7e1dfcc
jne 0x4131c0
mov dword [esp + 0x54], 0xb7bee436
jmp 0x4131c0
cmp eax, 0xac72014f
jg 0x414627
cmp eax, 0xaa2830fa
jne 0x4131c0
mov dword [esp + 0x1ca0], 0xffffffff
mov dword [esp + 0x54], 0xb0516381
jmp 0x4131c0
cmp eax, 0xaef84aa1
jg 0x41465a
cmp eax, 0xac720150
jne 0x4131c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], esi
call fcn.00411550
mov dword [esp + 0x54], 0xf00437ac
jmp 0x4131c0
cmp eax, 0xb0516380
jg 0x41473d
cmp eax, 0xaef84aa2
jne 0x4131c0
lea eax, [esp + 0x3a4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
lea eax, [esp + 0x3a4]
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str._q__u
mov dword [esp + 4], 0x104
call fcn.00405760
lea eax, [esp + 0x11ea]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x11ea]
mov dword [esp + 8], eax
lea eax, [esp + 0x3b0]
mov dword [esp], eax
mov dword [esp + 4], 0xfe
call fcn.00405760
lea eax, [esp + 0x1808]
mov dword [esp + 0x1c68], eax
lea eax, [esp + 0x3a4]
mov dword [esp + 0x1c6c], eax
mov dword [esp + 0x1c74], 0
lea eax, [esp + 0x1c58]
mov dword [esp], eax
call dword [0x4ceea8]
sub esp, 4
cmp eax, 1
setne byte [esp + 0x1caf]
mov dword [esp + 0x54], 0xc0064279
jmp 0x4131c0
cmp eax, 0xb6d6e276
jg 0x41475c
cmp eax, 0xb0516381
jne 0x4131c0
mov dword [esp + 0x54], 0xeaadf770
jmp 0x4131c0
cmp eax, 0xb7bee435
jg 0x41485c
cmp eax, 0xb6d6e277
jne 0x4131c0
lea eax, [esp + 0x13f4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
lea eax, [esp + 0x11ea]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
lea eax, [esp + 0x13f4]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.004062f0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x15fe]
mov dword [esp + 8], eax
lea eax, [esp + 0x11ea]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00405760
lea eax, [esp + 0x13f4]
mov dword [esp], eax
call fcn.00405bd0
mov ecx, dword [esp + 0x6c]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0x11ea]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x13f4]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00405760
lea eax, [esp + 0x11ea]
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [0x4ceea0]
sub esp, 8
mov dword [esp + 0x1c94], eax
mov dword [esp + 0x54], 0x8d15a5dc
jmp 0x4131c0
cmp eax, 0xbc0aca4b
jg 0x41488b
cmp eax, 0xb7bee436
jne 0x4131c0
mov eax, 0x68a2a438
cmp dword [esp + 0x1c98], 0
jne 0x414882
mov eax, 0x4f276825
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xc0064278
jg 0x4148aa
cmp eax, 0xbc0aca4c
jne 0x4131c0
mov dword [esp + 0x54], 0x52882882
jmp 0x4131c0
cmp eax, 0xc158831d
jg 0x4148da
cmp eax, 0xc0064279
jne 0x4131c0
mov al, byte [esp + 0x1caf]
test al, al
mov eax, 0xfe9c2806
jne 0x4148d1
mov eax, 0xf8e46d37
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xc25855ae
jg 0x414957
cmp eax, 0xc158831e
jne 0x4131c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], 0
call sub.KERNEL32.dll_K32GetModuleBaseNameW
sub esp, 0x10
mov dword [esp + 0x64], eax
mov word [esp + eax*2 + 0xfd8], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
mov dword [esp + 0x1c98], eax
mov dword [esp + 0x54], 0x24370148
jmp 0x4131c0
cmp eax, 0xc5a447f3
jg 0x414976
cmp eax, 0xc25855af
jne 0x4131c0
mov dword [esp + 0x54], 0xb7bee436
jmp 0x4131c0
cmp eax, 0xca10542a
jg 0x41498d
cmp eax, 0xc5a447f4
jne 0x4131c0
jmp 0x415217
cmp eax, 0xca7ea8e8
jg 0x4149b7
cmp eax, 0xca10542b
jne 0x4131c0
mov dword [esp + 0x1ca0], 0
mov dword [esp + 0x54], 0xf2a104a6
jmp 0x4131c0
cmp eax, 0xcca36116
jg 0x4149f9
cmp eax, 0xca7ea8e9
jne 0x4131c0
lea eax, [esp + 0x11ea]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
call fcn.00412d80
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1ca0], eax
mov dword [esp + 0x54], 0xb0516381
jmp 0x4131c0
cmp eax, 0xcdb17a8c
jg 0x414a2e
cmp eax, 0xcca36117
jne 0x4131c0
lea eax, [esp + 0x60]
mov dword [esp], eax
call fcn.00411630
test eax, eax
mov eax, 0xdb6d30f
jne 0x414a25
mov eax, 0x274e4b10
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xce584d2a
jg 0x414a4d
cmp eax, 0xcdb17a8d
jne 0x4131c0
mov dword [esp + 0x54], 0xb7bee436
jmp 0x4131c0
cmp eax, 0xcec508bc
jg 0x414a6c
cmp eax, 0xce584d2b
jne 0x4131c0
mov dword [esp + 0x54], 0x18639acc
jmp 0x4131c0
cmp eax, 0xcfe39461
jg 0x414b02
cmp eax, 0xcec508bd
jne 0x4131c0
mov dword [esp + 8], esi
lea eax, [esp + 0x7b8]
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
sub esp, 0x10
lea eax, [esp + 0x15fe]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.004052c0
lea eax, [esp + 0x15fe]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0x6c], eax
mov dword [esp], 0
call fcn.00415230
mov dword [esp + 0x50], eax
call fcn.00402da0
imul eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.0041ae62
mov dword [esp + 0x54], 0xe434caea
jmp 0x4131c0
cmp eax, 0xd30d68db
jg 0x414b21
cmp eax, 0xcfe39462
jne 0x4131c0
mov dword [esp + 0x54], 0x7b82b4cb
jmp 0x4131c0
cmp eax, 0xd4f56791
jg 0x414b40
cmp eax, 0xd30d68dc
jne 0x4131c0
mov dword [esp + 0x54], 0x7a8b2792
jmp 0x4131c0
cmp eax, 0xe434cae9
jg 0x414b57
cmp eax, 0xd4f56792
jne 0x4131c0
jmp 0x414ed9
cmp eax, 0xe6c4d7e7
jg 0x414b76
cmp eax, 0xe434caea
jne 0x4131c0
mov dword [esp + 0x54], 0x6d3b7035
jmp 0x4131c0
cmp eax, 0xeaadf76f
jg 0x414c1e
cmp eax, 0xe6c4d7e8
jne 0x4131c0
mov eax, dword [esp + 0x1c90]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4ceea4]
sub esp, 0x10
lea eax, [esp + 0xbcc]
mov dword [esp + 0x1c68], eax
mov dword [esp + 0x1c6c], 0
mov dword [esp + 0x1c74], 1
lea eax, [esp + 0x1c58]
mov dword [esp], eax
call dword [0x4ceea8]
sub esp, 4
cmp eax, 1
mov eax, 0xedc7ff2f
jne 0x414c15
mov eax, 0xfd58f1a4
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xeb8a06b5
jg 0x414c4b
cmp eax, 0xeaadf770
jne 0x4131c0
mov eax, dword [esp + 0x1ca0]
mov dword [esp + 0x1cb0], eax
mov dword [esp + 0x54], 0xc5a447f4
jmp 0x4131c0
cmp eax, 0xebade750
jg 0x414c75
cmp eax, 0xeb8a06b6
jne 0x4131c0
mov dword [esp + 0x1ca0], 0
mov dword [esp + 0x54], 0xca10542b
jmp 0x4131c0
cmp eax, 0xedc7ff2e
jg 0x414d0b
cmp eax, 0xebade751
jne 0x4131c0
mov dword [esp + 8], esi
lea eax, [esp + 0x7b8]
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
sub esp, 0x10
lea eax, [esp + 0x15fe]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.004052c0
lea eax, [esp + 0x15fe]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0x6c], eax
mov dword [esp], 0
call fcn.00415230
mov dword [esp + 0x50], eax
call fcn.00402da0
imul eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.0041ae62
mov dword [esp + 0x54], 0xcec508bd
jmp 0x4131c0
cmp eax, 0xede3839b
jg 0x414d22
cmp eax, 0xedc7ff2f
jne 0x4131c0
jmp 0x414ed9
cmp eax, 0xeecb446b
jg 0x414d41
cmp eax, 0xede3839c
jne 0x4131c0
mov dword [esp + 0x54], 0xf00437ac
jmp 0x4131c0
cmp eax, 0xf00437ab
jg 0x414d8d
cmp eax, 0xeecb446c
jne 0x4131c0
lea eax, [esp + 0x7b8]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
mov eax, 0x4492ff2b
jne 0x414d84
mov eax, 0x247b9655
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xf2a104a5
jg 0x414dc0
cmp eax, 0xf00437ac
jne 0x4131c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], esi
call fcn.00411550
mov dword [esp + 0x54], 0xcdb17a8d
jmp 0x4131c0
cmp eax, 0xf8e46d36
jg 0x414ddf
cmp eax, 0xf2a104a6
jne 0x4131c0
mov dword [esp + 0x54], 0xb0516381
jmp 0x4131c0
cmp eax, 0xfd58f1a3
jg 0x414e49
cmp eax, 0xf8e46d37
jne 0x4131c0
mov eax, dword [esp + 0x1c90]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4ceea4]
sub esp, 0x10
mov dword [esp + 0x5c], 1
mov dword [esp + 0x54], 0xb7bee436
jmp 0x4131c0
cmp eax, 0xfe9c2805
jg 0x414ea8
cmp eax, 0xfd58f1a4
jne 0x4131c0
mov eax, dword [esp + 0x1c90]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x1c98]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov eax, 0xbc0aca4c
jne 0x414e9f
mov eax, 0x1d5b8c9d
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xffe33435
jg 0x414ec7
cmp eax, 0xfe9c2806
jne 0x4131c0
mov dword [esp + 0x54], 0x5ce86dd2
jmp 0x4131c0
cmp eax, 0xfff335c0
jg 0x414efa
cmp eax, 0xffe33436
jne 0x4131c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], esi
call fcn.00411550
mov dword [esp + 0x54], 0xb7bee436
jmp 0x4131c0
cmp eax, 0x5916f6f
jg 0x414f2c
cmp eax, 0xfff335c1
jne 0x4131c0
mov eax, dword [esp + 0x1c98]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 0x54], 0x6e026caf
jmp 0x4131c0
cmp eax, 0x7aef253
jg 0x414f5c
cmp eax, 0x5916f70
jne 0x4131c0
mov al, byte [esp + 0x1caa]
test al, al
mov eax, 0xce584d2b
jne 0x414f53
mov eax, 0x6e026caf
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0xbeee4df
jg 0x414f7b
cmp eax, 0x7aef254
jne 0x4131c0
mov dword [esp + 0x54], 0xb6d6e277
jmp 0x4131c0
cmp eax, 0xdb6d30e
jg 0x414f9a
cmp eax, 0xbeee4e0
jne 0x4131c0
mov dword [esp + 0x54], 0x4fea9812
jmp 0x4131c0
cmp eax, 0xe0c11e9
jg 0x414fb9
cmp eax, 0xdb6d30f
jne 0x4131c0
mov dword [esp + 0x54], 0x24370148
jmp 0x4131c0
cmp eax, 0x14c3be89
jg 0x414ff0
cmp eax, 0xe0c11ea
jne 0x4131c0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esp, 0xc
mov dword [esp + 0x54], 0x82c0ef5f
jmp 0x4131c0
cmp eax, 0x14d73fb6
jg 0x41501f
cmp eax, 0x14c3be8a
jne 0x4131c0
mov eax, 0xd4f56792
cmp dword [esp + 0x68], 0x80
jne 0x415016
mov eax, 0x3bf6a2e6
mov dword [esp + 0x54], eax
jmp 0x4131c0
cmp eax, 0x183578fd
jg 0x4150f7
cmp eax, 0x14d73fb7
jne 0x4131c0
lea eax, [esp + 0x3a4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404690
lea eax, [esp + 0x3a4]
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str._q__u
mov dword [esp + 4], 0x104
call fcn.00405760
lea eax, [esp + 0x11ea]
mov dword [esp], eax
call fcn.00405bd0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x11ea]
mov dword [esp + 8], eax
lea eax, [esp + 0x3b0]
mov dword [esp], eax
mov dword [esp + 4], 0xfe
call fcn.00405760
lea eax, [esp + 0x1808]
mov dword [esp + 0x1c68], eax
lea eax, [esp + 0x3a4]
mov dword [esp + 0x1c6c], eax
mov dword [esp + 0x1c74], 0
lea eax, [esp + 0x1c58]
mov dword [esp], eax
call dword [0x4ceea8]
sub esp, 4
mov dword [esp + 0x54], 0xaef84aa2
jmp 0x4131c0
cmp eax, 0x18639acb
jg 0x415116
cmp eax, 0x183578fe
jne 0x4131c0
mov dword [esp + 0x54], 0xeaadf770
jmp 0x4131c0
cmp eax, 0x1d5b8c9c
jg 0x415148
cmp eax, 0x18639acc
jne 0x4131c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete byte [esp + 0x1cab]
mov dword [esp + 0x54], 0x2b44a7d8
jmp 0x4131c0
cmp eax, 0x1d5b8c9d
je 0x4151d3
cmp eax, 0x24370148
jne 0x4151e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], 0
call sub.KERNEL32.dll_K32GetModuleBaseNameW
sub esp, 0x10
mov dword [esp + 0x64], eax
mov word [esp + eax*2 + 0xfd8], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
mov dword [esp + 0x1c98], eax
test eax, eax
setne byte [esp + 0x1caa]
mov dword [esp + 0x54], 0x5916f70
jmp 0x4131c0
mov dword [esp + 0x54], 0xaef84aa2
jmp 0x4131c0
cmp eax, 0x24370c3c
jne 0x4131c0
mov eax, dword [esp + 0x1c9c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0x68], eax
mov dword [esp + 0x54], 0x4fea9812
jmp 0x4131c0
mov eax, dword [esp + 0x1cb0]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret