Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x180
push 0
push 0x41343c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x413440], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.DLL_HeapCreate
mov dword [0x41343c], eax
call section..text
mov eax, 0x41230e
mov dword [0x41347c], eax
call fcn.0040ef00
call fcn.0040ecec
call fcn.0040d1f3
call fcn.0040cd23
call fcn.0040c6d0
call fcn.0040c359
call fcn.0040c0a0
call fcn.0040c082
call fcn.0040bff9
call fcn.0040b761
call fcn.0040a790
call fcn.004099a1
call fcn.00409666
call fcn.004092f7
call fcn.00408361
call fcn.00407fd9
push dword [0x4135a8]
call fcn.00409685
push 7
push 0x412064
lea eax, [0x4135a8]
push eax
push 8
call fcn.004095d4
push 0x4135a0
push 0x412074
push 7
push 0x401
push 8
call fcn.0040ebed
mov eax, 0x200
push eax
lea eax, [0x4135b8]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040d212
push dword [0x4135b0]
call fcn.00409685
push 7
push 0x41206c
lea eax, [0x4135b0]
push eax
push 8
call fcn.004095d4
mov edx, 0x412021
lea ecx, [0x413538]
call fcn.00405068
mov ebp, 0x41230e
mov ebx, ebp
mov ebp, 0x412129
sub ebx, ebp
mov dword [0x413520], ebx
mov ebp, 0x412129
mov dword [0x413524], ebp
push dword [0x413520]
call fcn.0040c110
mov dword [0x4134f4], eax
mov dword [0x413490], 0
mov eax, dword [0x413520]
cmp eax, dword [0x413490]
jl 0x4011b1
mov ebx, dword [0x413524]
add ebx, dword [0x413490]
mov eax, ebx
call fcn.0040c130
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x4134f4]
add ebx, dword [0x413490]
mov eax, ebx
call fcn.0040c140
inc dword [0x413490]
jno 0x401170
mov edx, dword [0x413a90]
push edx
push edx
mov ebx, dword [0x413520]
add ebx, 0xfffffff8
push ebx
mov ebx, dword [0x4134f4]
add ebx, 4
push ebx
call fcn.0040c150
push 0x413468
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push dword [0x413468]
call fcn.004050d0
push 0x413468
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 1
push dword [0x413468]
call fcn.004051b0
push 0x4134bc
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 2
push dword [0x413468]
call fcn.004051b0
push 0x41352c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 3
push dword [0x413468]
call fcn.004051b0
push 0x4134b4
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 4
push dword [0x413468]
call fcn.004051b0
push 0x413598
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 5
push dword [0x413468]
call fcn.004051b0
push 0x4134c0
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 6
push dword [0x413468]
call fcn.004051b0
push 0x413550
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 7
push dword [0x413468]
call fcn.004051b0
push 0x413470
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 8
push dword [0x413468]
call fcn.004051b0
push 0x4134d4
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 9
push dword [0x413468]
call fcn.004051b0
push 0x41357c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0xa
push dword [0x413468]
call fcn.004051b0
push 0x413484
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0xb
push dword [0x413468]
call fcn.004051b0
push 0x41358c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0xc
push dword [0x413468]
call fcn.004051b0
push 0x413540
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0xd
push dword [0x413468]
call fcn.004051b0
push 0x4134dc
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0xe
push dword [0x413468]
call fcn.004051b0
push 0x413510
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0xf
push dword [0x413468]
call fcn.004051b0
push 0x413454
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x10
push dword [0x413468]
call fcn.004051b0
push 0x413578
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x11
push dword [0x413468]
call fcn.004051b0
push 0x41348c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x12
push dword [0x413468]
call fcn.004051b0
push 0x41350c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x13
push dword [0x413468]
call fcn.004051b0
push 0x413544
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x14
push dword [0x413468]
call fcn.004051b0
push 0x413508
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x15
push dword [0x413468]
call fcn.004051b0
push 0x41355c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x16
push dword [0x413468]
call fcn.004051b0
push 0x41353c
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x17
push dword [0x413468]
call fcn.004051b0
push 0x413564
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x18
push dword [0x413468]
call fcn.004051b0
push 0x4134c8
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x19
push dword [0x413468]
call fcn.004051b0
push 0x4134cc
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x1a
push dword [0x413468]
call fcn.004051b0
push 0x413560
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413538]
push 0x1b
push dword [0x413468]
call fcn.004051b0
push 0x413504
call fcn.0040ef80
call fcn.0040a54f
mov ebx, eax
cmp ebx, 0x32
jge 0x40165e
push 0x10
push dword [0x41355c]
push dword [0x413578]
call fcn.00408010
jmp 0x4026d6
mov eax, 0x41230e
mov dword [0x41347c], eax
mov eax, dword [0x41347c]
mov eax, dword [eax]
mov dword [0x413490], eax
add dword [0x41347c], 4
mov eax, dword [0x41347c]
mov eax, dword [eax]
mov dword [0x413494], eax
add dword [0x41347c], 4
mov eax, dword [0x41347c]
mov eax, dword [eax]
mov dword [0x413498], eax
add dword [0x41347c], 4
mov eax, dword [0x41347c]
mov eax, dword [eax]
mov dword [0x41349c], eax
add dword [0x41347c], 4
mov eax, dword [0x41347c]
mov eax, dword [eax]
mov dword [0x4134a0], eax
add dword [0x41347c], 4
push 0x14
call fcn.0040c110
mov dword [0x4134b0], eax
push dword [0x413490]
mov eax, dword [0x4134b0]
call fcn.0040c1b0
push dword [0x413494]
mov ebx, dword [0x4134b0]
add ebx, 4
mov eax, ebx
call fcn.0040c1b0
push dword [0x413498]
mov ebx, dword [0x4134b0]
add ebx, 8
mov eax, ebx
call fcn.0040c1b0
push dword [0x41349c]
mov ebx, dword [0x4134b0]
add ebx, 0xc
mov eax, ebx
call fcn.0040c1b0
push dword [0x4134a0]
mov ebx, dword [0x4134b0]
add ebx, 0x10
mov eax, ebx
call fcn.0040c1b0
mov edx, dword [0x413a90]
push edx
push edx
push 0x14
push dword [0x4134b0]
call fcn.0040d7d0
push 0x413590
call fcn.0040ef80
call fcn.00408a16
lea eax, [0x403274]
push eax
call fcn.004093f0
call fcn.0040849f
mov dword [0x41354c], eax
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4134e4], eax
mov edx, dword [0x413a90]
push edx
push edx
call fcn.004084b2
push 0x413548
call fcn.0040ef80
push dword [0x413548]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov ebx, dword [0x41354c]
and ebx, ebx
jle 0x4018c9
mov dword [0x413490], 0
mov ebx, dword [0x41354c]
dec ebx
cmp ebx, dword [0x413490]
jl 0x40184c
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413490]
call fcn.00408451
push 0x413528
call fcn.0040ef80
push dword [0x413528]
mov edx, dword [0x4134c0]
pop ecx
call fcn.0040f000
je 0x401810
mov dword [0x413480], 1
jmp 0x401840
mov ebx, dword [0x413480]
cmp ebx, 1
jne 0x401840
mov edx, dword [0x413528]
push dword [0x413a90]
call fcn.0040f030
push 0x41356c
call fcn.0040ef80
mov dword [0x413480], 0
inc dword [0x413490]
jno 0x4017c4
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
call sub.KERNEL32.DLL_GetCommandLineA
push eax
call fcn.0040c1c0
inc dword [0x413a90]
mov edx, dword [0x412324]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x413a90]
push eax
call fcn.0040c1c0
push 0x4134d0
call fcn.0040ef80
mov edx, dword [0x413548]
push dword [0x413a90]
call fcn.0040f030
mov edx, str.__BFINOPSX
call fcn.0040f030
mov edx, dword [0x4134d0]
call fcn.0040f030
push 0x4134d0
call fcn.0040ef80
jmp 0x4018e4
mov edx, dword [0x413548]
push dword [0x413a90]
call fcn.0040f030
push 0x4134d0
call fcn.0040ef80
push 0x41202f
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x40190f
mov eax, dword [0x413448]
mov dword [0x413518], eax
push dword [0x413518]
call fcn.004033a0
jmp 0x40192f
push 0x10
push dword [0x413508]
push dword [0x413578]
call fcn.00408010
push 1
jmp 0x4026db
push 0x41202d
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x401968
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x41345c]
push dword [0x413448]
call fcn.0040c150
push 0x413500
call fcn.0040ef80
jmp 0x401988
push 0x10
push dword [0x413508]
push dword [0x413578]
call fcn.00408010
push 1
jmp 0x4026db
push 0x412027
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x4019bc
mov eax, dword [0x413448]
mov dword [0x413494], eax
mov eax, dword [0x41345c]
mov dword [0x41344c], eax
mov eax, dword [0x413494]
mov dword [0x413558], eax
jmp 0x4019dc
push 0x10
push dword [0x413508]
push dword [0x413578]
call fcn.00408010
push 1
jmp 0x4026db
push 0x41202b
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x401a0e
mov eax, dword [0x413448]
mov dword [0x4134a8], eax
mov eax, dword [0x41345c]
mov dword [0x4134b8], eax
mov eax, dword [0x4134a8]
mov dword [0x413514], eax
push 0x412029
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x401a40
mov eax, dword [0x413448]
mov dword [0x4134a4], eax
mov eax, dword [0x41345c]
mov dword [0x413450], eax
mov eax, dword [0x4134a4]
mov dword [0x413580], eax
push 0x412031
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x401cd8
mov edx, dword [0x41356c]
xor ecx, ecx
call fcn.0040f000
jne 0x401a87
mov edx, dword [0x41356c]
push dword [0x413a90]
call fcn.0040f030
push 0x413534
call fcn.0040ef80
jmp 0x401bfb
push 0xc80001
push dword [0x413564]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.0040aaa0
push dword [0x4134c8]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00409c83
push 0x20
push 0x41201e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00409e5c
push 0x412053
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.0040a169
push 4
push 0xd
push 0
call fcn.0040aac3
push 2
call fcn.0040a189
call fcn.0040acc7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401b67
push dword [0x413574]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 0
jmp 0x4026db
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401baf
call fcn.0040cdec
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401bac
mov edx, dword [0x413a90]
push edx
push edx
push 2
call fcn.0040a1c4
push 0x413534
call fcn.0040ef80
push 0
call fcn.0040a663
add esp, 8
jmp 0x401bfb
pop eax
jmp 0x401bf5
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401bf5
call fcn.0040cdfb
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401bf4
mov edx, dword [0x413a90]
push edx
push edx
push 2
call fcn.0040a1c4
push 0x413534
call fcn.0040ef80
push 0
call fcn.0040a663
add esp, 8
jmp 0x401bfb
pop eax
pop eax
jmp 0x401b3d
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413534]
call fcn.004052c0
push eax
mov eax, dword [0x413534]
push eax
call fcn.0040d7d0
inc dword [0x413a90]
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x41345c]
push dword [0x413448]
call fcn.0040c150
pop edx
pop ecx
mov dword [0x413a90], ecx
add ecx, dword [0x412324]
add edx, dword [0x412324]
call fcn.0040f000
jne 0x401c7f
push 0x10
push dword [0x413544]
push dword [0x413578]
call fcn.00408010
push dword [0x413574]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 1
jmp 0x4026db
push 0x412033
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x401c9d
mov eax, dword [0x413448]
mov dword [0x413554], eax
push dword [0x413450]
push dword [0x4134b8]
push dword [0x41344c]
push dword [0x413554]
push dword [0x4134a4]
push dword [0x4134a8]
push dword [0x413494]
push dword [0x413534]
push dword [0x4134e4]
call fcn.00403e0f
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x41344c]
push dword [0x413558]
call fcn.0040c150
push 0x4134fc
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x4134b8]
push dword [0x413514]
call fcn.0040c150
push 0x413474
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push 0
call fcn.00408451
inc dword [0x413a90]
mov edx, dword [0x413504]
pop ecx
mov dword [0x413a90], ecx
add ecx, dword [0x412324]
call fcn.0040f000
je 0x401d62
mov ebx, dword [0x41354c]
cmp ebx, 1
jne 0x401d62
mov eax, 1
jmp 0x401d64
xor eax, eax
and eax, eax
je 0x401e75
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
call fcn.0040c365
inc dword [0x413a90]
push dword [0x41353c]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.00408083
push 0x41346c
call fcn.0040ef80
mov edx, dword [0x41346c]
xor ecx, ecx
call fcn.0040f000
jne 0x401e23
mov edx, dword [0x41346c]
push dword [0x413a90]
call fcn.0040f030
push 0x4134f8
call fcn.0040ef80
push dword [0x4134f8]
call fcn.0040c3a5
mov edx, dword [0x413474]
xor ecx, ecx
call fcn.0040f000
jne 0x401df5
push dword [0x413474]
call fcn.004034ce
push dword [0x413500]
push 1
call fcn.0040c870
and eax, eax
je 0x401e23
push dword [0x4134fc]
push 1
call fcn.0040c9f0
push 1
call fcn.0040c650
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
call fcn.004084b2
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c3b7
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c3a5
pop dword [0x413a90]
push dword [0x413574]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 0
jmp 0x4026db
push 0x412035
push dword [0x4134e4]
call fcn.00403c04
and eax, eax
je 0x401fc9
push 0x400
call fcn.0040c110
mov dword [0x4134d8], eax
mov edx, dword [0x413a90]
push edx
push edx
call fcn.0040c42d
push 0x413588
call fcn.0040ef80
push dword [0x4134d8]
push 0
push 0x41201e
push dword [0x413588]
call sub.KERNEL32.DLL_GetTempFileNameA
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x4134d8]
call fcn.0040c1c0
push 0x413570
call fcn.0040ef80
push dword [0x4134d8]
call fcn.0040c210
push dword [0x413570]
call fcn.0040c4bc
push dword [0x413570]
call fcn.0040c4ca
push dword [0x413570]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x413570]
push dword [0x413a90]
call fcn.0040f030
mov edx, dword [0x41352c]
call fcn.0040f030
mov edx, str..exe
call fcn.0040f030
push 0x4134f0
call fcn.0040ef80
push dword [0x4134f0]
push 0
call fcn.0040c870
push dword [0x41345c]
push dword [0x413448]
push 0
call fcn.0040ca70
push 0
call fcn.0040c650
mov edx, dword [0x4134f0]
push dword [0x413a90]
call fcn.0040f030
push 0x4134e8
call fcn.0040ef80
push dword [0x4134e8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x4134e8]
push dword [0x4134bc]
call fcn.0040850d
push dword [0x4134b4]
push dword [0x41352c]
call fcn.0040850d
mov dword [0x413458], 1
mov edx, dword [0x413574]
push dword [0x413a90]
call fcn.0040f030
mov edx, 0x412025
call fcn.0040f030
mov edx, dword [0x413500]
call fcn.0040f030
push 0x413500
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413478
call fcn.0040ef80
push dword [0x413a90]
push dword [0x413478]
push 0
push 0x41201e
mov edx, dword [0x413574]
push dword [0x413a90]
call fcn.0040f030
mov edx, 0x412025
call fcn.0040f030
inc dword [0x413a90]
mov edx, dword [0x412324]
add dword [esp], edx
call sub.KERNEL32.DLL_GetTempFileNameA
pop dword [0x413a90]
push dword [0x413478]
call fcn.0040c4bc
push str..bat
push dword [0x413478]
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov edx, dword [0x413478]
push dword [0x413a90]
call fcn.0040f030
push 0x413500
call fcn.0040ef80
push dword [0x413500]
push 1
call fcn.0040c870
and eax, eax
je 0x40223e
push dword [0x413510]
push 1
call fcn.0040cad0
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
call sub.KERNEL32.DLL_GetCommandLineA
push eax
call fcn.0040c1c0
inc dword [0x413a90]
mov edx, dword [0x412324]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x413a90]
push eax
call fcn.0040c1c0
inc dword [0x413a90]
push dword [0x413550]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413a90]
push dword [0x4134fc]
push 1
call fcn.0040cad0
mov ebx, dword [0x413458]
cmp ebx, 1
jne 0x402232
mov edx, dword [0x413a90]
push edx
push edx
mov ebp, 0x412129
mov ebx, ebp
mov ebp, 0x41207c
sub ebx, ebp
push ebx
mov ebp, 0x41207c
push ebp
call fcn.0040c150
push 0x4134ac
call fcn.0040ef80
push dword [0x4134ac]
call fcn.004052c0
mov dword [0x4134e0], eax
push dword [0x4134e0]
call fcn.0040c110
mov dword [0x4134ec], eax
push dword [0x4134e0]
call fcn.0040c110
mov dword [0x4134c4], eax
push dword [0x4134ac]
push dword [0x4134ec]
call fcn.0040c230
mov dword [0x413490], 0
mov eax, dword [0x4134e0]
cmp eax, dword [0x413490]
jl 0x4021f9
mov ebx, dword [0x4134ec]
add ebx, dword [0x413490]
mov eax, ebx
call fcn.0040c130
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x4134c4]
add ebx, dword [0x413490]
mov eax, ebx
call fcn.0040c140
inc dword [0x413490]
jno 0x4021b8
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
push dword [0x4134c4]
call fcn.0040c1c0
inc dword [0x413a90]
push 1
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040cad0
pop dword [0x413a90]
push 1
call fcn.0040c650
jmp 0x402279
push dword [0x413500]
call fcn.0040c4bc
call fcn.004040bc
push 0x10
push dword [0x413508]
push dword [0x413578]
call fcn.00408010
push dword [0x413574]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 1
jmp 0x4026db
mov edx, dword [0x413474]
xor ecx, ecx
call fcn.0040f000
jne 0x402293
push dword [0x413474]
call fcn.004034ce
push 0x400
call fcn.0040c110
mov dword [0x413568], eax
mov edx, dword [0x413a90]
push edx
push edx
call fcn.0040c42d
push 0x413464
call fcn.0040ef80
push dword [0x413568]
push 0
push 0x41201e
push dword [0x413464]
call sub.KERNEL32.DLL_GetTempFileNameA
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413568]
call fcn.0040c1c0
push 0x413584
call fcn.0040ef80
mov edx, dword [0x413a90]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x41351c
call fcn.0040ef80
push dword [0x413a90]
push 0x800
push dword [0x41351c]
mov edx, dword [0x413a90]
push edx
push edx
call fcn.004084b2
inc dword [0x413a90]
mov edx, dword [0x412324]
add dword [esp], edx
call sub.KERNEL32.DLL_GetShortPathNameA
pop dword [0x413a90]
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
call fcn.004084b2
inc dword [0x413a90]
push dword [0x413470]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413a90]
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
call fcn.004084b2
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c5e8
inc dword [0x413a90]
push dword [0x4134d4]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413a90]
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
call fcn.004084b2
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c3b7
inc dword [0x413a90]
push dword [0x41357c]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413a90]
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
push dword [0x41351c]
call fcn.00405190
inc dword [0x413a90]
push dword [0x413484]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413a90]
mov edx, dword [0x4134f8]
push dword [0x413a90]
call fcn.0040f030
push 0x41359c
call fcn.0040ef80
push dword [0x41359c]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x41359c]
push dword [0x41358c]
call fcn.0040850d
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
mov eax, dword [0x413460]
cdq
push edx
push eax
call fcn.004054a0
inc dword [0x413a90]
push dword [0x413540]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413a90]
push dword [0x413584]
push dword [0x4134dc]
call fcn.0040850d
call fcn.00403bd0
and eax, eax
je 0x4024e7
call fcn.0040a54f
mov ebx, eax
cmp ebx, 0x41
je 0x4024e7
mov eax, 1
jmp 0x4024e9
xor eax, eax
and eax, eax
je 0x402556
mov edx, dword [0x413a90]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413594
call fcn.0040ef80
push 0x800
push dword [0x413594]
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push dword [0x413594]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x413594]
push dword [0x413a90]
call fcn.0040f030
mov edx, str.sysnative
call fcn.0040f030
push 0x413594
call fcn.0040ef80
push dword [0x413594]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x40258d
mov edx, dword [0x413a90]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413594
call fcn.0040ef80
push 0x800
push dword [0x413594]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [0x413594]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x413500]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x413500]
push dword [0x413a90]
call fcn.0040f030
mov edx, str.__BFINOPSX
call fcn.0040f030
mov edx, dword [0x4134d0]
call fcn.0040f030
push 0x4134d0
call fcn.0040ef80
push dword [0x4134d0]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x413a90]
mov edx, dword [0x413560]
push dword [0x413a90]
call fcn.0040f030
mov edx, str.__BFINOPSX
call fcn.0040f030
mov edx, dword [0x4134d0]
call fcn.0040f030
inc dword [0x413a90]
push dword [0x4134f8]
mov edx, dword [0x413594]
push dword [0x413a90]
call fcn.0040f030
mov edx, dword [0x4134cc]
call fcn.0040f030
mov edx, dword [0x412324]
add dword [esp], edx
mov edx, dword [0x412324]
add dword [esp + 8], edx
call fcn.004032be
pop dword [0x413a90]
mov dword [0x413488], eax
call fcn.004040bc
push dword [0x413500]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x413500]
call fcn.0040c4bc
push dword [0x413584]
call fcn.0040c4bc
push dword [0x4134f0]
call fcn.0040c4bc
mov edx, dword [0x413a90]
push edx
push edx
mov edx, dword [0x413a90]
push edx
push edx
push dword [0x413a90]
call fcn.004084b2
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c3b7
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c3a5
pop dword [0x413a90]
push dword [0x413570]
call sub.KERNEL32.DLL_RemoveDirectoryA
push dword [0x413574]
call sub.KERNEL32.DLL_RemoveDirectoryA
push dword [0x413488]
jmp 0x4026db
push 0
call 0x4026f5
call fcn.0040ef50
push dword [0x41343c]
call sub.KERNEL32.DLL_HeapDestroy
call sub.KERNEL32.DLL_ExitProcess
call fcn.0040930b
call fcn.00409540
call fcn.00409a11
call fcn.0040a779
call fcn.0040b7ef
call fcn.0040bfed
call fcn.0040c5fa
call fcn.0040c6c0
call fcn.0040d0ee
call fcn.0040c0c0
ret