Function at 0x401a15
Capabilities:
Copy file
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Resolve function by parsing pe exports
Set current directory
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
push edi
push 0x34
call fcn.00404180
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x401a36
mov ecx, eax
call fcn.00401000
jmp 0x401a38
xor eax, eax
mov dword [0x40becc], eax
mov eax, dword [esp + 0x41c]
mov ebp, 0xff
mov dword [0x40bdc0], ebx
push ebp
mov dword [0x40bec8], eax
call fcn.00404180
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
pop ecx
mov esi, eax
push esi
push ebp
call edi
push str..oid
push esi
call fcn.004045d0
lea eax, [esp + 0x1a0]
push eax
push esi
call fcn.00404a6b
add esp, 0x10
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x401abe
push esi
push ebp
call edi
lea eax, [esp + 0x1ac]
push eax
push esi
call fcn.004045d0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x198]
push eax
push dword [esp + 0x18]
call fcn.00404b35
pop ecx
test eax, eax
pop ecx
je 0x401a8c
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.temp.exe
push esi
call fcn.004045d0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00404175
push ebp
call fcn.00404180
push ebp
push ebx
push eax
mov dword [esp + 0x30], eax
call fcn.004046b0
push 0xc8
call fcn.00404180
push 0x32
mov dword [esp + 0x9c], eax
pop esi
push esi
call fcn.00404180
push esi
mov dword [esp + 0x9c], eax
call fcn.00404180
push 0x96
mov dword [esp + 0xa8], eax
call fcn.00404180
push esi
mov dword [esp + 0x54], eax
call fcn.00404180
push ebp
mov dword [esp + 0x54], eax
call fcn.00404180
push 0x64
mov dword [esp + 0x80], eax
pop edi
push edi
call fcn.00404180
push edi
mov dword [esp + 0xc0], eax
call fcn.00404180
push edi
mov dword [esp + 0xcc], eax
call fcn.00404180
push edi
mov dword [esp + 0xd8], eax
call fcn.00404180
push esi
mov dword [esp + 0xb0], eax
call fcn.00404180
add esp, 0x40
mov dword [esp + 0x6c], eax
push esi
call fcn.00404180
push 0xa
mov dword [esp + 0x90], eax
call fcn.00404180
push 0x3c
mov dword [esp + 0xa4], eax
call fcn.00404180
push 0x14
mov dword [esp + 0x68], eax
call fcn.00404180
push edi
mov dword [esp + 0x78], eax
call fcn.00404180
push edi
mov dword [esp + 0xa8], eax
call fcn.00404180
push esi
mov dword [esp + 0x84], eax
call fcn.00404180
push esi
mov dword [esp + 0x94], eax
call fcn.00404180
mov dword [esp + 0x68], eax
push 0x14
call fcn.00404180
push 0x14
mov dword [esp + 0x88], eax
call fcn.00404180
push 0x14
mov dword [esp + 0x88], eax
call fcn.00404180
push 0x14
mov dword [esp + 0x74], eax
call fcn.00404180
push edi
mov dword [esp + 0x74], eax
call fcn.00404180
push 0xc8
push ebx
push dword [esp + 0xbc]
mov dword [esp + 0xb8], eax
mov dword [esp + 0xe8], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0xf4], ebx
call fcn.004046b0
add esp, 0x40
push esi
push ebx
push dword [esp + 0x84]
call fcn.004046b0
push esi
push ebx
push dword [esp + 0x98]
call fcn.004046b0
push 0x96
push ebx
push dword [esp + 0x4c]
call fcn.004046b0
push esi
push ebx
push dword [esp + 0x54]
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x88]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0xd0]
call fcn.004046b0
add esp, 0x48
push edi
push ebx
push dword [esp + 0x9c]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0xb0]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0x90]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0xa4]
call fcn.004046b0
push esi
push ebx
push dword [esp + 0xc0]
call fcn.004046b0
push esi
push ebx
push dword [esp + 0xb0]
call fcn.004046b0
add esp, 0x48
push 0xa
push ebx
push dword [esp + 0xa0]
call fcn.004046b0
push 0x3c
push ebx
push dword [esp + 0x6c]
call fcn.004046b0
push 0x14
push ebx
push dword [esp + 0x84]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0xbc]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0xa0]
call fcn.004046b0
push esi
push ebx
push dword [esp + 0xb8]
call fcn.004046b0
add esp, 0x48
push esi
push ebx
push dword [esp + 0x50]
call fcn.004046b0
push 0x14
pop edi
push edi
push ebx
push dword [esp + 0x74]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0x7c]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0x70]
call fcn.004046b0
push edi
push ebx
push dword [esp + 0x78]
call fcn.004046b0
push esi
lea eax, [esp + 0x170]
push ebx
push eax
call fcn.004046b0
add esp, 0x48
lea eax, [esp + 0x164]
push esi
push ebx
push eax
call fcn.004046b0
push 0xc8
lea eax, [esp + 0x360]
push ebx
push eax
call fcn.004046b0
push ebp
call fcn.00404180
add esp, 0x1c
mov esi, eax
push 1
pop edi
push 0x24
push dword [esp + 0x428]
call fcn.004044c0
pop ecx
cmp eax, ebx
pop ecx
mov dword [esp + 0x24], eax
jne 0x401e80
push 0x40c000
push dword [esp + 0x428]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4023cc
push dword [esp + 0x424]
push esi
call fcn.004045c0
push 0x40c000
push dword [esp + 0x430]
call fcn.004045c0
add esp, 0x10
push 5
push str.name
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401e92
push esi
push dword [esp + 0x80]
jmp 0x402351
inc dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.004045c0
pop ecx
pop ecx
jmp 0x401e5f
push 5
push str.numb
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401eb0
push esi
push dword [esp + 0x70]
jmp 0x402351
push 7
push 0x40b2e8
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401ece
push esi
push dword [esp + 0x7c]
jmp 0x402351
push 5
push str.rboot
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401eee
mov dword [esp + 0xa8], edi
jmp 0x4023b8
push 8
push str.realname
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401f0c
push esi
push dword [esp + 0x78]
jmp 0x402351
push 5
push str.organ
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401f2a
push esi
push dword [esp + 0x4c]
jmp 0x402351
push 7
push str.nomodem
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401f4a
mov dword [esp + 0xcc], edi
jmp 0x4023b8
push 7
push str.script
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401f6e
push esi
mov dword [0x40bfec], edi
push dword [esp + 0x5c]
jmp 0x402351
push 8
push str.popname
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401f8c
push esi
push dword [esp + 0x68]
jmp 0x402351
push 5
push str.copy
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401faa
push esi
push dword [esp + 0x44]
jmp 0x402351
push 5
push str.gate
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401fc8
push esi
push dword [esp + 0x6c]
jmp 0x402351
push 5
push str.chain
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401ffc
push 0x40b294
push dword [esp + 0x60]
call fcn.004045c0
push esi
push dword [esp + 0x68]
call fcn.004045d0
add esp, 0x10
jmp 0x4023b8
push 6
push str.iehome
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
je 0x4023b8
push 7
push str.nethome
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
je 0x4023b8
push 9
push str.homepage
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402051
add esi, 9
lea eax, [esp + 0x350]
push esi
push eax
jmp 0x402351
push 6
push str.IEMail
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402071
mov dword [esp + 0xac], edi
jmp 0x4023b8
push 6
push str.OEMail
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402091
mov dword [esp + 0xc4], edi
jmp 0x4023b8
push 6
push str.NSMail
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4020b1
mov dword [esp + 0xa4], edi
jmp 0x4023b8
push 7
push str.O98Mail
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4020d1
mov dword [esp + 0xb0], edi
jmp 0x4023b8
push 9
push str.noprofile
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4020fd
push 0x40b294
push dword [esp + 0x64]
call fcn.004045c0
push esi
push dword [esp + 0x6c]
jmp 0x401fef
push 9
push str.dunsuffix
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x40211d
mov dword [esp + 0xc8], edi
jmp 0x4023b8
push 9
push str.dunprefix
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x40213d
mov dword [esp + 0xb8], edi
jmp 0x4023b8
push 0xa
push str.mailsuffix
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x40215d
mov dword [esp + 0xb4], edi
jmp 0x4023b8
push 0xa
push str.mailprefix
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x40217d
mov dword [esp + 0xc0], edi
jmp 0x4023b8
push 7
push str.prefix
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4021a1
add esi, 7
lea eax, [esp + 0x130]
push esi
jmp 0x40204b
push 7
push str.suffix
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4021c5
add esi, 7
lea eax, [esp + 0x164]
push esi
jmp 0x40204b
push 4
push str.DNS
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4021e6
push esi
push dword [esp + 0x94]
jmp 0x402351
push 5
push str.area
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402207
push esi
push dword [esp + 0x9c]
jmp 0x402351
push 5
push str.pass
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402228
push esi
push dword [esp + 0x88]
jmp 0x402351
push 5
push str.smtp
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402249
push esi
push dword [esp + 0x90]
jmp 0x402351
push 9
push str.onlysmtp
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402267
push esi
push dword [esp + 0x74]
jmp 0x402351
push 4
push str.pop
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402288
push esi
push dword [esp + 0x98]
jmp 0x402351
push 5
push str.news
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4022a9
push esi
push dword [esp + 0xa0]
jmp 0x402351
push 0xa
push str.dialoption
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4022c9
mov dword [esp + 0xbc], edi
jmp 0x4023b8
push 7
push str.domain
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4022e7
push esi
push dword [esp + 0x8c]
jmp 0x402351
push 5
push 0x40b074
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402302
push esi
push dword [esp + 0x30]
jmp 0x402351
push 9
push str.dialparm
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x40231d
push esi
push dword [esp + 0x48]
jmp 0x402351
push 5
push str.prof
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402338
push esi
push dword [esp + 0x2c]
jmp 0x402351
push 5
push str.next
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x402358
push esi
push dword [esp + 0x54]
call fcn.004045c0
jmp 0x4023b6
push 5
push str.appl
push esi
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x4023b8
add esi, 5
push 7
push str.http:__
push esi
mov dword [0x40bff4], edi
call fcn.00404d30
add esp, 0xc
test eax, eax
je 0x4023ab
push ebp
push 0x40bdc4
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x40bdc4
call fcn.004044c0
pop ecx
cmp eax, ebx
pop ecx
je 0x4023ab
mov byte [eax + 1], bl
push esi
push 0x40bdc4
call fcn.004045d0
pop ecx
pop ecx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x401e0b
mov byte [eax - 1], bl
jmp 0x401e0b
push ebx
call fcn.00404175
push ebp
mov dword [esp + 0x44], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], ebx
call fcn.00404180
mov esi, eax
push ebp
push ebx
push esi
mov dword [esp + 0x38], esi
call fcn.004046b0
add esp, 0x14
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40c000
push dword [esp + 0x30]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
jne 0x402421
push 0x2e
push esi
call fcn.004044c0
pop ecx
mov byte [eax + 1], bl
pop ecx
jmp 0x40244d
push 0x5c
push esi
call fcn.004044c0
push 0x3d
mov byte [eax + 1], bl
push dword [esp + 0x38]
call fcn.004044c0
inc eax
push eax
push esi
call fcn.004045d0
push 0x40b18c
push esi
call fcn.004045d0
add esp, 0x20
push 0x40b188
push esi
call fcn.004045d0
push 0x40b184
push esi
call fcn.00404a58
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x402532
push 0x400
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], ebx
call fcn.00404180
pop ecx
mov dword [esp + 0x38], eax
mov edi, 0x400
push edi
push ebx
push dword [esp + 0x40]
call fcn.004046b0
push dword [esp + 0x20]
push edi
push 1
push dword [esp + 0x50]
call fcn.0040418e
mov edi, eax
mov eax, dword [esp + 0x3c]
add eax, edi
push eax
push dword [esp + 0x54]
call fcn.00404276
mov ecx, dword [esp + 0x44]
push edi
push dword [esp + 0x60]
add ecx, eax
mov dword [esp + 0x60], eax
push ecx
call fcn.00403e40
mov eax, dword [esp + 0x44]
add dword [esp + 0x50], edi
add esp, 0x30
test byte [eax + 0xc], 0x10
je 0x402489
push dword [esp + 0x38]
call fcn.00404175
push ebx
lea eax, [esp + 0x28]
push 0x20
push eax
lea eax, [esp + 0x44]
push eax
call fcn.004013b3
push 1
push ebx
push esi
push dword [esp + 0x48]
push dword [esp + 0x58]
call fcn.00403910
push ebx
push 1
push esi
push dword [esp + 0x5c]
push dword [esp + 0x6c]
call fcn.00403910
add esp, 0x3c
test eax, eax
je 0x403901
push dword [esp + 0x14]
jmp 0x4027a6
mov esi, 0x104
push esi
call fcn.00404180
mov edi, eax
push esi
push ebx
push edi
mov dword [esp + 0x64], edi
call fcn.004046b0
add esp, 0x10
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40b184
push edi
call fcn.00404a58
pop ecx
cmp eax, ebx
pop ecx
mov dword [esp + 0x14], eax
je 0x402630
push 0xa
call fcn.00404180
mov esi, str.BBCCDDEEFF
lea edi, [esp + 0xd4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [esp + 0xa4], eax
pop ecx
movsb byte es:[edi], byte [esi]
xor eax, eax
dec byte [esp + eax + 0xd0]
inc eax
cmp eax, 0xa
jl 0x402592
mov esi, dword [esp + 0x14]
push ebx
push 0x34ff0
push esi
call fcn.004049ac
mov edi, dword [esp + 0xac]
push 0xa
push ebx
push edi
call fcn.004046b0
push esi
push 0xa
push 1
push edi
call fcn.0040418e
mov dword [esp + 0x3c], eax
lea eax, [esp + 0xf8]
push 0xa
push eax
push edi
call fcn.00404900
add esp, 0x34
test eax, eax
je 0x402634
cmp dword [esp + 0x14], 0xa
jl 0x403901
push 1
push 0xfffffffffffffff7
push esi
call fcn.004049ac
add esp, 0xc
test byte [esi + 0xc], 0x10
jne 0x402634
push 0xa
push ebx
push edi
call fcn.004046b0
push esi
push 0xa
push 1
push edi
call fcn.0040418e
mov dword [esp + 0x30], eax
lea eax, [esp + 0xec]
push 0xa
push eax
push edi
call fcn.00404900
add esp, 0x28
jmp 0x4025e1
mov esi, dword [esp + 0x14]
push ebp
call fcn.00404180
cmp esi, ebx
pop ecx
mov dword [esp + 0x14], eax
je 0x403901
push ebp
push ebx
push dword [esp + 0x1c]
call fcn.004046b0
push esi
push ebp
push 1
push dword [esp + 0x2c]
call fcn.0040418e
mov edi, eax
mov eax, dword [esp + 0x68]
add eax, edi
push eax
push dword [esp + 0x5c]
call fcn.00404276
add esp, 0x24
cmp eax, ebx
mov dword [esp + 0x3c], eax
je 0x403901
mov ecx, dword [esp + 0x4c]
push edi
push dword [esp + 0x18]
add ecx, eax
push ecx
call fcn.00403e40
add dword [esp + 0x58], edi
add esp, 0xc
test byte [esi + 0xc], 0x10
je 0x402647
push dword [esp + 0x54]
call fcn.00404175
push 1
lea eax, [esp + 0x54]
pop edi
push ebx
push 0x20
push eax
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x68], edi
call fcn.004013b3
push edi
push ebx
push dword [esp + 0x40]
push dword [esp + 0x48]
push dword [esp + 0x60]
call fcn.00403910
push ebx
push edi
push dword [esp + 0x54]
push dword [esp + 0x5c]
push dword [esp + 0x74]
call fcn.00403910
add esp, 0x3c
test eax, eax
jne 0x4027a5
cmp dword [0x40bec4], ebx
je 0x403901
mov edi, 0x19c
mov dword [esp + 0x48], ebx
push edi
mov dword [esp + 0x18], edi
call fcn.00404180
push dword [esp + 0x18]
mov esi, eax
push ebx
push esi
call fcn.004046b0
mov eax, dword [esp + 0x24]
lea ebp, [esi + 4]
mov dword [esi], eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x28]
push eax
push esi
mov dword [ebp], ebx
call fcn.00403d36
add esp, 0x1c
test eax, eax
jne 0x402799
cmp dword [ebp], ebx
je 0x402799
cmp dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
jle 0x402799
mov dword [esp + 0x30], ebp
mov ebp, 0xa0
push ebp
lea eax, [esp + 0x2b4]
push ebx
push eax
call fcn.004046b0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2bc], ebp
push dword [eax]
call fcn.00403dab
add esp, 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x30], edi
cmp eax, dword [esp + 0x48]
jl 0x402758
push esi
call fcn.00404175
pop ecx
jmp 0x403901
push esi
call fcn.0040489e
pop ecx
push dword [esp + 0x24]
call fcn.00404175
push ebp
call fcn.00404180
push ebp
mov dword [esp + 0x1c], eax
call fcn.00404180
add esp, 0xc
mov esi, eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.004044c0
push esi
mov byte [eax + 1], bl
push dword [esp + 0x8c]
call fcn.004045c0
push str.Icwscrpt.exe
push esi
call fcn.004045d0
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
add esp, 0x18
push dword [esp + 0x10]
push ebp
call edi
push str.Icwscrpt.exe
push dword [esp + 0x14]
call fcn.004045d0
push 0x40b164
push esi
call fcn.00404a58
add esp, 0x10
cmp eax, ebx
je 0x402839
push eax
call fcn.0040489e
pop ecx
push ebx
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [esp + 0x40], ebx
je 0x402913
push 0x40c000
push dword [esp + 0x44]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x402913
push dword [esp + 0x40]
call fcn.004043a0
push eax
call fcn.00404180
push dword [esp + 0x48]
mov dword [esp + 0x2c], eax
call fcn.004043a0
push eax
push ebx
push dword [esp + 0x34]
call fcn.004046b0
mov eax, dword [esp + 0x58]
add eax, 5
push eax
push dword [esp + 0x3c]
call fcn.004045c0
add esp, 0x20
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.004044c0
push dword [esp + 0x28]
mov byte [eax + 1], bl
push esi
call fcn.004045d0
push 0x40b06c
push esi
call fcn.004045d0
add esp, 0x18
push dword [esp + 0x10]
push ebp
call edi
push dword [esp + 0x20]
push dword [esp + 0x14]
call fcn.004045d0
push 0x40b06c
push dword [esp + 0x1c]
call fcn.004045d0
push 0x40b164
push esi
call fcn.00404a58
add esp, 0x18
cmp eax, ebx
je 0x402909
push eax
call fcn.0040489e
pop ecx
push ebx
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [esp + 0x20]
call fcn.00404175
pop ecx
push esi
call fcn.00404175
push dword [esp + 0x14]
call fcn.00404175
push 0x40c000
push dword [esp + 0x34]
call fcn.00404710
add esp, 0x10
test eax, eax
jne 0x402970
push 0x3d
push dword [esp + 0x30]
call fcn.004044c0
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x402970
push str.prof
push dword [esp + 0x2c]
call fcn.004045c0
inc esi
push esi
push dword [esp + 0x34]
call fcn.004045d0
add esp, 0x10
mov dword [0x40bdc0], 1
push ebp
call fcn.00404180
mov esi, eax
push ebp
push ebx
push esi
mov dword [esp + 0x48], esi
call fcn.004046b0
add esp, 0x10
push esi
push ebp
call edi
push ebp
call fcn.00404180
mov esi, eax
push ebp
push ebx
push esi
mov dword [esp + 0xb0], esi
call fcn.004046b0
push ebp
call fcn.00404180
push ebp
mov dword [esp + 0x4c], eax
call fcn.00404180
push ebp
push ebx
push dword [esp + 0x54]
mov dword [esp + 0x44], eax
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x4c]
call fcn.004046b0
add esp, 0x30
push ebp
push dword [esp + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push dword [esp + 0x38]
call fcn.004044c0
inc eax
push eax
push dword [esp + 0x2c]
call fcn.004045c0
push ebp
call fcn.00404180
push ebp
push ebx
push eax
mov dword [esp + 0x34], eax
call fcn.004046b0
push str.temp.ex_
push dword [esp + 0x38]
call fcn.004045c0
push dword [esp + 0x60]
push esi
call fcn.004045c0
push dword [esp + 0x44]
push esi
call fcn.004045d0
push 0x40b184
push esi
call fcn.00404a58
add esp, 0x40
cmp eax, ebx
je 0x402a45
push eax
call fcn.0040489e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x40b154
push str.INSTALL
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [esp + 0x30], eax
je 0x402a75
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x402a75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x10], eax
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
je 0x402b5b
cmp dword [esp + 0x10], ebx
je 0x402ab8
push dword [esp + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x30]
push ebx
push ecx
push eax
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.00404180
push ebp
mov dword [esp + 0x38], eax
call fcn.00404180
push ebp
push ebx
push dword [esp + 0x40]
mov dword [esp + 0x24], eax
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x2c]
call fcn.004046b0
push dword [esp + 0x58]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x3c], ebp
push esi
call fcn.004045c0
push str.temp.exe
push esi
call fcn.004045d0
add esp, 0x30
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
push dword [esp + 0x38]
push dword [esp + 0x44]
push dword [esp + 0x48]
push str.temp.exe
push dword [esp + 0x2c]
push 1
call sub.VERSION.dll_VerInstallFileA
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [esp + 0xa0]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x30]
call fcn.00404175
push dword [esp + 0x14]
call fcn.00404175
pop ecx
pop ecx
jmp 0x402b5f
mov esi, dword [esp + 0x1c]
push ebp
call fcn.00404180
push ebp
mov dword [esp + 0x20], eax
call fcn.00404180
push ebp
mov dword [esp + 0x28], eax
call fcn.00404180
push ebp
push ebx
push dword [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x3c]
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x3c]
call fcn.004046b0
add esp, 0x30
push ebp
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [esp + 0x18]
call fcn.00401421
push dword [esp + 0x1c]
call fcn.004043a0
pop ecx
cmp eax, 3
pop ecx
jbe 0x402bd6
push 0x40b148
push dword [esp + 0x1c]
call fcn.004045d0
pop ecx
pop ecx
push dword [esp + 0x18]
push dword [esp + 0x20]
call fcn.004045c0
push str.21esignup.exe
push dword [esp + 0x28]
call fcn.004045d0
add esp, 0x10
push dword [esp + 0x10]
push ebp
call edi
push str.21esignup.exe
push dword [esp + 0x14]
call fcn.004045d0
pop ecx
pop ecx
push 1
push dword [esp + 0x14]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [esp + 0x18]
call fcn.00404175
push dword [esp + 0x20]
call fcn.00404175
push dword [esp + 0x18]
call fcn.00404175
push ebp
call fcn.00404180
push ebp
mov dword [esp + 0x2c], eax
call fcn.00404180
push ebp
mov dword [esp + 0x34], eax
call fcn.00404180
push ebp
push ebx
push dword [esp + 0x38]
mov dword [esp + 0x34], eax
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x48]
call fcn.004046b0
push ebp
push ebx
push dword [esp + 0x48]
call fcn.004046b0
add esp, 0x3c
push ebp
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [esp + 0x18]
call fcn.00401421
push dword [esp + 0x1c]
call fcn.004043a0
pop ecx
cmp eax, 3
pop ecx
jbe 0x402cad
push 0x40b148
push dword [esp + 0x1c]
call fcn.004045d0
pop ecx
pop ecx
push dword [esp + 0x18]
push dword [esp + 0x20]
call fcn.004045c0
push str.bookmark.htm
push dword [esp + 0x28]
call fcn.004045d0
add esp, 0x10
push dword [esp + 0x10]
push ebp
call edi
push str.bookmark.htm
push dword [esp + 0x14]
call fcn.004045d0
pop ecx
pop ecx
push 1
push dword [esp + 0x14]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [esp + 0x18]
push dword [esp + 0x20]
call fcn.004045c0
push str.inbox
push dword [esp + 0x28]
call fcn.004045d0
add esp, 0x10
push dword [esp + 0x10]
push ebp
call edi
push str.Inbox
mov edi, dword [esp + 0x14]
push edi
call fcn.004045d0
pop ecx
pop ecx
push 1
push edi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [esp + 0x18]
call fcn.00404175
push dword [esp + 0x20]
call fcn.00404175
push edi
call fcn.00404175
push 0x40c000
push dword [esp + 0x3c]
call fcn.00404710
add esp, 0x14
test eax, eax
jne 0x402d74
push 0x2e
push dword [esp + 0x38]
call fcn.004044c0
pop ecx
mov byte [eax + 1], bl
pop ecx
jmp 0x402da4
mov edi, dword [esp + 0x34]
push 0x5c
push edi
call fcn.004044c0
push 0x3d
mov byte [eax + 1], bl
push dword [esp + 0x38]
call fcn.004044c0
inc eax
push eax
push edi
call fcn.004045d0
push 0x40b18c
push edi
call fcn.004045d0
add esp, 0x20
push 0x40b188
push dword [esp + 0x38]
call fcn.004045d0
mov edi, dword [esp + 0x34]
push 0x40c000
push edi
call fcn.00404710
add esp, 0x10
test eax, eax
jne 0x402de6
push dword [esp + 0x20]
mov edi, dword [esp + 0x3c]
push edi
call fcn.004045d0
push 0x2e
push edi
call fcn.004044c0
add esp, 0x10
mov byte [eax + 1], bl
jmp 0x402e18
push 0x5c
push edi
call fcn.004044c0
pop ecx
cmp eax, ebx
pop ecx
jne 0x402dfe
push 0x3d
push edi
call fcn.004044c0
pop ecx
pop ecx
mov edi, dword [esp + 0x38]
inc eax
push eax
push edi
call fcn.004045d0
push 0x40b18c
push edi
call fcn.004045d0
add esp, 0x10
push 0x40b188
push edi
call fcn.004045d0
cmp dword [esp + 0x5c], ebx
pop ecx
pop ecx
jne 0x402e39
push ebx
push edi
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x402e78
push 0x40b114
push edi
call fcn.00404a58
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x402e78
push 1
lea eax, [esp + 0x50]
push 0x20
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004013b3
push edi
push dword [esp + 0x60]
push 1
push dword [esp + 0x58]
call fcn.00404794
push edi
call fcn.0040489e
add esp, 0x24
mov edi, 0x40c000
push edi
push dword [esp + 0x54]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x402e97
push dword [esp + 0x50]
call fcn.00401522
pop ecx
push edi
push dword [esp + 0x30]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
jne 0x402ed8
push 0x2e
push dword [esp + 0x24]
call fcn.004044c0
pop ecx
cmp eax, ebx
pop ecx
je 0x402eba
mov byte [eax], bl
push 0x40b074
push dword [esp + 0x30]
call fcn.004045c0
push dword [esp + 0x28]
push dword [esp + 0x38]
call fcn.004045d0
add esp, 0x10
push edi
push dword [esp + 0x2c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
jne 0x402f23
push 0x2e
push dword [esp + 0x24]
call fcn.004044c0
pop ecx
cmp eax, ebx
pop ecx
je 0x402efb
mov byte [eax], bl
push str.prof
push dword [esp + 0x2c]
call fcn.004045c0
push dword [esp + 0x28]
push dword [esp + 0x34]
call fcn.004045d0
add esp, 0x10
mov dword [0x40bdc0], 1
push edi
push dword [esp + 0x30]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403176
push ebp
call fcn.00404180
push ebp
mov dword [esp + 0x38], eax
call fcn.00404180
mov edi, eax
push ebp
push ebx
push edi
call fcn.004046b0
add esp, 0x14
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
call fcn.004044c0
push edi
mov byte [eax + 1], bl
push dword [esp + 0x3c]
call fcn.004045c0
push edi
call fcn.00404175
add esp, 0x14
cmp dword [0x40bfec], ebx
jne 0x4030af
push 0x3d
push dword [esp + 0x30]
call fcn.00404500
inc eax
push eax
push dword [esp + 0x3c]
call fcn.004045d0
push 0x40b06c
push dword [esp + 0x44]
call fcn.004045d0
add esp, 0x18
cmp dword [esp + 0x3c], ebx
je 0x402fe2
push 1
lea eax, [esp + 0x50]
push 0x20
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004013b3
push ebx
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x44]
push dword [esp + 0x5c]
call fcn.00403910
add esp, 0x24
jmp 0x403167
push 0x40b184
push dword [esp + 0x28]
call fcn.00404a58
pop ecx
cmp eax, ebx
pop ecx
mov dword [esp + 0x54], eax
je 0x403167
push 0x400
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
call fcn.00404180
pop ecx
mov dword [esp + 0x18], eax
mov edi, 0x400
push edi
push ebx
push dword [esp + 0x20]
call fcn.004046b0
push dword [esp + 0x60]
push edi
push 1
push dword [esp + 0x30]
call fcn.0040418e
mov edi, eax
mov eax, dword [esp + 0x2c]
add eax, edi
push eax
push dword [esp + 0x3c]
call fcn.00404276
mov ecx, dword [esp + 0x34]
push edi
push dword [esp + 0x40]
add ecx, eax
mov dword [esp + 0x48], eax
push ecx
call fcn.00403e40
mov eax, dword [esp + 0x84]
add dword [esp + 0x40], edi
add esp, 0x30
test byte [eax + 0xc], 0x10
je 0x403015
push dword [esp + 0x18]
call fcn.00404175
push ebx
lea eax, [esp + 0x18]
push 0x20
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004013b3
push ebx
push ebx
push dword [esp + 0x40]
push dword [esp + 0x48]
push dword [esp + 0x40]
call fcn.00403910
push dword [esp + 0x44]
call fcn.0040441b
add esp, 0x2c
jmp 0x403167
push ebp
call fcn.00404180
mov edi, eax
push ebp
push ebx
push edi
call fcn.004046b0
mov eax, dword [esp + 0x68]
add eax, 7
push eax
push edi
call fcn.004045c0
push ebp
call fcn.00404180
add esp, 0x1c
mov dword [esp + 0x10], eax
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c
push dword [esp + 0x14]
call fcn.00404500
push edi
mov byte [eax + 1], bl
push dword [esp + 0x1c]
call fcn.004045d0
push ebp
call fcn.00404180
add esp, 0x14
mov dword [esp + 0x24], eax
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push dword [esp + 0x28]
call fcn.004044c0
push 0x5c
push edi
mov byte [eax + 1], bl
call fcn.004044c0
add esp, 0x10
cmp eax, ebx
je 0x403131
inc eax
push eax
jmp 0x403132
push edi
push dword [esp + 0x28]
call fcn.004045d0
pop ecx
pop ecx
push ebx
push dword [esp + 0x14]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
call fcn.00404175
push dword [esp + 0x28]
call fcn.00404175
push dword [esp + 0x18]
call fcn.00404175
add esp, 0xc
push dword [esp + 0x30]
call fcn.00404175
pop ecx
mov edi, 0x40c000
push edi
push dword [esp + 0x84]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4031a4
push str._path
push esi
call fcn.004045d0
push dword [esp + 0x88]
push esi
call fcn.004045d0
add esp, 0x10
push edi
push dword [esp + 0x60]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4031c0
push dword [esp + 0x5c]
push esi
call fcn.004045d0
pop ecx
pop ecx
push edi
push dword [esp + 0x64]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4031dc
push dword [esp + 0x60]
push esi
call fcn.004045d0
pop ecx
pop ecx
push edi
push dword [esp + 0x80]
call fcn.00404710
pop ecx
mov edi, 0x40b294
test eax, eax
pop ecx
je 0x40320b
push edi
push esi
call fcn.004045d0
push dword [esp + 0x84]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x88]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403239
push edi
push esi
call fcn.004045d0
push dword [esp + 0x8c]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x70]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403261
push edi
push esi
call fcn.004045d0
push dword [esp + 0x74]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x6c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403289
push edi
push esi
call fcn.004045d0
push dword [esp + 0x70]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x68]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4032b1
push edi
push esi
call fcn.004045d0
push dword [esp + 0x6c]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x9c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4032df
push edi
push esi
call fcn.004045d0
push dword [esp + 0xa0]
push esi
call fcn.004045d0
add esp, 0x10
cmp dword [esp + 0xc4], ebx
je 0x4032f5
push str._OEMail
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xac], ebx
je 0x40330b
push str._IEMail
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xa4], ebx
je 0x403321
push str._NSMail
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xb0], ebx
je 0x403337
push str._O98Mail
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xcc], ebx
je 0x40334d
push str._nomodem
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xb8], ebx
je 0x403363
push str._dunprefix
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xc8], ebx
je 0x403379
push str._dunsuffix
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xc0], ebx
je 0x40338f
push str._mailprefix
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xb4], ebx
je 0x4033a5
push str._mailsuffix
push esi
call fcn.004045d0
pop ecx
pop ecx
lea eax, [esp + 0x130]
push 0x40c000
push eax
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4033d5
push edi
push esi
call fcn.004045d0
lea eax, [esp + 0x138]
push eax
push esi
call fcn.004045d0
add esp, 0x10
lea eax, [esp + 0x164]
push 0x40c000
push eax
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403405
push edi
push esi
call fcn.004045d0
lea eax, [esp + 0x16c]
push eax
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x78]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x40342d
push edi
push esi
call fcn.004045d0
push dword [esp + 0x7c]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x4c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403455
push edi
push esi
call fcn.004045d0
push dword [esp + 0x50]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x94]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403483
push edi
push esi
call fcn.004045d0
push dword [esp + 0x98]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x5c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4034ab
push edi
push esi
call fcn.004045d0
push dword [esp + 0x60]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x98]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4034d9
push edi
push esi
call fcn.004045d0
push dword [esp + 0x9c]
push esi
call fcn.004045d0
add esp, 0x10
cmp dword [esp + 0xbc], ebx
je 0x4034ef
push str._dialoption
push esi
call fcn.004045d0
pop ecx
pop ecx
cmp dword [esp + 0xa8], ebx
je 0x403505
push str._rboot
push esi
call fcn.004045d0
pop ecx
pop ecx
push 0x40c000
push dword [esp + 0x90]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403533
push edi
push esi
call fcn.004045d0
push dword [esp + 0x94]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x7c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x40355e
push edi
push esi
call fcn.004045d0
push dword [esp + 0x80]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x8c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x40358c
push edi
push esi
call fcn.004045d0
push dword [esp + 0x90]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0xa0]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4035ba
push edi
push esi
call fcn.004045d0
push dword [esp + 0xa4]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x44]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4035e2
push edi
push esi
call fcn.004045d0
push dword [esp + 0x48]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x30]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x40360a
push edi
push esi
call fcn.004045d0
push dword [esp + 0x34]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x2c]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403632
push edi
push esi
call fcn.004045d0
push dword [esp + 0x30]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x48]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x40365a
push edi
push esi
call fcn.004045d0
push dword [esp + 0x4c]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x74]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x403682
push edi
push esi
call fcn.004045d0
push dword [esp + 0x78]
push esi
call fcn.004045d0
add esp, 0x10
push 0x40c000
push dword [esp + 0x54]
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4036aa
push edi
push esi
call fcn.004045d0
push dword [esp + 0x58]
push esi
call fcn.004045d0
add esp, 0x10
mov edi, 0x40bdc4
push 0x40c000
push edi
call fcn.00404710
pop ecx
test eax, eax
pop ecx
je 0x4036d5
push str._appl
push esi
call fcn.004045d0
push edi
push esi
call fcn.004045d0
add esp, 0x10
push 0x24
push esi
call fcn.00404500
pop ecx
cmp eax, ebx
pop ecx
je 0x4036e6
mov byte [eax], 0x20
mov eax, dword [0x40bff8]
cmp eax, ebx
je 0x4036f6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
lea ecx, [esp + 0x124]
pop eax
mov dword [esp + 0xdc], 0x44
push ecx
lea ecx, [esp + 0xe0]
push ecx
push ebx
push ebx
push 0x80
push eax
push ebx
push ebx
push esi
push ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov word [esp + 0x136], bx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x130], eax
mov word [esp + 0x134], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40376c
push 0xffffffffffffffff
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x38]
call fcn.00404175
push dword [esp + 0xa4]
call fcn.00404175
push dword [esp + 0x3c]
call fcn.00404175
push dword [esp + 0x20]
call fcn.00404175
push esi
call fcn.00404175
push dword [esp + 0x34]
call fcn.00404175
push dword [esp + 0x98]
call fcn.00404175
push dword [esp + 0x98]
call fcn.00404175
push dword [esp + 0xa4]
call fcn.00404175
push dword [esp + 0x50]
call fcn.00404175
push dword [esp + 0x50]
call fcn.00404175
push dword [esp + 0x7c]
call fcn.00404175
push dword [esp + 0xbc]
call fcn.00404175
push dword [esp + 0xc8]
call fcn.00404175
push dword [esp + 0xd4]
call fcn.00404175
push dword [esp + 0xac]
call fcn.00404175
add esp, 0x40
push dword [esp + 0x6c]
call fcn.00404175
push dword [esp + 0x8c]
call fcn.00404175
push dword [esp + 0x80]
call fcn.00404175
push dword [esp + 0xa4]
call fcn.00404175
push dword [esp + 0x68]
call fcn.00404175
push dword [esp + 0x78]
call fcn.00404175
push dword [esp + 0xa8]
call fcn.00404175
push dword [esp + 0x84]
call fcn.00404175
push dword [esp + 0x94]
call fcn.00404175
push dword [esp + 0x6c]
call fcn.00404175
push dword [esp + 0x88]
call fcn.00404175
push dword [esp + 0x88]
call fcn.00404175
push dword [esp + 0x74]
call fcn.00404175
push ebp
call fcn.00404180
add esp, 0x38
mov esi, eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.00401421
mov dword [esp], str.AddShortcut.exe
push esi
call fcn.004045d0
push 0x40b164
push esi
call fcn.00404a58
add esp, 0x10
cmp eax, ebx
je 0x4038e9
push eax
call fcn.0040489e
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
push esi
call fcn.00404175
push dword [esp + 0x40]
call fcn.0040441b
pop ecx
pop ecx
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x408
ret 0x10