Function at 0x402430
Capabilities:
Delete file
Get common file path
Get system information on windows
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x434106
mov eax, dword fs:[0]
push eax
sub esp, 0xfd0
mov eax, dword [0x443430]
xor eax, esp
mov dword [esp + 0xfc8], eax
push ebx
push esi
push edi
mov eax, dword [0x443430]
xor eax, esp
push eax
lea eax, [esp + 0xfe0]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
mov esi, ecx
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.00406080
xor ebx, ebx
push ebx
call fcn.00406f4d
add esp, 4
push 0x43a974
mov ecx, esi
call fcn.004074c2
push 0x3ff
lea ecx, [esp + 0xbd9]
push ebx
push ecx
mov byte [esp + 0xbe0], bl
call fcn.00420b80
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0xc
push str.Enter_Unzip_
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0xbd8]
push str.t1:_d
push edx
mov dword [esp + 0x24], eax
call fcn.0041f4bd
add esp, 0xc
lea eax, [esp + 0xbd4]
push eax
call esi
call fcn.00401b20
test al, al
jne 0x402511
call fcn.00401bd0
test al, al
je 0x402528
push ebx
push 0x43a9ac
push 0x43a9b4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40335c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and ax, 0x3ff
movzx eax, ax
movzx eax, ax
cmp eax, 4
je 0x40254e
cmp eax, 9
jne 0x402554
mov dword [0x447304], 1
jmp 0x402554
mov dword [0x447304], ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push str.C:WindowsSystem32drivers_test.tmp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x402644
call fcn.00403520
cmp eax, 5
je 0x40261b
call fcn.00403520
cmp eax, 6
je 0x40261b
call fcn.00403520
cmp eax, 4
je 0x40261b
call fcn.00403520
cmp eax, 1
je 0x4025fb
call fcn.00403520
cmp eax, 2
je 0x4025fb
call fcn.00403520
cmp eax, 3
je 0x4025fb
mov eax, dword [0x447304]
cmp eax, ebx
jne 0x4025db
push ebx
push 0x43a9ac
push 0x43a9f8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40335c
cmp eax, 1
jne 0x40335c
push ebx
push 0x43aa38
push str.please_run_as_Administrator
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40335c
mov eax, dword [0x447304]
cmp eax, ebx
jne 0x4025db
push ebx
push 0x43a9ac
push 0x43aa78
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40335c
mov eax, dword [0x447304]
cmp eax, ebx
je 0x4025c4
cmp eax, 1
jne 0x40335c
push ebx
push 0x43aa38
push str.UAC_may_cause_unable_to_open_please_run_as_Administrator
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40335c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.C:WindowsSystem32drivers_test.tmp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [str.6.0.4.138]
mov edx, dword [0x43aad8]
xor eax, eax
mov dword [esp + 0x26d], eax
mov dword [esp + 0x271], eax
push 0x103
mov dword [esp + 0x279], eax
mov dword [esp + 0x270], ecx
mov dword [esp + 0x27d], eax
mov dword [esp + 0x281], eax
mov dword [esp + 0x285], eax
mov dword [esp + 0x289], eax
mov word [esp + 0x28d], ax
mov byte [esp + 0x28f], al
mov ax, word [0x43aadc]
lea ecx, [esp + 0xad1]
push ebx
push ecx
mov dword [esp + 0x27c], edx
mov word [esp + 0x280], ax
mov byte [esp + 0xad8], bl
call fcn.00420b80
add esp, 0xc
push 0x104
lea edx, [esp + 0xad0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [esp + 0x14]
call fcn.00402160
push 0x104
push ebx
push 0x447308
mov dword [esp + 0xff4], ebx
call fcn.00420b80
mov eax, dword [esp + 0x20]
mov edx, 0x447308
add esp, 0xc
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
cmp cl, bl
jne 0x402720
push 0x5c
push 0x447308
call fcn.0041f490
add esp, 8
cmp eax, ebx
je 0x402741
mov byte [eax], bl
mov eax, 0x447308
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402750
mov ecx, dword [str.windows]
mov edx, dword [0x43aae4]
mov dword [eax], ecx
mov cl, byte [0x43aae8]
mov edi, 0x447308
mov dword [eax + 4], edx
mov byte [eax + 8], cl
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x402780
mov dx, word [0x43a468]
mov eax, 0x447308
mov word [edi], dx
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4027a0
mov ecx, dword [str.RECYCLERmicrosoft]
mov dword [eax], ecx
mov ecx, dword [0x43aaf0]
mov dword [eax + 4], ecx
mov ecx, dword [0x43aaf4]
mov dword [eax + 8], ecx
mov ecx, dword [0x43aaf8]
mov dword [eax + 0xc], ecx
mov cx, word [0x43aafc]
mov word [eax + 0x10], cx
mov cl, byte [0x43aafe]
mov edi, 0x447308
mov byte [eax + 0x12], cl
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x4027f0
push 0x104
push 0x447410
mov word [edi], dx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
call fcn.00402000
cmp dword [str.UnZip.exe], ebx
je 0x402827
mov eax, 0x444864
nop
add eax, 4
cmp dword [eax], ebx
jne 0x402820
lea edx, [esp + 0x4c]
push edx
call fcn.00401000
mov byte [esp + 0xfe8], 1
call fcn.00401170
test eax, eax
jne 0x40288e
push 0x103
lea eax, [esp + 0x9c9]
push ebx
push eax
mov byte [esp + 0x9d0], bl
call fcn.00420b80
mov ecx, dword [str.UnZip.exe]
add esp, 0xc
push ecx
lea edx, [esp + 0x9c8]
push str.UnzipExe__s_file_is_failed__this_is_Running_
push edx
call fcn.0041f4bd
add esp, 0xc
lea eax, [esp + 0x9c4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x403328
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0x28]
cmp ax, 9
je 0x4028aa
cmp ax, 6
jne 0x4028b6
push 0x12b
mov ecx, 0x43ab30
jmp 0x4028c0
push 0x12c
mov ecx, 0x43ab44
call fcn.00403390
push 0x103
lea edx, [esp + 0x4a1]
push ebx
push edx
mov byte [esp + 0x4a8], bl
call fcn.00420b80
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esp, 0xc
push 0x104
lea eax, [esp + 0x4a0]
push eax
call esi
lea eax, [esp + 0x49c]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402901
mov ecx, dword [str.qzdm]
mov dx, word [0x43ab4c]
mov dword [eax], ecx
mov word [eax + 4], dx
call fcn.00403960
test eax, eax
jne 0x403224
call fcn.00403630
test eax, eax
jne 0x402cc7
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.setup_
call esi
call fcn.00401c80
push 0x103
lea eax, [esp + 0x399]
push ebx
push eax
mov byte [esp + 0x3a0], bl
call fcn.00420b80
add esp, 0xc
push 0x103
lea ecx, [esp + 0x291]
push ebx
push ecx
mov byte [esp + 0x298], bl
call fcn.00420b80
add esp, 0xc
xor eax, eax
jmp 0x402990
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x402990
lea eax, [esp + 0x394]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4029b0
mov edx, dword [str.FwMiddleCode.dll]
mov ecx, dword [0x43ab6c]
mov dword [eax], edx
mov edx, dword [0x43ab70]
mov dword [eax + 4], ecx
mov ecx, dword [0x43ab74]
mov dword [eax + 8], edx
mov dx, word [0x43ab78]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x4029f0
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402a10
mov ecx, dword [str.FwMiddleCode.delete]
mov edx, dword [0x43ab80]
mov dword [eax], ecx
mov ecx, dword [0x43ab84]
mov dword [eax + 4], edx
mov edx, dword [0x43ab88]
mov dword [eax + 8], ecx
mov ecx, dword [0x43ab8c]
mov dword [eax + 0xc], edx
mov dl, byte [0x43ab90]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x398]
push ecx
call fcn.00420130
add esp, 8
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x402a70
lea eax, [esp + 0x394]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402a90
mov edx, dword [str.InstallFWall.dll]
mov ecx, dword [0x43ab98]
mov dword [eax], edx
mov edx, dword [0x43ab9c]
mov dword [eax + 4], ecx
mov ecx, dword [0x43aba0]
mov dword [eax + 8], edx
mov dx, word [0x43aba4]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x402ad0
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402af0
mov ecx, dword [str.InstallFWall.delete]
mov edx, dword [0x43abac]
mov dword [eax], ecx
mov ecx, dword [0x43abb0]
mov dword [eax + 4], edx
mov edx, dword [0x43abb4]
mov dword [eax + 8], ecx
mov ecx, dword [0x43abb8]
mov dword [eax + 0xc], edx
mov dl, byte [0x43abbc]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x398]
push ecx
call fcn.00420130
add esp, 8
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x402b50
lea eax, [esp + 0x394]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402b70
mov edx, dword [str.EnterFirewall.dll]
mov ecx, dword [0x43abc4]
mov dword [eax], edx
mov edx, dword [0x43abc8]
mov dword [eax + 4], ecx
mov ecx, dword [0x43abcc]
mov dword [eax + 8], edx
mov dx, word [0x43abd0]
mov dword [eax + 0xc], ecx
mov cl, byte [0x43abd2]
mov word [eax + 0x10], dx
mov byte [eax + 0x12], cl
xor eax, eax
jmp 0x402bc0
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x402bc0
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402be0
mov edx, dword [str.EnterFirewall.delete]
mov ecx, dword [0x43abd8]
mov dword [eax], edx
mov edx, dword [0x43abdc]
mov dword [eax + 4], ecx
mov ecx, dword [0x43abe0]
mov dword [eax + 8], edx
mov edx, dword [0x43abe4]
mov dword [eax + 0xc], ecx
mov cx, word [0x43abe8]
mov dword [eax + 0x10], edx
lea edx, [esp + 0x28c]
mov word [eax + 0x14], cx
push edx
lea eax, [esp + 0x398]
push eax
call fcn.00420130
push 0x103
lea ecx, [esp + 0x5b1]
push ebx
push ecx
mov byte [esp + 0x5b8], bl
call fcn.00420b80
add esp, 0x14
xor eax, eax
jmp 0x402c60
mov cl, byte [eax + 0x447308]
mov byte [esp + eax + 0x5a4], cl
add eax, 1
cmp cl, bl
jne 0x402c60
lea eax, [esp + 0x5a4]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402c80
mov edx, dword [str.QzdmExtern.exe]
mov ecx, dword [0x43abf0]
mov dword [eax], edx
mov edx, dword [0x43abf4]
mov dword [eax + 4], ecx
mov ecx, dword [0x43abf8]
mov dword [eax + 8], edx
lea edx, [esp + 0x5a4]
push edx
mov dword [eax + 0xc], ecx
call fcn.00402360
add esp, 4
call fcn.00401f40
jmp 0x40322a
push 0x103
lea eax, [esp + 0x5a9]
push ebx
push eax
mov byte [esp + 0x5b0], bl
call fcn.00420b80
add esp, 0xc
push 0x104
lea ecx, [esp + 0x5a8]
push ecx
call esi
lea eax, [esp + 0x5a4]
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402d00
mov edx, dword [str.qzdm_ver.ini]
mov ecx, dword [0x43ac00]
mov dword [eax], edx
mov edx, dword [0x43ac04]
mov dword [eax + 4], ecx
mov cx, word [0x43ac08]
mov dword [eax + 8], edx
push 0x103
lea edx, [esp + 0x7b9]
push ebx
push edx
mov word [eax + 0xc], cx
mov byte [esp + 0x7c0], bl
call fcn.00420b80
add esp, 0xc
lea eax, [esp + 0x5a4]
push eax
push 0x104
lea ecx, [esp + 0x7bc]
push ecx
push 0x43ae3c
push 0x43ac0c
push str.settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esp + 0x7b4]
push edx
call esi
lea eax, [esp + 0x7b4]
push eax
lea eax, [esp + 0x270]
call fcn.00401d80
add esp, 4
test eax, eax
jg 0x402dc1
lea eax, [esp + 0x7b4]
lea edx, [eax + 1]
jmp 0x402db0
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x402db0
sub eax, edx
jne 0x40322a
lea ecx, [esp + 0x5a4]
push ecx
lea edx, [esp + 0x270]
push edx
push 0x43ac0c
push str.settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.setup2_
call esi
call fcn.00401c80
push 0x103
lea eax, [esp + 0x291]
push ebx
push eax
mov byte [esp + 0x298], bl
call fcn.00420b80
add esp, 0xc
push 0x103
lea ecx, [esp + 0x399]
push ebx
push ecx
mov byte [esp + 0x3a0], bl
call fcn.00420b80
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x402e30
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402e50
mov edx, dword [str.FwMiddleCode.dll]
mov ecx, dword [0x43ab6c]
mov dword [eax], edx
mov edx, dword [0x43ab70]
mov dword [eax + 4], ecx
mov ecx, dword [0x43ab74]
mov dword [eax + 8], edx
mov dx, word [0x43ab78]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x402e90
lea eax, [esp + 0x394]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402eb0
mov ecx, dword [str.FwMiddleCode.delete]
mov edx, dword [0x43ab80]
mov dword [eax], ecx
mov ecx, dword [0x43ab84]
mov dword [eax + 4], edx
mov edx, dword [0x43ab88]
mov dword [eax + 8], ecx
mov ecx, dword [0x43ab8c]
mov dword [eax + 0xc], edx
mov dl, byte [0x43ab90]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
lea eax, [esp + 0x394]
push eax
lea ecx, [esp + 0x290]
push ecx
call fcn.00420130
add esp, 8
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x402f10
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402f30
mov edx, dword [str.InstallFWall.dll]
mov ecx, dword [0x43ab98]
mov dword [eax], edx
mov edx, dword [0x43ab9c]
mov dword [eax + 4], ecx
mov ecx, dword [0x43aba0]
mov dword [eax + 8], edx
mov dx, word [0x43aba4]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x402f70
lea eax, [esp + 0x394]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402f90
mov ecx, dword [str.InstallFWall.delete]
mov edx, dword [0x43abac]
mov dword [eax], ecx
mov ecx, dword [0x43abb0]
mov dword [eax + 4], edx
mov edx, dword [0x43abb4]
mov dword [eax + 8], ecx
mov ecx, dword [0x43abb8]
mov dword [eax + 0xc], edx
mov dl, byte [0x43abbc]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
lea eax, [esp + 0x394]
push eax
lea ecx, [esp + 0x290]
push ecx
call fcn.00420130
add esp, 8
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x402ff0
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403010
mov edx, dword [str.EnterFirewall.dll]
mov ecx, dword [0x43abc4]
mov dword [eax], edx
mov edx, dword [0x43abc8]
mov dword [eax + 4], ecx
mov ecx, dword [0x43abcc]
mov dword [eax + 8], edx
mov dx, word [0x43abd0]
mov dword [eax + 0xc], ecx
mov cl, byte [0x43abd2]
mov word [eax + 0x10], dx
mov byte [eax + 0x12], cl
xor eax, eax
jmp 0x403060
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x403060
lea eax, [esp + 0x394]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403080
mov edx, dword [str.EnterFirewall.delete]
mov ecx, dword [0x43abd8]
mov dword [eax], edx
mov edx, dword [0x43abdc]
mov dword [eax + 4], ecx
mov ecx, dword [0x43abe0]
mov dword [eax + 8], edx
mov edx, dword [0x43abe4]
mov dword [eax + 0xc], ecx
mov cx, word [0x43abe8]
mov dword [eax + 0x10], edx
lea edx, [esp + 0x394]
mov word [eax + 0x14], cx
push edx
lea eax, [esp + 0x290]
push eax
call fcn.00420130
add esp, 8
xor eax, eax
jmp 0x4030e0
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x28c], cl
add eax, 1
cmp cl, bl
jne 0x4030e0
lea eax, [esp + 0x28c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403100
mov ecx, dword [str.QzdmTerm.exe]
mov edx, dword [0x43ac28]
mov dword [eax], ecx
mov ecx, dword [0x43ac2c]
mov dword [eax + 4], edx
mov dx, word [0x43ac30]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
xor eax, eax
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x394], cl
add eax, 1
cmp cl, bl
jne 0x403131
lea eax, [esp + 0x394]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403150
mov ecx, dword [str.QzdmTerm.delete]
mov edx, dword [0x43ac38]
mov dword [eax], ecx
mov ecx, dword [0x43ac3c]
mov dword [eax + 4], edx
mov edx, dword [0x43ac40]
mov dword [eax + 8], ecx
mov cl, byte [0x43ac44]
mov dword [eax + 0xc], edx
lea edx, [esp + 0x394]
mov byte [eax + 0x10], cl
push edx
lea eax, [esp + 0x290]
push eax
call fcn.00420130
push 0x103
lea ecx, [esp + 0x8c9]
push ebx
push ecx
mov byte [esp + 0x8d0], bl
call fcn.00420b80
add esp, 0x14
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x447308]
mov byte [esp + eax + 0x8bc], cl
add eax, 1
cmp cl, bl
jne 0x4031c0
lea eax, [esp + 0x8bc]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4031e0
mov edx, dword [str.QzdmExtern.exe]
mov ecx, dword [0x43abf0]
mov dword [eax], edx
mov edx, dword [0x43abf4]
mov dword [eax + 4], ecx
mov ecx, dword [0x43abf8]
mov dword [eax + 8], edx
lea edx, [esp + 0x8bc]
push edx
mov dword [eax + 0xc], ecx
call fcn.00402360
add esp, 4
call fcn.00401f40
jmp 0x40322a
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.exec_extern_
call esi
push 0x103
lea eax, [esp + 0x6b1]
push ebx
push eax
mov byte [esp + 0x6b8], bl
call fcn.00420b80
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x49c]
mov byte [esp + eax + 0x6ac], cl
add eax, 1
cmp cl, bl
jne 0x403250
lea eax, [esp + 0x6ac]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403270
mov ecx, dword [str.QZDMArchive.exe]
mov edx, dword [0x43ac5c]
mov dword [eax], ecx
mov ecx, dword [0x43ac60]
mov dword [eax + 4], edx
mov edx, dword [0x43ac64]
mov dword [eax + 8], ecx
mov cx, word [0x43ac68]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
lea eax, [esp + 0xacc]
mov esi, eax
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4032b1
lea edi, [esp + 0x6ac]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x4032c6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 0x6ac]
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edx
call esi
lea eax, [esp + 0x6ac]
push eax
call fcn.004022d0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x18]
lea ecx, [esp + 0xbd4]
push eax
push str.unzip_t2_t1:_d
push ecx
call fcn.0041f4bd
add esp, 0xc
lea edx, [esp + 0xbd4]
push edx
call esi
lea ecx, [esp + 0x4c]
call fcn.004010c0
mov dword [esp + 0xfe8], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40335c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xfe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xfc8]
xor ecx, esp
call fcn.0041f2bf
mov esp, ebp
pop ebp
ret