Function at 0x41abe0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Persist via lnk shortcut
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x583720
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x338c
call fcn.0055a0b0
mov eax, dword [0x5e4a44]
xor eax, esp
mov dword [esp + 0x3388], eax
push ebx
push esi
push edi
mov eax, dword [0x5e4a44]
xor eax, esp
push eax
lea eax, [esp + 0x33a0]
mov dword fs:[0], eax
push 0
mov dword [esp + 0x28], ecx
call fcn.00552a39
add esp, 4
push eax
call fcn.0055218b
add esp, 4
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextCharset]
mov dword [0x5f4e90], eax
lea eax, [esp + 0x14]
push 0x5f520c
push eax
call fcn.00419f40
add esp, 8
push eax
mov ecx, 0x5f520c
mov dword [esp + 0x33ac], 0
call fcn.00402bc0
or esi, 0xffffffff
mov dword [esp + 0x33a8], esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aca1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push 0x5f5808
push ecx
call fcn.00419f40
add esp, 8
push eax
mov ecx, 0x5f5808
mov dword [esp + 0x33ac], 1
call fcn.00402bc0
mov dword [esp + 0x33a8], esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41acef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x400
lea ecx, [esp + 0x2e90]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x2e8c]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ad10
sub eax, edx
push eax
lea edx, [esp + 0x2e90]
push edx
mov ecx, 0x5f5208
call fcn.00402ef0
mov eax, dword [0x5f5208]
push 0x5c
push eax
call fcn.00551488
add esp, 8
test eax, eax
je 0x41ad50
sub eax, dword [0x5f5208]
mov edi, eax
cmp edi, esi
jne 0x41addb
push 0x5affa8
lea ecx, [esp + 0x18]
call fcn.004024e0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x33b0], 2
call fcn.00419f40
mov ecx, dword [0x5f5808]
mov eax, dword [eax]
add esp, 8
push 0x10
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41adae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x33a8], esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x41bb87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41bb87
lea ecx, [edi + 1]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, 0x5f5208
call fcn.004027f0
push eax
mov ecx, 0x5f5208
mov dword [esp + 0x33ac], 3
call fcn.00402bc0
mov dword [esp + 0x33a8], esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x41ae28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x5f5208]
add eax, 0xfffffff0
push eax
call fcn.00403050
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x18], esi
push 6
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x33b0], 4
call fcn.0041c050
mov eax, dword [eax]
push str._naka_
push eax
call fcn.00551707
add esp, 8
test eax, eax
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ae90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x41aea6
mov esi, dword [esi - 0xc]
push 5
add esi, 0xfffffffb
push esi
lea ecx, [esp + 0x20]
call fcn.004151e0
push 3
push 0x5affc4
lea ecx, [esp + 0x20]
call fcn.00402e00
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x41aecd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + edi + 0x2e8d]
push ecx
lea ecx, [esp + 0x24]
call fcn.004024e0
mov byte [esp + 0x33a8], 5
mov edx, dword [esp + 0x20]
push 0x2e
push edx
call fcn.00551488
add esp, 8
test eax, eax
je 0x41af4a
sub eax, dword [esp + 0x20]
test eax, eax
jle 0x41af4a
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004027f0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x33ac], 6
call fcn.00402bc0
mov byte [esp + 0x33a8], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41af4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call fcn.00552a39
add esp, 4
lea ecx, [esp + 0x30]
push ecx
mov esi, str._y_m_d_H_M_S.log
lea edi, [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
call fcn.00419d40
mov byte [esp + 0x33a8], 7
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00402e00
mov byte [esp + 0x33a8], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41afaf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5af6f0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00413530
add esp, 8
mov ecx, esp
mov byte [esp + 0x33ac], 8
mov dword [esp + 0x34], esp
lea edx, [esp + 0x24]
push edx
push eax
push ecx
call fcn.00413470
add esp, 0xc
call fcn.0041bbb0
mov byte [esp + 0x33ac], 5
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b013
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x24]
mov ecx, dword [ebx + 0x48]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004024e0
mov byte [esp + 0x33a8], 9
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x41b5d4
push 9
push ecx
call fcn.005513b5
add esp, 8
test eax, eax
je 0x41b5d4
sub eax, dword [esp + 0x28]
mov esi, eax
cmp esi, 2
jle 0x41b5d4
push 3
lea edx, [esi - 3]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
call fcn.004029f0
mov byte [esp + 0x33a8], 0xa
mov edi, dword [esp + 0x14]
push 0x5affdc
push edi
call fcn.00551707
add esp, 8
test eax, eax
sete al
test al, al
je 0x41b595
inc esi
push esi
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x30]
call fcn.004027c0
mov byte [esp + 0x33a8], 0xb
mov esi, dword [esp + 0x40]
push 0x5c
push esi
call fcn.00551488
add esp, 8
test eax, eax
jne 0x41b0c8
or eax, 0xffffffff
jmp 0x41b0ca
sub eax, esi
inc eax
push eax
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x48]
call fcn.004027c0
lea eax, [esp + 0x2e8c]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x33ac], 0xc
call fcn.004024e0
mov byte [esp + 0x33a8], 0xd
mov ecx, dword [esp + 0x1c]
push 0x5c
push ecx
call fcn.00551488
add esp, 8
test eax, eax
jne 0x41b113
or eax, 0xffffffff
jmp 0x41b117
sub eax, dword [esp + 0x1c]
inc eax
push eax
push 0
lea ecx, [esp + 0x24]
call fcn.004151e0
mov eax, dword [esp + 0x38]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41b13d
push 0x80004005
call fcn.004010d0
mov edx, dword [esp + 0x1c]
push eax
push edx
call fcn.00551707
add esp, 8
test eax, eax
setne al
test al, al
je 0x41b15b
mov ecx, esi
call fcn.0041a690
push esi
mov dword [esp + 0x28], 0x24
xor ebx, ebx
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41b1a9
mov eax, dword [esp + 0x24]
mov ecx, eax
dec eax
mov dword [esp + 0x24], eax
test ecx, ecx
jle 0x41b1a9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41b19e
call dword [sym.imp.KERNEL32.dll_GetLastError]
add ebx, 0xa
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x41b172
mov ebx, dword [esp + 0x24]
push edi
push ebx
push esi
push str._UPD_del_:__s___d___08x
call fcn.0041bdc0
add esp, 0x10
test ebx, ebx
jge 0x41b338
lea ecx, [esp + 0x24]
call fcn.00402490
push edi
push esi
lea edx, [esp + 0x2c]
push str.Update_Failed___s_delete_failed___08x
push edx
mov byte [esp + 0x33b8], 0xe
call fcn.00403110
mov eax, dword [0x5f5808]
mov edi, dword [esp + 0x34]
add esp, 0x10
push 0x10
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0041bda0
lea eax, [edi - 0x10]
mov byte [esp + 0x33a8], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b228
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 0xc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b250
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 0xb
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b278
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
mov byte [esp + 0x33a8], 0xa
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b29c
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x33a8], 9
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b2c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b2ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 4
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b314
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x33a8], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x41adc6
push 0x5c
lea ecx, [esp + 0x44]
call fcn.00402730
mov edi, eax
call fcn.00454925
push eax
push edi
push esi
lea ecx, [esp + 0x30]
call fcn.00402d90
push 0x5af6f0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x33b4], 0xf
call fcn.00413530
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x33b4], 0x10
call fcn.00413470
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x33ac], 0x11
call fcn.00402bc0
mov byte [esp + 0x33a8], 0x10
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b3ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 0xf
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b3f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x40]
push 0
push ebx
lea ecx, [esp + 0x2e94]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, dword [esp + 0x24]
test eax, eax
je 0x41b4ef
push str._DEL_t
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00413530
add esp, 0xc
lea ecx, [esp + 0x2e8c]
push ecx
push eax
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x33b4], 0x12
call fcn.00413530
mov eax, dword [eax]
add esp, 0xc
push eax
call fcn.005521bf
add esp, 4
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00402ba0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x33a8], 0xf
call fcn.00402ba0
push 0x44
lea eax, [esp + 0x70]
push 0
push eax
call fcn.00557650
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x70]
push edx
push edi
push eax
push eax
push eax
push eax
push eax
push esi
push ebx
mov dword [esp + 0x94], 0x44
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41b4ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._UPD_pro_:__08x
call fcn.0041bdc0
mov eax, dword [0x5f5808]
add esp, 8
push 0x10
push eax
push str.Update_Failed__1
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0041bda0
lea eax, [edi - 0x10]
mov byte [esp + 0x33a8], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b518
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 0xc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b540
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x33a8], 0xb
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b568
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [esp + 0x33a8], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b29c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41b29c
push 0x5b0044
push edi
call fcn.00551707
add esp, 8
test eax, eax
sete al
test al, al
je 0x41b666
add edi, 0xfffffff0
mov byte [esp + 0x33a8], 9
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b5d4
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x4c], 8
mov dword [esp + 0x50], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.004686cd
push 0
call fcn.00469e53
add esp, 4
mov ecx, ebx
call fcn.0046a3b2
lea edi, [ebx + 0xe8]
mov ecx, edi
call fcn.0040b790
test al, al
jne 0x41b6ba
push str._ozf_:_err
call fcn.0041bdc0
mov eax, dword [0x5f4e94]
add esp, 4
test eax, eax
je 0x41b645
push eax
call fcn.00553d71
add esp, 4
mov dword [0x5f4e94], 0
mov byte [esp + 0x33a8], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41b2e0
mov eax, dword [0x5f5808]
push 0x10
push eax
push str.Update_Failed__2
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str._cmd_:_err
call fcn.0041bdc0
add esp, 4
call fcn.0041bda0
add edi, 0xfffffff0
mov byte [esp + 0x33a8], 9
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b2c4
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
jmp 0x41b2c4
call fcn.0040bdf0
test al, al
jne 0x41b6da
push str._oif_:_err
call fcn.0041bdc0
add esp, 4
call fcn.0041bda0
jmp 0x41b2c4
mov ecx, edi
call fcn.0040c120
test al, al
jne 0x41b6fc
push str._lc_:_err
call fcn.0041bdc0
add esp, 4
call fcn.0041bda0
jmp 0x41bb6c
lea ecx, [esp + 0x2c]
call fcn.00402490
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x33ac], 0x13
call fcn.00412c40
lea edx, [esp + 0x2e90]
mov ecx, eax
call fcn.00412120
test al, al
jne 0x41b740
push str._fhui_:_err
call fcn.0041bdc0
add esp, 4
call fcn.0041bda0
jmp 0x41bb63
call fcn.00428e90
mov ecx, 0x5f5208
call fcn.00402ce0
push eax
lea ecx, [esp + 0x54]
call fcn.00403920
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x58]
push edx
mov ecx, 0x5e6b08
mov byte [esp + 0x33b4], 0x14
call fcn.00403990
lea ecx, [esp + 0x50]
mov byte [esp + 0x33a8], 0x13
call fcn.00403960
lea eax, [ebx + 0x1c4]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00419f40
add esp, 8
push eax
mov ecx, 0x5f520c
mov byte [esp + 0x33ac], 0x15
call fcn.00402bc0
lea ecx, [esp + 0x30]
mov byte [esp + 0x33a8], 0x13
call fcn.00402ba0
lea edx, [ebx + 0x248]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.00419f40
add esp, 8
push eax
mov ecx, 0x5f5808
mov byte [esp + 0x33ac], 0x16
call fcn.00402bc0
lea ecx, [esp + 0x30]
mov byte [esp + 0x33a8], 0x13
call fcn.00402ba0
lea ecx, [esp + 0x328c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0x10
lea edx, [esp + 0x2d94]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x328c]
lea eax, [esp + 0x2d8c]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41b850
test dl, dl
je 0x41b84c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41b850
add eax, 2
add ecx, 2
test dl, dl
jne 0x41b830
xor eax, eax
jmp 0x41b855
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41b9b1
push 0x104
lea eax, [esp + 0xb8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x2d8c]
push ecx
lea edx, [esp + 0xb8]
push edx
push str._csc__4:__s____s
call fcn.0041bdc0
lea eax, [esp + 0xc0]
add esp, 0xc
push eax
lea ecx, [esp + 0x2d90]
call fcn.0041a3b0
add esp, 4
test al, al
jne 0x41b9b1
lea ecx, [esp + 0x1c]
call fcn.00402490
lea ecx, [esp + 0xb4]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x33ac], 0x17
call fcn.004025c0
push 0x5c
lea ecx, [esp + 0x20]
call fcn.00402730
inc eax
push eax
push 0
lea ecx, [esp + 0x24]
call fcn.004151e0
push 0x2e
lea ecx, [esp + 0x20]
call fcn.00402730
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx - 0xc]
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.004151e0
lea edi, [esp + 0x2d8c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41b910
mov ax, word [0x5af6f0]
mov word [edi], ax
mov eax, dword [esp + 0x1c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b927
lea edi, [esp + 0x2d8c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41b938
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x2d8c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41b958
mov ecx, dword [str..lnk]
mov dl, byte [0x5b00c0]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0xb4]
push eax
lea edi, [esp + 0x2d90]
call fcn.0041a2d0
add esp, 4
mov ecx, edi
push ecx
lea edx, [esp + 0xb8]
push edx
push str._csc__6:__s____s
call fcn.0041bdc0
add esp, 0xc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x33a8], 0x13
call fcn.00402ba0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1f8]
push ecx
call fcn.00428970
lea edx, [esp + 0x1f4]
mov byte [esp + 0x33a8], 0x18
mov ecx, edx
mov dword [ebx + 0x20], edx
call fcn.00460c4b
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x41ba15
push 0x5b00d8
push ecx
call fcn.00550eef
mov ecx, dword [esp + 0x34]
add esp, 8
test eax, eax
je 0x41ba01
sub eax, ecx
je 0x41ba15
cmp dword [ecx - 0xc], 0
jl 0x41ba15
push 0x5b00e4
push ecx
call fcn.00550eef
add esp, 8
call fcn.0041bda0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x41bb4e
push 0x5af6f0
lea ecx, [esp + 0x1c]
call fcn.00402620
push 0x5b00f4
lea ecx, [esp + 0x3c]
call fcn.004024e0
push 0x13c
lea ecx, [esp + 0xbc]
push 0
mov byte [esp + 0x33b0], 0x19
push ecx
mov dword [esp + 0xc0], 0
call fcn.00557650
add esp, 0xc
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00413470
mov eax, dword [eax]
add esp, 0xc
lea edx, [esp + 0xb4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00402ba0
test esi, esi
je 0x41bb45
cmp esi, 0xffffffff
je 0x41bb45
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add dword [esp + 0x40], 0x40616000
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
adc dword [esp + 0x44], 0xfffffed2
mov edi, edi
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0xcc]
push ecx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x41bb2f
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00413530
mov eax, dword [eax]
add esp, 0xc
push eax
call edi
lea ecx, [esp + 0x3c]
call fcn.00402ba0
lea edx, [esp + 0xb4]
push edx
push esi
call ebx
test eax, eax
jne 0x41baf0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x38]
call fcn.00402ba0
lea eax, [esp + 0x1f4]
push eax
mov byte [esp + 0x33ac], 0x13
call fcn.00428cd0
lea ecx, [esp + 0x2c]
call fcn.00402ba0
lea ecx, [esp + 0x28]
call fcn.00402ba0
lea ecx, [esp + 0x20]
call fcn.00402ba0
lea ecx, [esp + 0x18]
call fcn.00402ba0
xor eax, eax
mov ecx, dword [esp + 0x33a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3388]
xor ecx, esp
call fcn.005509f8
mov esp, ebp
pop ebp
ret