Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3f4
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3f8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3f4], eax
call section..text
call fcn.0040ae30
call fcn.0040acdc
call fcn.00409203
call fcn.00408d33
call fcn.004086e0
call fcn.00408369
call fcn.004081b0
call fcn.00408192
call fcn.00408109
call fcn.00407871
call fcn.004068a0
call fcn.00405ab1
call fcn.00405849
call fcn.00404f15
call fcn.00404b8d
push dword [0x40e4ec]
call fcn.00405868
push 7
push 0x40d284
lea eax, [0x40e4ec]
push eax
push 8
call fcn.004057b7
push 0x40e4e4
push 0x40d28c
push 7
push 0x401
push 8
call fcn.0040abdd
mov edx, str.Continue_
lea ecx, [0x40e40c]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e4d0]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e438]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e47c]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e4a4]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e480]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e410]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e424]
call fcn.00404068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40e478]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40e4b8]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40e4a0]
call fcn.00404068
mov edx, str.Password
lea ecx, [0x40e4bc]
call fcn.00404068
mov edx, str.Please_enter_the_password.
lea ecx, [0x40e450]
call fcn.00404068
call fcn.0040665f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40e4b8]
push dword [0x40e4d0]
call fcn.00404bc4
jmp 0x401ff7
lea eax, [0x403274]
push eax
call fcn.00405650
call fcn.00405053
mov dword [0x40e4ac], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e45c], eax
mov edx, dword [0x40e7c8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004081e0
push 0x40e4a8
call fcn.0040aeb0
push dword [0x40e4a8]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x40e4ac]
and ebx, ebx
jle 0x401333
mov dword [0x40e43c], 0
mov ebx, dword [0x40e4ac]
dec ebx
cmp ebx, dword [0x40e43c]
jl 0x4012b6
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e43c]
call fcn.00405005
push 0x40e494
call fcn.0040aeb0
push dword [0x40e494]
mov edx, str._b2epass
pop ecx
call fcn.0040af30
je 0x40127a
mov dword [0x40e430], 1
jmp 0x4012aa
mov ebx, dword [0x40e430]
cmp ebx, 1
jne 0x4012aa
mov edx, dword [0x40e494]
push dword [0x40e7c8]
call fcn.0040af60
push 0x40e4c4
call fcn.0040aeb0
mov dword [0x40e430], 0
inc dword [0x40e43c]
jno 0x40122f
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004081e0
inc dword [0x40e7c8]
mov edx, dword [0x40d344]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e7c8]
push eax
call fcn.004081e0
push 0x40e454
call fcn.0040aeb0
mov edx, dword [0x40e4a8]
push dword [0x40e7c8]
call fcn.0040af60
mov edx, 0x40d01f
call fcn.0040af60
mov edx, dword [0x40e454]
call fcn.0040af60
push 0x40e454
call fcn.0040aeb0
jmp 0x40134e
mov edx, dword [0x40e4a8]
push dword [0x40e7c8]
call fcn.0040af60
push 0x40e454
call fcn.0040aeb0
push 0x40d085
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401379
mov eax, dword [0x40e400]
mov dword [0x40e48c], eax
push dword [0x40e48c]
call fcn.00403297
jmp 0x401399
push 0x10
push dword [0x40e478]
push dword [0x40e4d0]
call fcn.00404bc4
push 1
jmp 0x401ffc
push str.NOPSX
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x4013d2
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e414]
push dword [0x40e400]
call fcn.00408230
push 0x40e474
call fcn.0040aeb0
jmp 0x4013f2
push 0x10
push dword [0x40e478]
push dword [0x40e4d0]
call fcn.00404bc4
push 1
jmp 0x401ffc
push 0x40d06c
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401426
mov eax, dword [0x40e400]
mov dword [0x40e440], eax
mov eax, dword [0x40e414]
mov dword [0x40e404], eax
mov eax, dword [0x40e440]
mov dword [0x40e4b4], eax
jmp 0x401446
push 0x10
push dword [0x40e478]
push dword [0x40e4d0]
call fcn.00404bc4
push 1
jmp 0x401ffc
push 0x40d072
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401478
mov eax, dword [0x40e400]
mov dword [0x40e448], eax
mov eax, dword [0x40e414]
mov dword [0x40e44c], eax
mov eax, dword [0x40e448]
mov dword [0x40e488], eax
push 0x40d070
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x4014aa
mov eax, dword [0x40e400]
mov dword [0x40e444], eax
mov eax, dword [0x40e414]
mov dword [0x40e408], eax
mov eax, dword [0x40e444]
mov dword [0x40e4d4], eax
push 0x40d087
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401742
mov edx, dword [0x40e4c4]
xor ecx, ecx
call fcn.0040af30
jne 0x4014f1
mov edx, dword [0x40e4c4]
push dword [0x40e7c8]
call fcn.0040af60
push 0x40e49c
call fcn.0040aeb0
jmp 0x401665
push 0xc80001
push dword [0x40e4bc]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00406bb0
push dword [0x40e450]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00405d93
push 0x20
push 0x40d01e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00405f6c
push 0x40d209
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00406279
push 4
push 0xd
push 0
call fcn.00406bd3
push 2
call fcn.00406299
call fcn.00406dd7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4015d1
push dword [0x40e4cc]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401ffc
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401619
call fcn.00408dfc
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401616
mov edx, dword [0x40e7c8]
push edx
push edx
push 2
call fcn.004062d4
push 0x40e49c
call fcn.0040aeb0
push 0
call fcn.00406773
add esp, 8
jmp 0x401665
pop eax
jmp 0x40165f
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40165f
call fcn.00408e0b
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40165e
mov edx, dword [0x40e7c8]
push edx
push edx
push 2
call fcn.004062d4
push 0x40e49c
call fcn.0040aeb0
push 0
call fcn.00406773
add esp, 8
jmp 0x401665
pop eax
pop eax
jmp 0x4015a7
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e49c]
call fcn.004040c0
push eax
mov eax, dword [0x40e49c]
push eax
call fcn.004097c0
inc dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e414]
push dword [0x40e400]
call fcn.00408230
pop edx
pop ecx
mov dword [0x40e7c8], ecx
add ecx, dword [0x40d344]
add edx, dword [0x40d344]
call fcn.0040af30
jne 0x4016e9
push 0x10
push dword [0x40e4a4]
push dword [0x40e4d0]
call fcn.00404bc4
push dword [0x40e4cc]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401ffc
push 0x40d089
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401707
mov eax, dword [0x40e400]
mov dword [0x40e4b0], eax
push dword [0x40e408]
push dword [0x40e44c]
push dword [0x40e404]
push dword [0x40e4b0]
push dword [0x40e444]
push dword [0x40e448]
push dword [0x40e440]
push dword [0x40e49c]
push dword [0x40e45c]
call fcn.00403858
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e404]
push dword [0x40e4b4]
call fcn.00408230
push 0x40e470
call fcn.0040aeb0
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e44c]
push dword [0x40e488]
call fcn.00408230
push 0x40e428
call fcn.0040aeb0
push 0x40d06e
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401a00
mov edx, dword [0x40e7c8]
push edx
push edx
push 0
call fcn.00405005
inc dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e414]
push dword [0x40e400]
call fcn.00408230
pop edx
pop ecx
mov dword [0x40e7c8], ecx
add ecx, dword [0x40d344]
add edx, dword [0x40d344]
call fcn.0040af30
je 0x4017fe
mov ebx, dword [0x40e4ac]
cmp ebx, 1
jne 0x4017fe
mov eax, 1
jmp 0x401800
xor eax, eax
and eax, eax
je 0x401a00
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
call fcn.00408375
inc dword [0x40e7c8]
push dword [0x40e4a0]
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.00404c37
push 0x40e420
call fcn.0040aeb0
mov edx, dword [0x40e420]
xor ecx, ecx
call fcn.0040af30
jne 0x4019ae
mov edx, dword [0x40e420]
push dword [0x40e7c8]
call fcn.0040af60
push 0x40e468
call fcn.0040aeb0
push dword [0x40e468]
call fcn.004083b5
mov edx, dword [0x40e428]
xor ecx, ecx
call fcn.0040af30
jne 0x401895
push dword [0x40e428]
call fcn.004033c5
push dword [0x40e474]
push 1
call fcn.00408950
and eax, eax
je 0x401980
push 1
call fcn.00408660
push dword [0x40e7c8]
push 0x24
mov edx, dword [0x40e410]
push dword [0x40e7c8]
call fcn.0040af60
mov edx, 0x40d021
call fcn.0040af60
mov edx, dword [0x40e474]
call fcn.0040af60
mov edx, 0x40d021
call fcn.0040af60
mov edx, dword [0x40e424]
call fcn.0040af60
inc dword [0x40e7c8]
push dword [0x40e480]
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.00404bc4
pop dword [0x40e7c8]
mov dword [0x40e46c], eax
mov ebx, dword [0x40e46c]
cmp ebx, 7
jne 0x401980
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call fcn.00405066
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083c7
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083b5
pop dword [0x40e7c8]
push dword [0x40e4cc]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401ffc
push dword [0x40e474]
push 1
call fcn.00408880
and eax, eax
je 0x4019ae
push dword [0x40e470]
push 1
call fcn.00408a00
push 1
call fcn.00408660
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call fcn.00405066
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083c7
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083b5
pop dword [0x40e7c8]
push dword [0x40e4cc]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401ffc
push 0x40d08b
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401b3c
push 0x400
call fcn.004082d0
mov dword [0x40e458], eax
mov edx, dword [0x40e7c8]
push edx
push edx
call fcn.0040843d
push 0x40e4dc
call fcn.0040aeb0
push dword [0x40e458]
push 0
push 0x40d01e
push dword [0x40e4dc]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e458]
call fcn.004081e0
push 0x40e4c8
call fcn.0040aeb0
push dword [0x40e458]
call fcn.004082f0
push dword [0x40e4c8]
call fcn.004084cc
push dword [0x40e4c8]
call fcn.004084da
push dword [0x40e4c8]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x40e4c8]
push dword [0x40e7c8]
call fcn.0040af60
mov edx, str.extd.exe
call fcn.0040af60
push 0x40e464
call fcn.0040aeb0
push dword [0x40e464]
push 0
call fcn.00408880
push dword [0x40e414]
push dword [0x40e400]
push 0
call fcn.00408a80
push 0
call fcn.00408660
mov edx, dword [0x40e464]
push dword [0x40e7c8]
call fcn.0040af60
push 0x40e460
call fcn.0040aeb0
push dword [0x40e460]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x40e460]
push str.b2eextd
call fcn.004050c1
push str._call:extd
push str.extd
call fcn.004050c1
mov edx, dword [0x40e4cc]
push dword [0x40e7c8]
call fcn.0040af60
mov edx, str.BDFI
call fcn.0040af60
mov edx, dword [0x40e474]
call fcn.0040af60
push 0x40e474
call fcn.0040aeb0
push dword [0x40e474]
push 1
call fcn.00408880
and eax, eax
je 0x401c95
push str._shift__0
push 1
call fcn.00408ae0
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004081e0
inc dword [0x40e7c8]
mov edx, dword [0x40d344]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e7c8]
push eax
call fcn.004081e0
inc dword [0x40e7c8]
push 0x40d08d
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.004050c1
pop dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
push str._b2eargs_
push 0x40d0c5
push dword [0x40e470]
call fcn.004043e0
push 0x40e470
call fcn.0040aeb0
push dword [0x40e470]
push 1
call fcn.00408ae0
push 0x40d08b
push dword [0x40e45c]
call fcn.004037f1
and eax, eax
je 0x401c89
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
mov ebp, 0x40d341
mov ebx, ebp
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
sub ebx, ebp
push ebx
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
push ebp
call fcn.00408230
inc dword [0x40e7c8]
push 1
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.00408ae0
pop dword [0x40e7c8]
push 1
call fcn.00408660
jmp 0x401cd0
push dword [0x40e474]
call fcn.004084cc
call fcn.00403b05
push 0x10
push dword [0x40e478]
push dword [0x40e4d0]
call fcn.00404bc4
push dword [0x40e4cc]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401ffc
mov edx, dword [0x40e428]
xor ecx, ecx
call fcn.0040af30
jne 0x401cea
push dword [0x40e428]
call fcn.004033c5
push 0x400
call fcn.004082d0
mov dword [0x40e4c0], eax
mov edx, dword [0x40e7c8]
push edx
push edx
call fcn.0040843d
push 0x40e41c
call fcn.0040aeb0
push dword [0x40e4c0]
push 0
push 0x40d01e
push dword [0x40e41c]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e4c0]
call fcn.004081e0
push 0x40e4d8
call fcn.0040aeb0
mov edx, dword [0x40e7c8]
push edx
push edx
push 0x800
call fcn.00404410
push 0x40e490
call fcn.0040aeb0
push dword [0x40e7c8]
push 0x800
push dword [0x40e490]
mov edx, dword [0x40e7c8]
push edx
push edx
call fcn.00405066
inc dword [0x40e7c8]
mov edx, dword [0x40d344]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call fcn.00405066
inc dword [0x40e7c8]
push str.b2eprogramname
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.004050c1
pop dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call fcn.00405066
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004085f8
inc dword [0x40e7c8]
push str.b2eprogramfilename
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.004050c1
pop dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call fcn.00405066
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083c7
inc dword [0x40e7c8]
push str.b2eprogrampathname
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.004050c1
pop dword [0x40e7c8]
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
push dword [0x40e490]
call fcn.00404510
inc dword [0x40e7c8]
push str.b2eprogramshortname
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.004050c1
pop dword [0x40e7c8]
mov edx, dword [0x40e468]
push dword [0x40e7c8]
call fcn.0040af60
push 0x40e4e0
call fcn.0040aeb0
push dword [0x40e4e0]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x40e4e0]
push 0x40d074
call fcn.004050c1
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
mov eax, dword [0x40e418]
cdq
push edx
push eax
call fcn.004046a0
inc dword [0x40e7c8]
push str.b2eincfilecount
mov edx, dword [0x40d344]
add dword [esp + 4], edx
call fcn.004050c1
pop dword [0x40e7c8]
push dword [0x40e4d8]
push str.b2etempfile
call fcn.004050c1
push 0x44
push dword [0x40e468]
push dword [0x40e454]
push dword [0x40e474]
call fcn.0040553d
mov dword [0x40e484], eax
push dword [0x40e484]
call fcn.00405557
mov ebx, eax
and ebx, ebx
jne 0x401f4f
jmp 0x401f5b
push 5
call fcn.00406752
jmp 0x401f3c
push dword [0x40e484]
call fcn.0040559e
mov dword [0x40e434], eax
push dword [0x40e484]
call fcn.004055bc
call fcn.00403b05
push dword [0x40e474]
call fcn.004084cc
push dword [0x40e4d8]
call fcn.004084cc
push dword [0x40e464]
call fcn.004084cc
mov edx, dword [0x40e7c8]
push edx
push edx
mov edx, dword [0x40e7c8]
push edx
push edx
push dword [0x40e7c8]
call fcn.00405066
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083c7
mov edx, dword [0x40d344]
add dword [esp], edx
call fcn.004083b5
pop dword [0x40e7c8]
push dword [0x40e4c8]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x40e4cc]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x40e434]
jmp 0x401ffc
push 0
call 0x402016
call fcn.0040ae80
push dword [0x40e3f4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004057a0
call fcn.00405b21
call fcn.00406889
call fcn.004078ff
call fcn.004080fd
call fcn.0040860a
call fcn.004086d0
call fcn.004090fe
call fcn.004081d0
ret