Function at 0x410884
Capabilities:
Copy file
Get keyboard layout
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x41088c
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4118f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0xa0]
call fcn.00409a6c
test al, al
je 0x4108c7
push 1
push 0
push 1
push 0x6f
call sub.user32.dll_SystemParametersInfoA
jmp 0x4108d4
push 1
push 0
push 0
push 0x6f
call sub.user32.dll_SystemParametersInfoA
mov eax, dword [esi + 0x100]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x4109b5
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.0040a0a8
cmp dword [ebp - 0x1c], 0
je 0x4109ad
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [esi + 0xf8]
mov edx, ebx
call fcn.0040a0a8
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040366c
je 0x4109ad
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xfc]
mov edx, ebx
call fcn.0040a0a8
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.0040366c
je 0x4109ad
lea ecx, [ebp - 0x30]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
mov eax, dword [esi + 0xdc]
mov edx, ebx
call fcn.0040a0a8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x411910
call fcn.0040356c
mov edx, dword [ebp - 0x34]
mov eax, 0x80000002
call fcn.00404b34
mov edx, 0x41194c
pop ecx
call fcn.00404ca0
inc ebx
dec edi
jne 0x4108e9
mov ax, word [0x411960]
call fcn.00406d8c
test al, al
jne 0x410a04
mov ax, word [0x411964]
call fcn.00406d8c
test al, al
jne 0x410a04
mov ax, word [0x411968]
call fcn.00406d8c
test al, al
jne 0x410a04
mov ax, word [0x41196c]
call fcn.00406d8c
test al, al
jne 0x410a04
mov ax, word [0x411970]
call fcn.00406d8c
test al, al
je 0x410ab2
call fcn.004058a0
mov dword [ebp - 0x14], eax
mov edx, 0x41197c
mov eax, 0x80000001
call fcn.00404ad4
mov edx, dword [ebp - 0x14]
call fcn.00404ed4
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x410a5b
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x3c]
push eax
mov edx, 0x41197c
mov eax, 0x80000001
call fcn.00404b04
pop edx
call fcn.00404d10
inc ebx
dec edi
jne 0x410a31
mov eax, dword [ebp - 0x14]
call fcn.0040766c
mov eax, dword [esi + 0xdc]
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x410ab2
mov ebx, 1
lea ecx, [ebp - 0x40]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.0040a0a8
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.00407d78
mov eax, dword [ebp - 0x44]
push eax
mov edx, 0x41197c
mov eax, 0x80000001
call fcn.00404b34
pop edx
pop ecx
call fcn.00404ca0
inc ebx
dec edi
jne 0x410a75
mov ax, word [0x411994]
call fcn.00406d8c
test al, al
jne 0x410adf
mov ax, word [0x411998]
call fcn.00406d8c
test al, al
jne 0x410adf
mov ax, word [0x41199c]
call fcn.00406d8c
test al, al
je 0x410b55
mov edi, dword [esi + 0x108]
test edi, edi
jle 0x410afb
mov edx, 0x41197c
mov eax, 0x80000001
call fcn.00404cec
dec edi
jne 0x410ae9
mov eax, dword [esi + 0xdc]
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x410b55
mov ebx, 1
lea ecx, [ebp - 0x48]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.0040a0a8
mov eax, dword [ebp - 0x48]
push eax
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.00407d78
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x4119a8
call fcn.0040356c
mov edx, dword [ebp - 0x4c]
mov eax, 0x80000001
call fcn.00404b34
xor edx, edx
pop ecx
call fcn.00404ca0
inc ebx
dec edi
jne 0x410b0d
xor ebx, ebx
lea ecx, [ebp - 0x58]
lea edi, [ebx + 0x100]
mov eax, edi
mov edx, 3
call fcn.00407d0c
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x4119cc
call fcn.0040356c
mov edx, dword [ebp - 0x54]
mov eax, 0x80000001
call fcn.00404d34
test al, al
je 0x410bb9
lea ecx, [ebp - 0x60]
mov eax, edi
mov edx, 3
call fcn.00407d0c
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, 0x4119cc
call fcn.0040356c
mov edx, dword [ebp - 0x5c]
mov eax, 0x80000001
call fcn.00404cec
inc ebx
cmp ebx, 0xc9
jne 0x410b57
mov eax, dword [esi + 0xe4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x410dbc
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x64]
mov eax, dword [esi + 0xe4]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x64]
call fcn.00407d40
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x6c]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.00407d0c
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x4119cc
call fcn.0040356c
mov edx, dword [ebp - 0x68]
mov eax, 0x80000001
call fcn.00404b34
lea ecx, [ebp - 8]
mov edx, 0x411a00
call fcn.00404dcc
lea ecx, [ebp - 0x70]
mov eax, dword [esi + 0xec]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x70]
call fcn.00407d40
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x78]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.00407d0c
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x4119cc
call fcn.0040356c
mov edx, dword [ebp - 0x74]
mov eax, 0x80000001
call fcn.00404b34
lea ecx, [ebp - 8]
mov edx, 0x411a18
call fcn.00404dcc
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x80]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x80]
mov ecx, 4
mov edx, 1
call fcn.00403778
mov eax, dword [ebp - 0x7c]
mov edx, 0x411a2c
call fcn.0040366c
jne 0x410d48
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x88]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x88]
mov ecx, 8
mov edx, 5
call fcn.00403778
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x90]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x90]
mov ecx, 8
mov edx, 5
call fcn.00403778
mov edx, dword [ebp - 0x8c]
pop eax
call fcn.00403528
mov ecx, dword [ebp - 0x84]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.0040a100
lea ecx, [ebp - 0x94]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0x94]
call fcn.00407d40
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x9c]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.00407d0c
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
mov edx, 0x4119cc
call fcn.0040356c
mov edx, dword [ebp - 0x98]
mov eax, 0x80000001
call fcn.00404b34
lea ecx, [ebp - 8]
mov edx, 0x411a3c
call fcn.00404dcc
inc ebx
dec edi
jne 0x410bd7
mov ebx, dword [esi + 0x104]
cmp ebx, 0x804
jne 0x410dd7
lea eax, [ebp - 0xc]
mov edx, 0x411a50
call fcn.00403434
cmp ebx, 0x404
jne 0x410dec
lea eax, [ebp - 0xc]
mov edx, 0x411a5c
call fcn.00403434
cmp ebx, 0x412
jne 0x410e01
lea eax, [ebp - 0xc]
mov edx, 0x411a68
call fcn.00403434
cmp ebx, 0x411
je 0x410e10
mov eax, 3
jmp 0x410e15
mov eax, 1
mov edi, eax
test edi, edi
jle 0x410f3a
mov ebx, 1
lea eax, [esi + 0x468]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00407d40
mov dword [ebp - 8], eax
push 4
push 0x411a74
push dword [ebp - 0xc]
lea edx, [ebp - 0xa4]
mov eax, ebx
dec eax
call fcn.00407d78
push dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.004035e0
mov edx, dword [ebp - 0xa0]
mov eax, 0x80000001
call fcn.00404b34
lea ecx, [ebp - 8]
mov edx, 0x411a00
call fcn.00404dcc
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
call fcn.00407d40
mov dword [ebp - 8], eax
push 4
push 0x411a74
push dword [ebp - 0xc]
lea edx, [ebp - 0xac]
mov eax, ebx
dec eax
call fcn.00407d78
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.004035e0
mov edx, dword [ebp - 0xa8]
mov eax, 0x80000001
call fcn.00404b34
lea ecx, [ebp - 8]
mov edx, 0x411a18
call fcn.00404dcc
xor eax, eax
mov dword [ebp - 8], eax
push 4
push 0x411a74
push dword [ebp - 0xc]
lea edx, [ebp - 0xb4]
mov eax, ebx
dec eax
call fcn.00407d78
push dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.004035e0
mov edx, dword [ebp - 0xb0]
mov eax, 0x80000001
call fcn.00404b34
lea ecx, [ebp - 8]
mov edx, 0x411a3c
call fcn.00404d8c
inc ebx
add dword [ebp - 0x18], 8
dec edi
jne 0x410e2d
mov eax, dword [esi + 0x78]
call fcn.00409a6c
test al, al
je 0x41106d
mov eax, dword [esi + 0x7c]
call fcn.00409f10
test eax, eax
jne 0x410fe7
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411ac8
mov edx, 0x411ad4
call fcn.00404ca0
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411ac8
mov edx, 0x411ae4
call fcn.00404ca0
mov ax, word [0x411994]
call fcn.00406d8c
test al, al
jne 0x410fc7
mov ax, word [0x411998]
call fcn.00406d8c
test al, al
jne 0x410fc7
mov ax, word [0x41199c]
call fcn.00406d8c
test al, al
je 0x4110a9
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411ac8
xor edx, edx
call fcn.00404ca0
jmp 0x4110a9
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411a50
mov edx, 0x411ad4
call fcn.00404ca0
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411a50
mov edx, 0x411ae4
call fcn.00404ca0
mov ax, word [0x411994]
call fcn.00406d8c
test al, al
jne 0x411050
mov ax, word [0x411998]
call fcn.00406d8c
test al, al
jne 0x411050
mov ax, word [0x41199c]
call fcn.00406d8c
test al, al
je 0x4110a9
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411a50
xor edx, edx
call fcn.00404ca0
jmp 0x4110a9
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411afc
mov edx, 0x411ad4
call fcn.00404ca0
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411afc
mov edx, 0x411ae4
call fcn.00404ca0
mov eax, dword [esi + 0x80]
call fcn.00409a6c
test al, al
je 0x411107
mov eax, dword [esi + 0x84]
call fcn.00409f10
test eax, eax
jne 0x4110e7
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411ac8
mov edx, 0x411b08
call fcn.00404ca0
jmp 0x411125
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411a50
mov edx, 0x411b08
call fcn.00404ca0
jmp 0x411125
mov edx, 0x411aa8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411afc
mov edx, 0x411b08
call fcn.00404ca0
mov ax, word [0x411960]
call fcn.00406d8c
test al, al
jne 0x411170
mov ax, word [0x411964]
call fcn.00406d8c
test al, al
jne 0x411170
mov ax, word [0x411968]
call fcn.00406d8c
test al, al
jne 0x411170
mov ax, word [0x41196c]
call fcn.00406d8c
test al, al
jne 0x411170
mov ax, word [0x411970]
call fcn.00406d8c
test al, al
je 0x4111d2
mov eax, dword [esi + 0x9c]
call fcn.00409f10
test eax, eax
jne 0x4111a8
mov edx, 0x411b20
mov eax, 0x80000001
call fcn.00404b34
xor ecx, ecx
mov edx, 0x411b38
call fcn.00404c68
push 0x40000000
push 0
call sub.user32.dll_ActivateKeyboardLayout
jmp 0x4111d2
mov edx, 0x411b20
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x10000
mov edx, 0x411b38
call fcn.00404c68
push 0x40010000
push 0
call sub.user32.dll_ActivateKeyboardLayout
push 2
push 0
push 0
push 0x5b
call sub.user32.dll_SystemParametersInfoA
mov ebx, 0x1f
lea eax, [esi + 0x110]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x4111ea
lea eax, [esi + 0x110]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, 0x1f
lea edi, [esi + 0x110]
mov eax, dword [edi]
test eax, eax
je 0x411219
push eax
call sub.user32.dll_UnloadKeyboardLayout
add edi, 4
dec ebx
jne 0x41120d
mov eax, dword [esi + 0xdc]
mov ebx, dword [eax + 0x1c]
cmp ebx, 1
jl 0x411259
push 8
lea ecx, [ebp - 0xb8]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.0040a0a8
mov eax, dword [ebp - 0xb8]
call fcn.00403720
push eax
call sub.user32.dll_LoadKeyboardLayoutA
dec ebx
test ebx, ebx
jne 0x41122d
mov ebx, 0x1f
lea eax, [esi + 0x110]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x411264
lea eax, [esi + 0x110]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
push 1
mov eax, dword [esi + 0x110]
push eax
call sub.user32.dll_ActivateKeyboardLayout
push 2
lea eax, [esi + 0x110]
push eax
push 0
push 0x5a
call sub.user32.dll_SystemParametersInfoA
call fcn.004058a0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040339c
mov edx, 0x411b4c
mov eax, 0x80000002
call fcn.00404ad4
mov edx, dword [ebp - 0x10]
call fcn.00404e04
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x4113c6
inc edi
xor ebx, ebx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.0040a0a8
mov eax, dword [ebp - 0xc0]
mov ecx, 1
mov edx, 1
call fcn.00403778
mov eax, dword [ebp - 0xbc]
mov edx, 0x411b88
call fcn.0040366c
je 0x4113be
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.0040a0a8
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
mov edx, 0x411910
call fcn.0040356c
mov edx, dword [ebp - 0xc4]
mov eax, 0x80000002
call fcn.00404ad4
lea ecx, [ebp - 0xc]
mov edx, 0x411b94
call fcn.00404c04
cmp dword [ebp - 0xc], 0
je 0x411388
lea eax, [ebp - 0xcc]
call fcn.00404a5c
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0xc]
call fcn.00403528
mov eax, dword [ebp - 0xcc]
call fcn.00407f9c
test al, al
jne 0x4113be
lea ecx, [ebp - 0xd4]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.0040a0a8
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
mov edx, 0x411910
call fcn.0040356c
mov edx, dword [ebp - 0xd0]
mov eax, 0x80000002
call fcn.00404cec
inc ebx
dec edi
jne 0x4112d5
mov eax, dword [ebp - 0x10]
call fcn.0040766c
mov eax, dword [esi + 0x6c]
call fcn.00409a6c
test al, al
je 0x411528
mov eax, dword [esi + 0xd4]
call fcn.00409a6c
test al, al
je 0x411528
mov ax, word [0x411968]
call fcn.00406d8c
test al, al
jne 0x41142d
mov ax, word [0x41196c]
call fcn.00406d8c
test al, al
jne 0x41142d
mov ax, word [0x411970]
call fcn.00406d8c
test al, al
jne 0x41142d
mov ax, word [0x411960]
call fcn.00406d8c
test al, al
je 0x411466
mov edx, 0x411ba8
mov eax, 0x80000001
call fcn.00404b34
xor ecx, ecx
mov edx, 0x411bc8
call fcn.00404c68
mov edx, 0x411bf0
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 4
mov edx, 0x411c18
call fcn.00404c68
mov dl, 1
mov eax, 0x411c2c
call fcn.0040da54
mov dl, 1
mov eax, 0x411c40
call fcn.0040da54
mov dl, 1
mov eax, 0x411c54
call fcn.0040da54
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x411c68
call fcn.00406bf4
mov eax, esi
mov edx, 0x411c68
call fcn.0040dd30
test al, al
je 0x4114f0
mov eax, esi
mov ecx, 1
mov edx, 0x411c7c
call fcn.0040db48
mov eax, esi
mov ecx, 1
mov edx, 0x411c68
call fcn.0040db48
mov edx, 0x411c94
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411c68
mov edx, 0x411c68
call fcn.00404ca0
jmp 0x411528
mov eax, dword [esi + 0x104]
sub eax, 0x404
je 0x411506
sub eax, 0x400
je 0x411512
jmp 0x41151e
mov eax, 0x411ccc
call fcn.004042a8
jmp 0x411528
mov eax, 0x411ce8
call fcn.004042a8
jmp 0x411528
mov eax, 0x411d04
call fcn.004042a8
mov eax, dword [esi + 0x70]
call fcn.00409a6c
test al, al
je 0x4115e2
mov ax, word [0x411968]
call fcn.00406d8c
test al, al
jne 0x411574
mov ax, word [0x41196c]
call fcn.00406d8c
test al, al
jne 0x411574
mov ax, word [0x411970]
call fcn.00406d8c
test al, al
jne 0x411574
mov ax, word [0x411960]
call fcn.00406d8c
test al, al
je 0x4115ad
mov edx, 0x411ba8
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 1
mov edx, 0x411bc8
call fcn.00404c68
mov edx, 0x411bf0
mov eax, 0x80000001
call fcn.00404b34
xor ecx, ecx
mov edx, 0x411c18
call fcn.00404c68
mov eax, esi
mov ecx, 1
mov edx, 0x411c68
call fcn.0040db48
mov eax, esi
mov edx, 0x411c68
call fcn.0041b1fc
xor edx, edx
mov eax, 0x411c54
call fcn.0040da54
xor edx, edx
mov eax, 0x411c40
call fcn.0040da54
mov eax, dword [esi + 0x70]
call fcn.00409a6c
test al, al
je 0x41184c
mov eax, dword [esi + 0xd4]
call fcn.00409a6c
test al, al
je 0x41184c
mov eax, esi
mov edx, 0x411c7c
call fcn.0040dd30
test al, al
jne 0x411759
lea eax, [ebp - 0xd8]
call fcn.00404a5c
lea eax, [ebp - 0xd8]
mov edx, 0x411c7c
call fcn.00403528
mov eax, dword [ebp - 0xd8]
call fcn.00407f9c
test al, al
jne 0x411759
lea eax, [ebp - 0xdc]
call fcn.00407fec
lea eax, [ebp - 0xdc]
mov edx, 0x411c7c
call fcn.00403528
mov eax, dword [ebp - 0xdc]
call fcn.00407f9c
test al, al
je 0x4116c6
push 0xffffffffffffffff
lea eax, [ebp - 0xe0]
call fcn.00404a5c
lea eax, [ebp - 0xe0]
mov edx, 0x411c7c
call fcn.00403528
mov eax, dword [ebp - 0xe0]
call fcn.00403720
push eax
lea eax, [ebp - 0xe4]
call fcn.00407fec
lea eax, [ebp - 0xe4]
mov edx, 0x411c7c
call fcn.00403528
mov eax, dword [ebp - 0xe4]
call fcn.00403720
push eax
call sub.KERNEL32.DLL_CopyFileA
lea eax, [ebp - 0xe8]
call fcn.00407fec
lea eax, [ebp - 0xe8]
mov edx, 0x411d24
call fcn.00403528
mov eax, dword [ebp - 0xe8]
call fcn.00407f9c
test al, al
je 0x411745
push 0xffffffffffffffff
lea eax, [ebp - 0xec]
call fcn.00404a5c
lea eax, [ebp - 0xec]
mov edx, 0x411d24
call fcn.00403528
mov eax, dword [ebp - 0xec]
call fcn.00403720
push eax
lea eax, [ebp - 0xf0]
call fcn.00407fec
lea eax, [ebp - 0xf0]
mov edx, 0x411d24
call fcn.00403528
mov eax, dword [ebp - 0xf0]
call fcn.00403720
push eax
call sub.KERNEL32.DLL_CopyFileA
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x411c7c
call fcn.00406bf4
mov eax, esi
mov edx, 0x411c7c
call fcn.0040dd30
test al, al
jne 0x41177d
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x411c7c
call fcn.00406bf4
mov eax, esi
mov edx, 0x411c7c
call fcn.0040dd30
test al, al
jne 0x4117d0
call fcn.004049bc
test eax, eax
jne 0x4117d0
mov eax, dword [esi + 0x104]
sub eax, 0x404
je 0x4117ac
sub eax, 0x400
je 0x4117b8
jmp 0x4117c4
mov eax, 0x411d3c
call fcn.004042a8
jmp 0x4117e1
mov eax, 0x411de4
call fcn.004042a8
jmp 0x4117e1
mov eax, 0x411e8c
call fcn.004042a8
jmp 0x4117e1
mov eax, esi
mov ecx, 1
mov edx, 0x411c7c
call fcn.0040db48
mov ax, word [0x411994]
call fcn.00406d8c
test al, al
jne 0x41180e
mov ax, word [0x411998]
call fcn.00406d8c
test al, al
jne 0x41180e
mov ax, word [0x41199c]
call fcn.00406d8c
test al, al
je 0x41182e
mov edx, 0x411c94
mov eax, 0x80000002
call fcn.00404b34
mov ecx, 0x411c7c
mov edx, 0x411c7c
call fcn.00404ca0
jmp 0x41184c
mov edx, 0x411c94
mov eax, 0x80000001
call fcn.00404b34
mov ecx, 0x411c7c
mov edx, 0x411c7c
call fcn.00404ca0
mov eax, dword [esi + 0xd4]
call fcn.00409a6c
test al, al
jne 0x4118b5
mov eax, esi
mov edx, 0x411c7c
call fcn.0040dd30
test al, al
je 0x411877
mov eax, esi
mov edx, 0x411c7c
call fcn.0041b1fc
mov eax, esi
mov edx, 0x411c68
call fcn.0040dd30
test al, al
je 0x411893
mov eax, esi
mov edx, 0x411c68
call fcn.0041b1fc
mov eax, esi
mov ecx, 1
mov edx, 0x411c68
call fcn.0040db48
mov eax, esi
mov ecx, 1
mov edx, 0x411c7c
call fcn.0040db48
mov eax, 0x80000002
call fcn.00404ce0
mov eax, 0x80000001
call fcn.00404ce0
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040e12c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411900
lea eax, [ebp - 0xf0]
mov edx, 0x36
call fcn.004033c0
lea eax, [ebp - 0xc]
call fcn.0040339c
ret