Function at 0x401672
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x174]
sub esp, 0x1bc
mov eax, dword [0x436b44]
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x170]
mov ecx, eax
mov esi, edx
shl ecx, 0xa
shl esi, 0xa
mov dword [ebp - 0x194], ecx
add ecx, section..ndata
lea ebx, [esi + section..ndata]
mov dword [ebp - 0x18c], ecx
lea ecx, [ebp - 0x170]
mov dword [0x41283c], ecx
mov ecx, dword [ebp - 0x174]
sub ecx, 2
cmp ecx, 0x41
ja case.0x4016e5.65
jmp dword [ecx*4 + 0x40b004]
mov dword [esp + 4], 0
mov dword [esp], edx
jmp 0x401cdc
inc dword [0x437380]
cmp dword [ebp - 0x190], 0
mov edx, 0x7fffffff
je case.0x4016e5.2
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push ebx
mov edx, 0x7fffffff
jmp case.0x4016e5.2
mov dword [esp], edx
call fcn.00401632
push edx
dec eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040389a
mov edx, eax
push ecx
push ecx
jmp case.0x4016e5.2
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.00406df9
jmp 0x403829
mov dword [esp], 0
call fcn.0040146e
test eax, eax
push edi
mov edx, 1
cmovle eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4021c1
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4021c1
cmp dword [ebp - 0x168], 0
jne 0x4017cf
mov eax, dword [edx*4 + 0x436a38]
mov dword [esp], 1
mov dword [ebp - 0x18c], edx
mov dword [edx*4 + 0x436a00], eax
call fcn.0040146e
mov edx, dword [ebp - 0x18c]
push esi
jmp 0x4017d6
mov eax, dword [edx*4 + 0x436a00]
mov dword [edx*4 + 0x436a38], eax
jmp case.0x4016e5.65
mov ecx, dword [ebp - 0x168]
xor edx, edx
mov eax, dword [ecx*4 + 0x436a38]
test eax, eax
sete dl
and eax, dword [ebp - 0x164]
mov edx, dword [ebp + edx*4 - 0x170]
mov dword [ecx*4 + 0x436a38], eax
jmp case.0x4016e5.2
mov eax, dword [eax*4 + 0x436a38]
jmp 0x402556
mov edx, dword [0x437384]
test edx, edx
je 0x401834
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
mov eax, dword [0x437388]
test eax, eax
je case.0x4016e5.65
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x402593
mov dword [esp], 0xfffffff0
call fcn.00401418
mov edx, dword [ebp - 0x16c]
push ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401b17
mov dword [esp], 0xfffffff0
call fcn.00401418
push edi
mov ebx, eax
xor edi, edi
mov dword [esp], eax
call fcn.0040775e
push edx
test eax, eax
je 0x40191d
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call fcn.004076cd
push esi
push esi
mov esi, eax
mov al, byte [eax]
mov byte [esi], 0
test al, al
mov byte [ebp - 0x18c], al
jne 0x4018de
cmp dword [ebp - 0x168], 0
je 0x4018de
call fcn.0040811e
test eax, eax
je 0x4018de
mov dword [esp], ebx
call fcn.004074d8
test eax, eax
push ecx
jne 0x4018eb
jmp 0x40191a
mov dword [esp], ebx
call fcn.00407573
test eax, eax
push edx
je 0x401908
cmp eax, 0xb7
je 0x4018f5
inc edi
jmp 0x401908
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
push ecx
cmp eax, 1
adc edi, 0
mov cl, byte [ebp - 0x18c]
lea eax, [esi + 1]
mov byte [esi], cl
test cl, cl
jmp 0x401894
mov byte [esi], 0
cmp dword [ebp - 0x16c], 0
je 0x40195a
mov dword [esp], 0xffffffe6
call fcn.00401653
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x43f800
call fcn.00407adf
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 1
push edx
adc edi, 0
jmp 0x403886
mov dword [esp], 0xfffffff5
jmp 0x4036d5
mov dword [esp], 0
call fcn.00401418
push ecx
mov dword [esp], eax
call fcn.00407f51
jmp 0x402375
mov dword [esp], 0xffffffd0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0xffffffdf
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 0x13
call fcn.00401418
push edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
push edx
push edx
je 0x4019ca
mov dword [esp], 0xffffffe3
jmp 0x402bf2
cmp dword [ebp - 0x168], 0
je 0x402a62
mov dword [esp], ebx
call fcn.00407f51
test eax, eax
push edi
je 0x402a62
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00408144
push ebx
push ebx
mov dword [esp], 0xffffffe4
jmp 0x402bf2
mov dword [esp], 0
call fcn.00401418
mov ebx, eax
push ecx
lea eax, [ebp - 0x158]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], 0x400
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x401a74
mov eax, dword [ebp - 0x158]
xor edi, edi
cmp eax, ebx
jbe 0x401a86
cmp byte [eax], 0
je 0x401a86
mov dword [esp], ebx
call fcn.00407f51
test eax, eax
push edx
je 0x401a74
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call fcn.00407adf
push eax
push eax
jmp 0x401a86
mov eax, dword [ebp - 0x194]
mov edi, 1
mov byte [eax + section..ndata], 0
cmp dword [ebp - 0x168], 0
jne 0x403886
mov eax, dword [ebp - 0x18c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 0xc
jmp 0x403886
mov dword [esp], 0xffffffff
call fcn.00401418
lea edx, [ebp - 0x158]
push edi
xor edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
sub esp, 0x18
test eax, eax
jmp 0x402df0
mov dword [esp], 0xffffffef
call fcn.00401418
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004078fd
push edx
push edx
jmp 0x402d72
mov dword [esp], 0x31
call fcn.00401418
push ebx
mov ebx, dword [ebp - 0x170]
mov esi, eax
mov dword [esp], eax
call fcn.00407730
and ebx, 7
test eax, eax
push edi
je 0x401b55
mov dword [esp + 4], esi
mov dword [esp], 0x412840
call fcn.00407adf
jmp 0x401b80
mov dword [esp + 4], 0x43f800
mov dword [esp], 0x412840
call fcn.00407adf
push edx
push edx
mov dword [esp], eax
call fcn.00407b1d
push ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407b12
push edi
push edi
mov dword [esp], 0x412840
call fcn.00407b62
cmp ebx, 2
push eax
jle 0x401bd2
mov dword [esp], 0x412840
call fcn.00407f51
mov edx, eax
xor eax, eax
push ecx
test edx, edx
je 0x401bc1
lea eax, [ebp - 0x164]
add edx, 0x14
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push edx
push edx
sub ebx, 3
or ebx, 0x80000000
test eax, ebx
sete bl
movzx ebx, bl
test ebx, ebx
jne 0x401bea
mov dword [esp], 0x412840
call fcn.0040786f
mov eax, 2
push edi
jmp 0x401bf3
xor eax, eax
cmp ebx, 1
setne al
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x412840
call fcn.004078a1
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
jne 0x401ce6
test ebx, ebx
je 0x401c3f
mov dword [esp + 4], esi
mov dword [esp], 0xffffffe2
call fcn.00406df9
push ecx
push ecx
cmp ebx, 2
sete al
movzx eax, al
mov edi, eax
jmp 0x403886
mov dword [esp + 4], section..ndata
mov dword [esp], 0x413040
call fcn.00407adf
push eax
push eax
mov dword [esp + 4], 0x412840
mov dword [esp], section..ndata
call fcn.00407adf
push eax
push eax
mov eax, dword [ebp - 0x15c]
mov dword [esp], 0x412c40
mov dword [esp + 4], eax
call fcn.00407c2f
push eax
push eax
mov dword [esp + 4], 0x413040
mov dword [esp], section..ndata
call fcn.00407adf
push eax
push eax
mov eax, dword [ebp - 0x170]
mov dword [esp], 0x412c40
sar eax, 3
mov dword [esp + 4], eax
call fcn.0040765f
cmp eax, 4
push edx
push edx
je 0x401bd6
cmp eax, 5
jne 0x401ccd
inc dword [0x436a40]
jmp 0x40388c
mov dword [esp + 4], 0x412840
mov dword [esp], 0xfffffffa
call fcn.00406df9
jmp 0x40214d
mov dword [esp + 4], esi
mov dword [esp], 0xffffffea
call fcn.00406df9
push eax
push eax
mov eax, dword [ebp - 0x168]
inc dword [0x436a6c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00403b47
dec dword [0x436a6c]
sub esp, 0x10
cmp dword [ebp - 0x164], 0xffffffff
mov ebx, eax
jne 0x401d3d
cmp dword [ebp - 0x160], 0xffffffff
je 0x401d5f
lea eax, [ebp - 0x164]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
push eax
jns case.0x4016e5.65
cmp ebx, 0xfffffffe
jne 0x401d9e
mov dword [esp + 4], 0xffffffe9
mov dword [esp], 0x412840
call fcn.00407c2f
push edi
push edi
mov dword [esp + 4], esi
mov dword [esp], 0x412840
call fcn.00407b12
jmp 0x401db2
mov dword [esp + 4], 0xffffffee
mov dword [esp], 0x412840
call fcn.00407c2f
push ebx
push ebx
mov dword [esp + 4], 0x200010
mov dword [esp], 0x412840
jmp 0x402148
mov dword [esp], 0
jmp 0x401e24
mov dword [esp], 0x31
call fcn.00401418
push edx
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0040765f
test eax, eax
push ecx
push ecx
je 0x402a62
cmp eax, dword [ebp - 0x168]
je 0x402007
cmp eax, dword [ebp - 0x160]
jne case.0x4016e5.65
mov edx, dword [ebp - 0x15c]
jmp case.0x4016e5.2
mov dword [esp], 0xfffffff0
call fcn.00401418
mov edx, dword [ebp - 0x16c]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004083eb
jmp 0x403829
mov dword [esp], 1
call fcn.00401418
push esi
mov dword [esp], eax
call fcn.00407b07
jmp 0x402555
mov dword [esp], 2
call fcn.0040146e
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.0040146e
push edx
mov dword [ebp - 0x190], eax
mov dword [esp], 1
call fcn.00401418
test edi, edi
push ecx
mov byte [esi + section..ndata], 0
mov ecx, eax
setne byte [ebp - 0x18c]
mov edx, dword [ebp - 0x190]
jne 0x401eb1
cmp dword [ebp - 0x168], 0
jne case.0x4016e5.65
mov dword [esp], ecx
mov dword [ebp - 0x194], edx
mov dword [ebp - 0x190], ecx
call fcn.00407b07
push edx
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x190]
test edx, edx
jns 0x401ede
add edx, eax
js case.0x4016e5.65
cmp edx, eax
mov dword [esp], ebx
cmovle eax, edx
add eax, ecx
mov dword [esp + 4], eax
call fcn.00407adf
cmp byte [ebp - 0x18c], 0
push ecx
push ecx
je case.0x4016e5.65
test edi, edi
jns 0x401f11
mov dword [esp], ebx
call fcn.00407b07
add edi, eax
push edx
js 0x401f1f
cmp edi, 0x3ff
jg case.0x4016e5.65
jmp 0x401f21
xor edi, edi
mov byte [edi + esi + section..ndata], 0
jmp case.0x4016e5.65
mov dword [esp], 0x20
call fcn.00401418
push ebx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401418
cmp dword [ebp - 0x160], 0
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x401f62
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x401f68
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push ecx
push ecx
jne 0x402007
jmp 0x402385
mov dword [esp], 1
call fcn.00401418
push edx
mov edi, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
test eax, eax
jne 0x401fb0
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x401fd2
cmp dword [ebp - 0x168], 0
jne 0x401fbd
xor edi, edi
jmp 0x401fd2
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push edi
push edi
je 0x401fa2
jmp 0x401fb9
mov byte [ebx + 0x3ff], 0
jmp 0x403886
mov dword [esp], 0
call fcn.0040146e
push ebx
mov ebx, eax
mov dword [esp], 1
call fcn.0040146e
cmp dword [ebp - 0x15c], 0
push esi
jne 0x402023
cmp ebx, eax
jge 0x402012
mov edx, dword [ebp - 0x164]
jmp case.0x4016e5.2
jle 0x402385
mov edx, dword [ebp - 0x160]
jmp case.0x4016e5.2
cmp ebx, eax
jb 0x402007
ja 0x402018
jmp 0x402385
mov dword [esp], 1
xor edi, edi
call fcn.0040146e
push edx
mov esi, eax
mov dword [esp], 2
call fcn.0040146e
cmp dword [ebp - 0x164], 0xc
push ecx
mov ecx, eax
ja case.default.0x40205d
mov eax, dword [ebp - 0x164]
jmp dword [eax*4 + 0x40b10c]
add esi, ecx
jmp 0x4020c0
sub esi, ecx
jmp 0x4020c0
imul esi, ecx
jmp 0x4020c0
test ecx, ecx
je 0x4020c4
mov eax, esi
cdq
idiv ecx
jmp 0x402097
or esi, ecx
jmp 0x4020c0
and esi, ecx
jmp 0x4020c0
xor esi, ecx
jmp 0x4020c0
test esi, esi
sete al
jmp 0x402094
or ecx, esi
setne al
movzx eax, al
mov esi, eax
jmp 0x4020c0
test ecx, ecx
setne al
xor edx, edx
test esi, esi
setne dl
mov esi, edx
and esi, eax
jmp 0x4020c0
test ecx, ecx
je 0x4020c4
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x4020c0
shl esi, cl
jmp 0x4020c0
sar esi, cl
xor edi, edi
jmp case.default.0x40205d
xor esi, esi
mov edi, 1
mov dword [esp + 4], esi
jmp 0x402350
mov dword [esp], 1
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 2
call fcn.0040146e
push edi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp case.0x4016e5.65
mov edx, dword [ebp - 0x168]
mov esi, dword [0x413c40]
test edx, edx
je 0x402194
mov eax, edx
dec eax
test esi, esi
je 0x402127
test eax, eax
mov esi, dword [esi]
jne 0x402118
test esi, esi
jne 0x402154
mov dword [esp + 4], 0xffffffe8
mov dword [esp], 0
call fcn.00407c2f
push edx
push edx
mov dword [esp + 4], 0x200010
mov dword [esp], eax
call fcn.0040765f
push eax
push eax
jmp 0x401722
add esi, 4
mov dword [esp], 0x412840
mov dword [esp + 4], esi
call fcn.00407adf
push eax
push eax
mov eax, dword [0x413c40]
mov dword [esp], esi
add eax, 4
mov dword [esp + 4], eax
call fcn.00407adf
push eax
push eax
mov eax, dword [0x413c40]
mov dword [esp + 4], 0x412840
add eax, 4
jmp 0x403727
test eax, eax
je 0x4021c7
test esi, esi
je 0x402a62
lea eax, [esi + 4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407adf
push edi
push edi
mov eax, dword [esi]
mov dword [esp], esi
mov dword [0x413c40], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
jmp case.0x4016e5.65
mov dword [esp + 4], 0x404
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x170]
push edx
push edx
mov dword [esp + 4], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.00407c2f
mov eax, dword [0x413c40]
push ecx
push ecx
mov dword [ebx], eax
mov dword [0x413c40], ebx
jmp case.0x4016e5.65
mov dword [esp], 3
call fcn.0040146e
push ecx
mov esi, eax
mov dword [esp], 4
call fcn.0040146e
test byte [ebp - 0x15c], 1
push edi
mov edi, eax
je 0x40223f
mov dword [esp], 0x33
call fcn.00401418
push edx
mov esi, eax
test byte [ebp - 0x15c], 2
je 0x402257
mov dword [esp], 0x44
call fcn.00401418
push edi
mov edi, eax
cmp dword [ebp - 0x174], 0x21
mov dword [esp], 1
jne 0x4022ec
call fcn.0040146e
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 2
call fcn.0040146e
mov edx, dword [ebp - 0x15c]
push ecx
sar edx, 2
je 0x4022cf
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x158]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
sub esp, 0x1c
test eax, eax
sete al
movzx eax, al
mov edi, eax
jmp 0x402339
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40232e
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x12
call fcn.00401418
push ecx
xor ecx, ecx
cmp byte [eax], 0
mov edx, dword [ebp - 0x18c]
cmove eax, ecx
cmp byte [edx], 0
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], esi
cmove edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_FindWindowExA]
sub esp, 0x10
mov dword [ebp - 0x158], eax
xor edi, edi
cmp dword [ebp - 0x170], 0
js 0x403886
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407a0c
push esi
push esi
jmp 0x403886
mov dword [esp], 0
call fcn.0040146e
push ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
push ecx
je 0x402385
mov edx, dword [ebp - 0x16c]
jmp case.0x4016e5.2
mov edx, dword [ebp - 0x168]
jmp case.0x4016e5.2
mov dword [esp], 2
call fcn.0040146e
push esi
mov esi, eax
mov dword [esp], 1
call fcn.0040146e
push edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push edx
push edx
jmp 0x402556
add eax, dword [0x436ae8]
mov dword [esp], 0
mov ebx, eax
call fcn.0040146e
push ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x403881
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edx
lea eax, [ebp - 0x158]
push edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x168]
mov edi, dword [ebp - 0x14c]
mov ebx, dword [ebp - 0x150]
push ecx
push ecx
imul edi, edx
imul ebx, edx
mov dword [esp], 0
call fcn.00401418
push edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadImageA]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x172
mov dword [esp], esi
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
test eax, eax
je case.0x4016e5.65
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4021c1
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push edi
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edx
push edx
mov esi, eax
mov dword [esp], 2
call fcn.0040146e
push ecx
mov dword [esp + 4], esi
mov dword [esp + 8], 0x48
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esp, 0xc
neg eax
mov dword [esp], 3
mov dword [0x412800], eax
call fcn.0040146e
mov dword [0x412810], eax
mov eax, dword [ebp - 0x160]
push esi
mov byte [0x412817], 1
mov dl, al
mov dword [esp], 0x41281c
and edx, 1
mov byte [0x412814], dl
mov dl, al
and eax, 4
mov byte [0x412816], al
mov eax, dword [ebp - 0x16c]
and edx, 2
mov byte [0x412815], dl
mov dword [esp + 4], eax
call fcn.00407c2f
push edi
push edi
mov dword [esp], 0x412800
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407a0c
jmp 0x403829
mov dword [esp], 0
call fcn.0040146e
push edx
mov ebx, eax
mov dword [esp], 1
call fcn.0040146e
cmp dword [ebp - 0x164], 0
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x40259e
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403829
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x403829
mov dword [esp], 0
call fcn.00401418
push esi
mov edi, eax
mov dword [esp], 0x31
call fcn.00401418
push edx
mov esi, eax
mov dword [esp], 0x22
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], 0x15
call fcn.00401418
push eax
mov dword [esp], 0xffffffec
call fcn.00401653
xor edx, edx
push eax
cmp byte [ebx], 0
mov eax, dword [ebp - 0x164]
cmove ebx, edx
cmp byte [edi], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 0x10], 0x43f800
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
cmovne edx, edi
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
cmp eax, 0x20
setle al
jmp 0x401c35
mov dword [esp], 0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0xffffffeb
call fcn.00406df9
push ecx
push ecx
mov dword [esp], ebx
call fcn.004075a1
test eax, eax
push ebx
mov ebx, eax
je 0x402a62
cmp dword [ebp - 0x168], 0
je 0x4026d9
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], 0x64
mov dword [esp], ebx
call esi
cmp eax, 0x102
push edi
push edi
jne 0x4026a1
mov dword [esp], 0xf
call fcn.0040867b
push eax
jmp 0x40267c
lea eax, [ebp - 0x158]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x16c], 0
push esi
push esi
js 0x4026dd
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407a0c
push ecx
push ecx
xor edi, edi
jmp 0x4026eb
xor eax, eax
cmp dword [ebp - 0x158], 0
setne al
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4036da
mov dword [esp], 2
call fcn.00401418
push edi
mov dword [esp], eax
call fcn.00407f51
test eax, eax
push edx
mov edi, eax
je 0x402734
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00407a0c
push esi
push esi
mov eax, dword [edi + 0x18]
jmp 0x402556
mov eax, dword [ebp - 0x194]
mov byte [esi + section..ndata], 0
mov byte [eax + section..ndata], 0
jmp 0x402a62
mov dword [esp], 0xffffffee
call fcn.00401418
push edi
mov dword [ebp - 0x190], eax
mov dword [esp], 0xc
call fcn.004080cc
mov ecx, dword [ebp - 0x190]
push edx
lea edx, [ebp - 0x17c]
mov dword [esp + 4], edx
mov dword [esp], ecx
call eax
mov edi, eax
mov eax, dword [ebp - 0x194]
push ecx
test edi, edi
mov byte [esi + section..ndata], 0
push ecx
mov byte [eax + section..ndata], 0
je 0x402a62
mov dword [esp + 4], edi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
push esi
push esi
mov esi, eax
je 0x402a62
mov dword [esp], 0xd
call fcn.004080cc
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], 0xe
call fcn.004080cc
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x190]
push ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x194]
sub esp, 0x10
test eax, eax
jne 0x402812
mov edi, 1
jmp 0x402874
lea eax, [ebp - 0x158]
mov dword [esp + 4], 0x40b000
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x178]
mov dword [esp + 8], eax
call dword [ebp - 0x198]
sub esp, 0x10
test eax, eax
je 0x40280b
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407a0c
mov eax, dword [ebp - 0x178]
push edi
push edi
xor edi, edi
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407a0c
push eax
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4036da
cmp dword [0x436a70], 0
js 0x4029a2
mov dword [esp], 0xfffffff0
call fcn.00401418
push ebx
mov edi, eax
mov dword [esp], 1
call fcn.00401418
cmp dword [ebp - 0x160], 0
push esi
mov esi, eax
jne 0x4028de
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x402996
jmp 0x4028ee
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push ecx
mov ebx, eax
je 0x4028b6
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push edx
mov edi, eax
push edx
je 0x402953
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x402924
mov dword [esp], eax
call fcn.00401653
push eax
call edi
test eax, eax
setne al
movzx eax, al
mov edi, eax
jmp 0x40296a
mov eax, dword [ebp - 0x190]
mov dword [esp + 0x10], 0x40a000
mov dword [esp + 0xc], 0x413c40
mov dword [esp + 8], 0x43a000
mov dword [esp + 4], 0x400
mov dword [esp], eax
call edi
xor edi, edi
jmp 0x40296a
mov dword [esp + 4], esi
mov dword [esp], 0xfffffff7
call fcn.00406df9
push edi
push edi
mov edi, 1
cmp dword [ebp - 0x164], 0
jne 0x403886
mov dword [esp], ebx
call fcn.00404863
test eax, eax
push esi
je 0x403886
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4036da
mov dword [esp], 0xfffffff6
jmp 0x402a5c
mov dword [esp], 0xffffffe7
jmp 0x402a5c
mov dword [esp], 0xfffffff0
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdf
call fcn.00401418
push ecx
mov edi, eax
mov dword [esp], 2
call fcn.00401418
push ebx
mov dword [ebp - 0x190], eax
mov dword [esp], 0xffffffcd
call fcn.00401418
push esi
mov esi, eax
mov dword [esp], 0x45
call fcn.00401418
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], edi
call fcn.00407730
test eax, eax
push ecx
jne 0x402a1f
mov dword [esp], 0x21
call fcn.00401418
push eax
lea eax, [ebp - 0x178]
mov dword [esp + 0xc], 0x410b0c
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40c63c
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jns 0x402a6c
mov dword [esp], 0xfffffff0
call fcn.00401653
push ebx
mov edi, 1
jmp 0x403886
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x41015c
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov ebx, eax
js 0x402bd4
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x50]
mov ebx, eax
mov eax, dword [ebp - 0x178]
push edx
push edx
mov edx, dword [eax]
mov dword [esp + 4], 0x43f800
mov dword [esp], eax
call dword [edx + 0x24]
mov eax, dword [ebp - 0x160]
push ecx
push ecx
movzx eax, ah
test eax, eax
je 0x402ae7
mov edx, dword [ebp - 0x178]
mov ecx, dword [edx]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x3c]
push eax
push eax
mov eax, dword [ebp - 0x178]
movzx ecx, word [ebp - 0x15e]
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x34]
push eax
push eax
cmp byte [esi], 0
je 0x402b27
mov eax, dword [ebp - 0x178]
movzx ecx, byte [ebp - 0x160]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x190]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x178]
push edi
mov ecx, dword [ebp - 0x194]
push edi
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x1c]
test ebx, ebx
push eax
push eax
js 0x402bc5
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x14], 0x400
mov ebx, 0x80004005
mov dword [esp + 0x10], 0x412000
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
je 0x402bc5
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x412000
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
test ebx, ebx
push ecx
js 0x402a55
mov dword [esp], 0xfffffff4
call fcn.00401653
jmp 0x4021c1
mov dword [esp], 0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0x11
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 0x23
call fcn.00401418
push edi
mov edi, eax
mov dword [esp], ebx
call fcn.00407f51
test eax, eax
push edx
jne 0x402c51
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00406df9
push edi
push edi
jmp 0x402a62
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [ebp - 0x154], 2
mov dword [ebp - 0x158], eax
call fcn.00407b07
push edx
mov byte [ebx + eax + 1], 0
mov dword [esp], esi
call fcn.00407b07
push ecx
mov byte [esi + eax + 1], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x150], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x13e], edi
xor edi, edi
mov word [ebp - 0x148], ax
call fcn.00406df9
lea eax, [ebp - 0x158]
push ebx
push ebx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
push esi
je 0x403886
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00406df9
push eax
push eax
mov di, 1
jmp 0x403886
cmp edx, 0xbadf00d
jne 0x402127
inc dword [0x436a4c]
jmp case.0x4016e5.65
xor esi, esi
test edx, edx
je 0x402d19
mov dword [esp], 0
call fcn.00401418
push esi
mov esi, eax
xor edi, edi
cmp dword [ebp - 0x16c], 0
je 0x402d33
mov dword [esp], 0x11
call fcn.00401418
push ebx
mov edi, eax
xor ebx, ebx
cmp dword [ebp - 0x160], 0
je 0x402d4d
mov dword [esp], 0x22
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], 0xffffffcd
call fcn.00401418
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
sub esp, 0x10
test eax, eax
jmp 0x401c32
mov dword [esp], 1
mov dword [ebp - 0x158], 0x7e4e21
call fcn.00401418
push ecx
mov edi, eax
mov dword [esp], 0x12
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdd
call fcn.00401418
push ecx
mov edx, dword [ebp - 0x18c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x158]
mov dword [esp], edi
mov dword [esp + 0x10], 0x3ff
mov dword [esp + 0xc], ebx
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x158]
sub esp, 0x18
cmp dword [esi + section..ndata], eax
jne 0x403886
mov byte [esi + section..ndata], 0
jmp 0x402ce4
cmp dword [ebp - 0x160], 0
jne 0x402e4c
mov dword [esp], 2
call fcn.004015c8
test eax, eax
push edx
mov ebx, eax
je 0x402a62
mov dword [esp], 0x33
call fcn.00401418
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push edi
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x402e8d
mov dword [esp], 0x22
call fcn.00401418
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x16c]
push ebx
and ecx, 2
test edx, edx
jne 0x402e78
mov esi, dword [0x436a3c]
lea edx, [esi - 0x7fffffff]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0040149a
sub esp, 0xc
mov esi, eax
test esi, esi
setne al
jmp 0x401c35
test edx, edx
mov edi, edx
jne 0x402ea8
mov eax, dword [0x436a3c]
lea edi, [eax - 0x7fffffff]
mov dword [esp], 2
mov ebx, dword [ebp - 0x160]
mov esi, dword [ebp - 0x15c]
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x11
call fcn.00401418
push ecx
lea ecx, [ebp - 0x158]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x436a68]
mov dword [esp], edi
mov dword [esp + 0x20], 0
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
or ecx, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x403886
cmp ebx, 1
jne 0x402f52
mov dword [esp], 0x23
call fcn.00401418
push ebx
mov dword [esp], 0x413040
call fcn.00407b07
inc eax
push edi
jmp 0x402fa0
cmp ebx, 4
jne 0x402f70
mov dword [esp], 3
call fcn.0040146e
mov dword [0x413040], eax
push ecx
mov eax, 4
jmp 0x402fa0
xor eax, eax
cmp ebx, 3
jne 0x402fa0
mov eax, dword [ebp - 0x164]
mov dword [esp + 0xc], 0xc00
mov dword [esp + 8], 0x413040
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403b47
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x10], 0x413040
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
setne al
movzx eax, al
mov edi, eax
mov eax, dword [ebp - 0x158]
jmp 0x4030c7
mov dword [esp], 0x20019
call fcn.004015c8
push edi
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x33
call fcn.00401418
cmp dword [ebp - 0x18c], 0
push edx
mov byte [esi + section..ndata], 0
je 0x402a62
lea edx, [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x178], 0x3ff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x158]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x403076
mov eax, dword [ebp - 0x158]
cmp eax, 1
je 0x403084
cmp eax, 4
je 0x403084
cmp eax, 2
je 0x4030ad
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x4030c1
cmp eax, 4
jne 0x4030ad
xor eax, eax
cmp dword [ebp - 0x160], 0
mov dword [esp], ebx
sete al
mov edi, eax
mov eax, dword [esi + section..ndata]
mov dword [esp + 4], eax
call fcn.00407a0c
push ecx
push ecx
jmp 0x4030c1
mov eax, dword [ebp - 0x178]
mov edi, dword [ebp - 0x160]
mov byte [esi + eax + section..ndata], 0
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4036da
mov dword [esp], 0x20019
call fcn.004015c8
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.0040146e
test edi, edi
push edx
mov byte [esi + section..ndata], 0
je 0x402a62
cmp dword [ebp - 0x160], 0
mov dword [ebp - 0x158], 0x3ff
je 0x403131
mov dword [esp + 0xc], 0x3ff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
sub esp, 0x10
jmp 0x403177
lea edx, [ebp - 0x158]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
sub esp, 0x20
test eax, eax
jne 0x402a62
mov byte [ebx + 0x3ff], 0
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4021c1
cmp byte [esi + section..ndata], 0
je case.0x4016e5.65
mov dword [esp], ebx
call fcn.00407a31
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4021c1
mov dword [esp], 0xffffffed
call fcn.00401418
mov edx, dword [ebp - 0x168]
push edi
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x16c]
mov dword [esp + 4], edx
call fcn.004078a1
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402556
mov byte [esi + section..ndata], 0
jmp 0x402a62
cmp dword [ebp - 0x168], 0
je 0x403213
mov dword [esp], 1
call fcn.0040146e
mov byte [0x412c40], al
push ecx
mov ecx, 1
jmp 0x40322b
mov dword [esp], 0x11
call fcn.00401418
push edi
mov dword [esp], eax
call fcn.00407b07
push edx
mov ecx, eax
cmp byte [esi + section..ndata], 0
mov edi, 1
je 0x403886
mov dword [esp], ebx
mov dword [ebp - 0x18c], ecx
call fcn.00407a31
mov ecx, dword [ebp - 0x18c]
push ebx
lea edx, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x412c40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
jmp 0x402d72
mov dword [esp], 2
xor edi, edi
call fcn.0040146e
test eax, eax
push ecx
mov dword [ebp - 0x190], eax
jle 0x403886
cmp byte [esi + section..ndata], 0
je 0x4033b5
mov dword [esp], ebx
xor ebx, ebx
call fcn.00407a31
lea ecx, [ebp - 0x178]
push edx
mov esi, eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [ebp - 0x198], ecx
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x4033b5
cmp dword [ebp - 0x158], 1
jne 0x4033b5
cmp dword [ebp - 0x164], 0
mov ecx, dword [ebp - 0x198]
je 0x403332
movzx eax, byte [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407a0c
push esi
push esi
jmp 0x40388c
cmp bl, 0xa
mov al, byte [ebp - 0x178]
je 0x403342
cmp bl, 0xd
jne 0x403386
cmp bl, al
mov ecx, edi
je 0x403350
cmp al, 0xa
je 0x403376
cmp al, 0xd
je 0x403376
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x4033b5
mov ebx, dword [ebp - 0x194]
inc edi
mov byte [ecx + ebx + section..ndata], al
jmp 0x4033b5
mov ebx, dword [ebp - 0x18c]
inc edi
test al, al
mov byte [ebx + edi - 1], al
mov bl, al
je 0x4033b5
cmp dword [ebp - 0x190], 0x3ff
mov eax, 0x3ff
cmovle eax, dword [ebp - 0x190]
cmp edi, eax
jl 0x4032be
mov eax, dword [ebp - 0x194]
test edi, edi
mov byte [edi + eax + section..ndata], 0
jmp 0x401c32
cmp byte [esi + section..ndata], 0
je case.0x4016e5.65
mov dword [esp], 2
mov edi, dword [ebp - 0x164]
call fcn.0040146e
push ecx
mov esi, eax
mov dword [esp], ebx
call fcn.00407a31
push ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp dword [ebp - 0x16c], 0
js case.0x4016e5.65
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
jmp 0x40255d
cmp byte [esi + section..ndata], 0
je case.0x4016e5.65
mov dword [esp], ebx
call fcn.00407a31
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4021c1
mov eax, dword [ebp - 0x194]
cmp byte [eax + section..ndata], 0
je 0x4031e5
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407a31
lea edx, [ebp - 0x158]
push ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
push edi
push edi
je 0x4031e5
jmp 0x4034e2
mov dword [esp], 2
call fcn.00401418
lea edx, [ebp - 0x158]
push edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
push edx
push edx
jne 0x4034ce
mov eax, dword [ebp - 0x194]
mov byte [eax + section..ndata], 0
jmp 0x4031e5
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407a0c
push esi
push esi
lea eax, [ebp - 0x12c]
mov dword [esp], ebx
mov dword [esp + 4], eax
jmp 0x40372a
mov dword [esp], 0xfffffff0
call fcn.00401418
push edx
mov esi, eax
mov dword [esp], eax
call fcn.00407730
test eax, eax
push ecx
jne 0x40351d
mov dword [esp], 0xffffffed
call fcn.00401418
push eax
mov dword [esp], esi
call fcn.0040786f
push edi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call fcn.004078a1
sub esp, 0xc
mov dword [ebp - 0x18c], eax
inc eax
jne 0x403563
mov dword [esp], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xffffffef
push ebx
jmp 0x4036d2
mov eax, dword [0x436b0c]
mov dword [esp], 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x190], eax
mov dword [esp + 4], eax
call edi
test eax, eax
push ecx
mov ebx, eax
push ecx
mov edx, 0xfffffd66
je 0x4036a7
mov dword [esp], 0
call fcn.00403b15
push eax
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00403acd
push eax
push eax
mov eax, dword [ebp - 0x168]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call edi
test eax, eax
push edx
mov edi, eax
push edx
je 0x403640
mov eax, dword [ebp - 0x168]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call fcn.00403b47
mov edx, edi
sub esp, 0x10
cmp byte [edx], 0
je 0x403636
mov ecx, dword [edx]
lea eax, [edx + 8]
mov dword [esp + 4], eax
mov dword [ebp - 0x194], eax
mov dword [esp + 8], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x198], ecx
add eax, ebx
mov dword [esp], eax
call fcn.0040784c
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x198]
sub esp, 0xc
lea edx, [eax + ecx]
jmp 0x4035f7
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00403b47
sub esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x190], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x190]
push edi
test edx, edx
js 0x40354a
mov eax, 0xfffffff3
xor edi, edi
mov dword [esp], eax
call fcn.00401653
push ebx
jmp 0x403886
mov dword [esp], 0
call fcn.0040146e
cmp eax, dword [0x436acc]
push ecx
mov ebx, eax
jae 0x402a62
mov edx, dword [ebp - 0x168]
imul esi, eax, 0x418
add esi, dword [0x436ac8]
test edx, edx
js 0x403734
mov eax, dword [esi + edx*4]
jne 0x40341e
mov eax, dword [ebp - 0x18c]
add esi, 0x18
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407adf
jmp 0x403829
not edx
test edx, edx
mov dword [ebp - 0x168], edx
je 0x403755
mov dword [esp], 1
call fcn.0040146e
mov dword [ebp - 0x16c], eax
push edx
jmp 0x403773
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], eax
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.00407c2f
push edi
push edi
or dword [esi + 8], 0x100
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x16c]
mov dword [esi + eax*4], edx
cmp dword [ebp - 0x164], 0
je case.0x4016e5.65
mov dword [esp], ebx
call fcn.00401234
jmp 0x4021c1
mov dword [esp], 0
call fcn.0040146e
cmp eax, 0x1f
push ebx
ja 0x402a62
cmp dword [ebp - 0x164], 0
je 0x4037f5
cmp dword [ebp - 0x168], 0
je 0x4037e3
mov dword [esp], eax
call fcn.00401349
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00401299
jmp 0x403829
mov dword [esp], 0
call fcn.00401393
push edx
jmp 0x40341e
cmp dword [ebp - 0x168], 0
mov edx, dword [0x436a80]
lea eax, [eax + 0x24]
je 0x403813
mov ecx, dword [ebp - 0x16c]
mov dword [edx + eax*4 + 4], ecx
jmp case.0x4016e5.65
mov eax, dword [edx + eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407c2f
push eax
push eax
jmp case.0x4016e5.65
and edx, dword [0x431d00]
mov eax, dword [ebp - 0x190]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0xb
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
cmp dword [ebp - 0x170], 0
je case.0x4016e5.65
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
xor edi, edi
add dword [0x436a40], edi
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 4