Function at 0x4103dc
Capabilities:
Copy file
Get keyboard layout
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x4103e4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41156b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0xa0]
call fcn.00409430
test al, al
je 0x41041f
push 1
push 0
push 1
push 0x6f
call sub.user32.dll_SystemParametersInfoA
jmp 0x41042c
push 1
push 0
push 0
push 0x6f
call sub.user32.dll_SystemParametersInfoA
mov eax, dword [esi + 0x100]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x41050d
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409a6c
cmp dword [ebp - 0x1c], 0
je 0x410505
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [esi + 0xf8]
mov edx, ebx
call fcn.00409a6c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.004032c8
je 0x410505
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xfc]
mov edx, ebx
call fcn.00409a6c
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004032c8
je 0x410505
lea ecx, [ebp - 0x30]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
mov eax, dword [esi + 0xdc]
mov edx, ebx
call fcn.00409a6c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x411584
call fcn.004031c8
mov edx, dword [ebp - 0x34]
mov eax, 0x80000002
call fcn.00404738
mov edx, 0x4115c0
pop ecx
call fcn.004048a4
inc ebx
dec edi
jne 0x410441
mov ax, word [0x4115d4]
call fcn.00406834
test al, al
jne 0x410567
mov ax, word [0x4115d8]
call fcn.00406834
test al, al
jne 0x410567
mov ax, word [0x4115dc]
call fcn.00406834
test al, al
jne 0x410567
mov ax, word [0x4115e0]
call fcn.00406834
test al, al
jne 0x410567
mov ax, word [0x4115e4]
call fcn.00406834
test al, al
jne 0x410567
mov eax, esi
call fcn.0040dbd0
test al, al
je 0x410615
call fcn.00405420
mov dword [ebp - 0x14], eax
mov edx, 0x4115f0
mov eax, 0x80000001
call fcn.004046d8
mov edx, dword [ebp - 0x14]
call fcn.00404ad8
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x4105be
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x3c]
push eax
mov edx, 0x4115f0
mov eax, 0x80000001
call fcn.00404708
pop edx
call fcn.00404914
inc ebx
dec edi
jne 0x410594
mov eax, dword [ebp - 0x14]
call fcn.00407030
mov eax, dword [esi + 0xdc]
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x410615
mov ebx, 1
lea ecx, [ebp - 0x40]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.00409a6c
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.0040773c
mov eax, dword [ebp - 0x44]
push eax
mov edx, 0x4115f0
mov eax, 0x80000001
call fcn.00404738
pop edx
pop ecx
call fcn.004048a4
inc ebx
dec edi
jne 0x4105d8
mov ax, word [0x411608]
call fcn.00406834
test al, al
jne 0x410642
mov ax, word [0x41160c]
call fcn.00406834
test al, al
jne 0x410642
mov ax, word [0x411610]
call fcn.00406834
test al, al
je 0x4106b8
mov edi, dword [esi + 0x108]
test edi, edi
jle 0x41065e
mov edx, 0x4115f0
mov eax, 0x80000001
call fcn.004048f0
dec edi
jne 0x41064c
mov eax, dword [esi + 0xdc]
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x4106b8
mov ebx, 1
lea ecx, [ebp - 0x48]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.00409a6c
mov eax, dword [ebp - 0x48]
push eax
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.0040773c
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x41161c
call fcn.004031c8
mov edx, dword [ebp - 0x4c]
mov eax, 0x80000001
call fcn.00404738
xor edx, edx
pop ecx
call fcn.004048a4
inc ebx
dec edi
jne 0x410670
xor ebx, ebx
lea ecx, [ebp - 0x58]
lea edi, [ebx + 0x100]
mov eax, edi
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x411640
call fcn.004031c8
mov edx, dword [ebp - 0x54]
mov eax, 0x80000001
call fcn.00404938
test al, al
je 0x41071c
lea ecx, [ebp - 0x60]
mov eax, edi
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, 0x411640
call fcn.004031c8
mov edx, dword [ebp - 0x5c]
mov eax, 0x80000001
call fcn.004048f0
inc ebx
cmp ebx, 0xc9
jne 0x4106ba
mov eax, dword [esi + 0xe4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x41091f
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x64]
mov eax, dword [esi + 0xe4]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x64]
call fcn.00407704
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x6c]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x411640
call fcn.004031c8
mov edx, dword [ebp - 0x68]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411674
call fcn.004049d0
lea ecx, [ebp - 0x70]
mov eax, dword [esi + 0xec]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x70]
call fcn.00407704
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x78]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x411640
call fcn.004031c8
mov edx, dword [ebp - 0x74]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x41168c
call fcn.004049d0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x80]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x80]
mov ecx, 4
mov edx, 1
call fcn.004033d4
mov eax, dword [ebp - 0x7c]
mov edx, 0x4116a0
call fcn.004032c8
jne 0x4108ab
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x88]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x88]
mov ecx, 8
mov edx, 5
call fcn.004033d4
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x90]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x90]
mov ecx, 8
mov edx, 5
call fcn.004033d4
mov edx, dword [ebp - 0x8c]
pop eax
call fcn.00403184
mov ecx, dword [ebp - 0x84]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409ac4
lea ecx, [ebp - 0x94]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0x94]
call fcn.00407704
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x9c]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
mov edx, 0x411640
call fcn.004031c8
mov edx, dword [ebp - 0x98]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x4116b0
call fcn.004049d0
inc ebx
dec edi
jne 0x41073a
mov ebx, dword [esi + 0x104]
cmp ebx, 0x804
jne 0x41093a
lea eax, [ebp - 0xc]
mov edx, 0x4116c4
call fcn.00403090
cmp ebx, 0x404
jne 0x41094f
lea eax, [ebp - 0xc]
mov edx, 0x4116d0
call fcn.00403090
cmp ebx, 0x412
jne 0x410964
lea eax, [ebp - 0xc]
mov edx, 0x4116dc
call fcn.00403090
cmp ebx, 0x411
je 0x410973
mov eax, 3
jmp 0x410978
mov eax, 1
mov edi, eax
test edi, edi
jle 0x410a9d
mov ebx, 1
lea eax, [esi + 0x468]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00407704
mov dword [ebp - 8], eax
push 4
push 0x4116e8
push dword [ebp - 0xc]
lea edx, [ebp - 0xa4]
mov eax, ebx
dec eax
call fcn.0040773c
push dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0xa0]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411674
call fcn.004049d0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
call fcn.00407704
mov dword [ebp - 8], eax
push 4
push 0x4116e8
push dword [ebp - 0xc]
lea edx, [ebp - 0xac]
mov eax, ebx
dec eax
call fcn.0040773c
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0xa8]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x41168c
call fcn.004049d0
xor eax, eax
mov dword [ebp - 8], eax
push 4
push 0x4116e8
push dword [ebp - 0xc]
lea edx, [ebp - 0xb4]
mov eax, ebx
dec eax
call fcn.0040773c
push dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0xb0]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x4116b0
call fcn.00404990
inc ebx
add dword [ebp - 0x18], 8
dec edi
jne 0x410990
mov eax, dword [esi + 0x78]
call fcn.00409430
test al, al
je 0x410c6c
mov eax, dword [esi + 0x7c]
call fcn.004098d4
sub eax, 1
jb 0x410acc
je 0x410b59
dec eax
je 0x410be6
jmp 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41173c
mov edx, 0x411748
call fcn.004048a4
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41173c
mov edx, 0x411758
call fcn.004048a4
mov ax, word [0x411608]
call fcn.00406834
test al, al
jne 0x410b39
mov ax, word [0x41160c]
call fcn.00406834
test al, al
jne 0x410b39
mov ax, word [0x411610]
call fcn.00406834
test al, al
je 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41173c
xor edx, edx
call fcn.004048a4
jmp 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4116c4
mov edx, 0x411748
call fcn.004048a4
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4116c4
mov edx, 0x411758
call fcn.004048a4
mov ax, word [0x411608]
call fcn.00406834
test al, al
jne 0x410bc6
mov ax, word [0x41160c]
call fcn.00406834
test al, al
jne 0x410bc6
mov ax, word [0x411610]
call fcn.00406834
test al, al
je 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4116c4
xor edx, edx
call fcn.004048a4
jmp 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411770
mov edx, 0x411748
call fcn.004048a4
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411770
mov edx, 0x411758
call fcn.004048a4
mov ax, word [0x411608]
call fcn.00406834
test al, al
jne 0x410c4f
mov ax, word [0x41160c]
call fcn.00406834
test al, al
jne 0x410c4f
mov ax, word [0x411610]
call fcn.00406834
test al, al
je 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411770
xor edx, edx
call fcn.004048a4
jmp 0x410ca8
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41177c
mov edx, 0x411748
call fcn.004048a4
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41177c
mov edx, 0x411758
call fcn.004048a4
mov eax, dword [esi + 0x80]
call fcn.00409430
test al, al
je 0x410d2e
mov eax, dword [esi + 0x84]
call fcn.004098d4
sub eax, 1
jb 0x410cce
je 0x410cee
dec eax
je 0x410d0e
jmp 0x410d4c
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41173c
mov edx, 0x411788
call fcn.004048a4
jmp 0x410d4c
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4116c4
mov edx, 0x411788
call fcn.004048a4
jmp 0x410d4c
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411770
mov edx, 0x411788
call fcn.004048a4
jmp 0x410d4c
mov edx, 0x41171c
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41177c
mov edx, 0x411788
call fcn.004048a4
mov ax, word [0x4115d4]
call fcn.00406834
test al, al
jne 0x410da2
mov ax, word [0x4115d8]
call fcn.00406834
test al, al
jne 0x410da2
mov ax, word [0x4115dc]
call fcn.00406834
test al, al
jne 0x410da2
mov ax, word [0x4115e0]
call fcn.00406834
test al, al
jne 0x410da2
mov ax, word [0x4115e4]
call fcn.00406834
test al, al
jne 0x410da2
mov eax, esi
call fcn.0040dbd0
test al, al
je 0x410e04
mov eax, dword [esi + 0x9c]
call fcn.004098d4
test eax, eax
jne 0x410dda
mov edx, 0x4117a0
mov eax, 0x80000001
call fcn.00404738
xor ecx, ecx
mov edx, 0x4117b8
call fcn.0040486c
push 0x40000000
push 0
call sub.user32.dll_ActivateKeyboardLayout
jmp 0x410e04
mov edx, 0x4117a0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x10000
mov edx, 0x4117b8
call fcn.0040486c
push 0x40010000
push 0
call sub.user32.dll_ActivateKeyboardLayout
push 2
push 0
push 0
push 0x5b
call sub.user32.dll_SystemParametersInfoA
mov ebx, 0x1f
lea eax, [esi + 0x110]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x410e1c
lea eax, [esi + 0x110]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, 0x1f
lea edi, [esi + 0x110]
mov eax, dword [edi]
test eax, eax
je 0x410e4b
push eax
call sub.user32.dll_UnloadKeyboardLayout
add edi, 4
dec ebx
jne 0x410e3f
mov eax, dword [esi + 0xdc]
mov ebx, dword [eax + 0x1c]
cmp ebx, 1
jl 0x410e8b
push 8
lea ecx, [ebp - 0xb8]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.00409a6c
mov eax, dword [ebp - 0xb8]
call fcn.0040337c
push eax
call sub.user32.dll_LoadKeyboardLayoutA
dec ebx
test ebx, ebx
jne 0x410e5f
mov ebx, 0x1f
lea eax, [esi + 0x110]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x410e96
lea eax, [esi + 0x110]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
push 1
mov eax, dword [esi + 0x110]
push eax
call sub.user32.dll_ActivateKeyboardLayout
push 2
lea eax, [esi + 0x110]
push eax
push 0
push 0x5a
call sub.user32.dll_SystemParametersInfoA
call fcn.00405420
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00402ff8
mov edx, 0x4117cc
mov eax, 0x80000002
call fcn.004046d8
mov edx, dword [ebp - 0x10]
call fcn.00404a08
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x410ff8
inc edi
xor ebx, ebx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00409a6c
mov eax, dword [ebp - 0xc0]
mov ecx, 1
mov edx, 1
call fcn.004033d4
mov eax, dword [ebp - 0xbc]
mov edx, 0x411808
call fcn.004032c8
je 0x410ff0
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00409a6c
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
mov edx, 0x411584
call fcn.004031c8
mov edx, dword [ebp - 0xc4]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0xc]
mov edx, 0x411814
call fcn.00404808
cmp dword [ebp - 0xc], 0
je 0x410fba
lea eax, [ebp - 0xcc]
call fcn.00404660
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0xc]
call fcn.00403184
mov eax, dword [ebp - 0xcc]
call fcn.00407960
test al, al
jne 0x410ff0
lea ecx, [ebp - 0xd4]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00409a6c
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
mov edx, 0x411584
call fcn.004031c8
mov edx, dword [ebp - 0xd0]
mov eax, 0x80000002
call fcn.004048f0
inc ebx
dec edi
jne 0x410f07
mov eax, dword [ebp - 0x10]
call fcn.00407030
mov eax, dword [esi + 0x6c]
call fcn.00409430
test al, al
je 0x41116d
mov eax, dword [esi + 0xd4]
call fcn.00409430
test al, al
je 0x41116d
mov ax, word [0x4115dc]
call fcn.00406834
test al, al
jne 0x411050
mov ax, word [0x4115e0]
call fcn.00406834
test al, al
jne 0x411050
mov ax, word [0x4115d4]
call fcn.00406834
test al, al
je 0x411089
mov edx, 0x411828
mov eax, 0x80000001
call fcn.00404738
xor ecx, ecx
mov edx, 0x411848
call fcn.0040486c
mov edx, 0x411870
mov eax, 0x80000001
call fcn.00404738
mov ecx, 4
mov edx, 0x411898
call fcn.0040486c
mov ax, word [0x4115e4]
call fcn.00406834
test al, al
jne 0x41116d
mov eax, esi
call fcn.0040dbd0
test al, al
jne 0x41116d
mov dl, 1
mov eax, 0x4118ac
call fcn.0040d50c
mov dl, 1
mov eax, 0x4118c0
call fcn.0040d50c
mov dl, 1
mov eax, 0x4118d4
call fcn.0040d50c
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x4118e8
call fcn.004066a4
mov eax, esi
mov edx, 0x4118e8
call fcn.0040d7d8
test al, al
je 0x411135
mov eax, esi
mov ecx, 1
mov edx, 0x4118fc
call fcn.0040d5f8
mov eax, esi
mov ecx, 1
mov edx, 0x4118e8
call fcn.0040d5f8
mov edx, 0x411914
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4118e8
mov edx, 0x4118e8
call fcn.004048a4
jmp 0x41116d
mov eax, dword [esi + 0x104]
sub eax, 0x404
je 0x41114b
sub eax, 0x400
je 0x411157
jmp 0x411163
mov eax, 0x41194c
call fcn.00403ef4
jmp 0x41116d
mov eax, 0x411968
call fcn.00403ef4
jmp 0x41116d
mov eax, 0x411984
call fcn.00403ef4
mov eax, dword [esi + 0x70]
call fcn.00409430
test al, al
je 0x411232
mov ax, word [0x4115dc]
call fcn.00406834
test al, al
jne 0x4111aa
mov ax, word [0x4115e0]
call fcn.00406834
test al, al
jne 0x4111aa
mov ax, word [0x4115d4]
call fcn.00406834
test al, al
je 0x4111e3
mov edx, 0x411828
mov eax, 0x80000001
call fcn.00404738
mov ecx, 1
mov edx, 0x411848
call fcn.0040486c
mov edx, 0x411870
mov eax, 0x80000001
call fcn.00404738
xor ecx, ecx
mov edx, 0x411898
call fcn.0040486c
mov ax, word [0x4115e4]
call fcn.00406834
test al, al
jne 0x411232
mov eax, esi
call fcn.0040dbd0
test al, al
jne 0x411232
mov eax, esi
mov ecx, 1
mov edx, 0x4118e8
call fcn.0040d5f8
mov eax, esi
mov edx, 0x4118e8
call fcn.0041b048
xor edx, edx
mov eax, 0x4118d4
call fcn.0040d50c
xor edx, edx
mov eax, 0x4118c0
call fcn.0040d50c
mov eax, dword [esi + 0x70]
call fcn.00409430
test al, al
je 0x4114be
mov eax, dword [esi + 0xd4]
call fcn.00409430
test al, al
je 0x4114be
mov ax, word [0x4115e4]
call fcn.00406834
test al, al
jne 0x4114be
mov eax, esi
call fcn.0040dbd0
test al, al
jne 0x4114be
mov eax, esi
mov edx, 0x4118fc
call fcn.0040d7d8
test al, al
jne 0x4113cb
lea eax, [ebp - 0xd8]
call fcn.00404660
lea eax, [ebp - 0xd8]
mov edx, 0x4118fc
call fcn.00403184
mov eax, dword [ebp - 0xd8]
call fcn.00407960
test al, al
jne 0x4113cb
lea eax, [ebp - 0xdc]
call fcn.004079b0
lea eax, [ebp - 0xdc]
mov edx, 0x4118fc
call fcn.00403184
mov eax, dword [ebp - 0xdc]
call fcn.00407960
test al, al
je 0x411338
push 0xffffffffffffffff
lea eax, [ebp - 0xe0]
call fcn.00404660
lea eax, [ebp - 0xe0]
mov edx, 0x4118fc
call fcn.00403184
mov eax, dword [ebp - 0xe0]
call fcn.0040337c
push eax
lea eax, [ebp - 0xe4]
call fcn.004079b0
lea eax, [ebp - 0xe4]
mov edx, 0x4118fc
call fcn.00403184
mov eax, dword [ebp - 0xe4]
call fcn.0040337c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0xe8]
call fcn.004079b0
lea eax, [ebp - 0xe8]
mov edx, 0x4119a4
call fcn.00403184
mov eax, dword [ebp - 0xe8]
call fcn.00407960
test al, al
je 0x4113b7
push 0xffffffffffffffff
lea eax, [ebp - 0xec]
call fcn.00404660
lea eax, [ebp - 0xec]
mov edx, 0x4119a4
call fcn.00403184
mov eax, dword [ebp - 0xec]
call fcn.0040337c
push eax
lea eax, [ebp - 0xf0]
call fcn.004079b0
lea eax, [ebp - 0xf0]
mov edx, 0x4119a4
call fcn.00403184
mov eax, dword [ebp - 0xf0]
call fcn.0040337c
push eax
call sub.kernel32.dll_CopyFileA
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x4118fc
call fcn.004066a4
mov eax, esi
mov edx, 0x4118fc
call fcn.0040d7d8
test al, al
jne 0x4113ef
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x4118fc
call fcn.004066a4
mov eax, esi
mov edx, 0x4118fc
call fcn.0040d7d8
test al, al
jne 0x411442
call fcn.004045c0
test eax, eax
jne 0x411442
mov eax, dword [esi + 0x104]
sub eax, 0x404
je 0x41141e
sub eax, 0x400
je 0x41142a
jmp 0x411436
mov eax, 0x4119bc
call fcn.00403ef4
jmp 0x411453
mov eax, 0x411a64
call fcn.00403ef4
jmp 0x411453
mov eax, 0x411b0c
call fcn.00403ef4
jmp 0x411453
mov eax, esi
mov ecx, 1
mov edx, 0x4118fc
call fcn.0040d5f8
mov ax, word [0x411608]
call fcn.00406834
test al, al
jne 0x411480
mov ax, word [0x41160c]
call fcn.00406834
test al, al
jne 0x411480
mov ax, word [0x411610]
call fcn.00406834
test al, al
je 0x4114a0
mov edx, 0x411914
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x4118fc
mov edx, 0x4118fc
call fcn.004048a4
jmp 0x4114be
mov edx, 0x411914
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4118fc
mov edx, 0x4118fc
call fcn.004048a4
mov eax, dword [esi + 0xd4]
call fcn.00409430
test al, al
jne 0x411527
mov eax, esi
mov edx, 0x4118fc
call fcn.0040d7d8
test al, al
je 0x4114e9
mov eax, esi
mov edx, 0x4118fc
call fcn.0041b048
mov eax, esi
mov edx, 0x4118e8
call fcn.0040d7d8
test al, al
je 0x411505
mov eax, esi
mov edx, 0x4118e8
call fcn.0041b048
mov eax, esi
mov ecx, 1
mov edx, 0x4118e8
call fcn.0040d5f8
mov eax, esi
mov ecx, 1
mov edx, 0x4118fc
call fcn.0040d5f8
mov eax, 0x80000002
call fcn.004048e4
mov eax, 0x80000001
call fcn.004048e4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040dbf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411572
lea eax, [ebp - 0xf0]
mov edx, 0x36
call fcn.0040301c
lea eax, [ebp - 0xc]
call fcn.00402ff8
ret