Function at 0x4014b0
Capabilities:
Check if file exists
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
mov eax, 0x12ac
call fcn.00409ea0
mov eax, dword [esp + 0x12b0]
mov ecx, dword [0x437518]
push ebx
push ebp
movdqu xmm1, xmmword [eax]
xor ebx, ebx
mov dword [esp + 8], ecx
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [esp + 0x24], xmm0
movdqa xmm0, xmm1
push esi
psrldq xmm0, 4
push edi
movd edi, xmm0
movdqa xmm0, xmm1
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
psrldq xmm0, 8
mov ebp, edi
movd edx, xmm0
mov dword [0x40e104], eax
movd eax, xmm1
mov esi, edx
shl ebp, 0xc
shl esi, 0xc
add ebp, section..ndata
mov dword [esp + 0x3c], eax
add esi, section..ndata
add eax, 0xfffffffe
mov dword [esp + 0x14], ebx
mov dword [esp + 0x40], esi
movdqu xmmword [esp + 0x1c], xmm1
mov dword [esp + 0x24], edx
cmp eax, 0xc6
ja case.0x40154f.65
movzx eax, byte [eax + 0x403afc]
jmp dword [eax*4 + 0x4039f8]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
push 0
push edi
call fcn.004074c0
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12ac
ret 4
inc dword [0x43750c]
test ecx, ecx
je 0x401591
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12ac
ret 4
push edi
call fcn.00403d90
dec eax
push 0
push eax
call fcn.004013c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
push 0
push edi
call fcn.004074c0
xor ebx, ebx
add dword [0x439608], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
push 0
call fcn.00403c00
mov ecx, 1
cmp eax, ecx
cmovg ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40154f.65
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x40154f.65
cmp dword [esp + 0x28], ebx
jne 0x401629
mov eax, dword [edi*4 + 0x439600]
push 1
mov dword [edi*4 + 0x4395c0], eax
call fcn.00403c00
mov ecx, dword [esp + 0x20]
mov dword [ecx*4 + 0x439600], eax
jmp case.0x40154f.65
mov eax, dword [edi*4 + 0x4395c0]
mov dword [edi*4 + 0x439600], eax
jmp case.0x40154f.65
mov esi, dword [esp + 0x28]
xor eax, eax
pop edi
mov edx, dword [esi*4 + 0x439600]
test edx, edx
sete al
mov ecx, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x28]
and eax, edx
mov dword [esi*4 + 0x439600], eax
mov eax, ecx
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
push dword [edx*4 + 0x439600]
push ebp
call fcn.00407e60
jmp case.0x40154f.65
mov eax, dword [0x437504]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x401694
push edx
push eax
call esi
mov edi, dword [esp + 0x20]
mov eax, dword [0x437508]
test eax, eax
je case.0x40154f.65
push edi
push eax
call esi
jmp case.0x40154f.65
mov eax, 0xfffffff0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
push dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x40154f.65
mov ebx, 1
jmp 0x4015c9
mov eax, 0xfffffff0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov edi, eax
push edi
call fcn.00408730
push edi
call fcn.004085d0
mov esi, eax
test esi, esi
je 0x40178f
push 0x5c
push esi
call fcn.00407e20
mov esi, eax
xor eax, eax
movzx ebp, word [esi]
mov word [esi], ax
test bp, bp
jne 0x40175f
cmp dword [esp + 0x28], eax
je 0x40175f
call fcn.00407d10
test eax, eax
je 0x40175f
push edi
call fcn.004075d0
jmp 0x401765
push edi
call fcn.004075b0
test eax, eax
je 0x40177c
cmp eax, 0xb7
jne 0x40177b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40177c
inc ebx
mov word [esi], bp
add esi, 2
test bp, bp
jne 0x401731
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x24], 0
push 0x40f108
je 0x4017c2
push 0xffffffffffffffe6
call fcn.004074c0
push edi
push 0x451000
call fcn.00408510
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4017c9
inc ebx
mov dword [esp + 0x14], ebx
jmp 0x4015c9
push 0xfffffffffffffff5
call fcn.004074c0
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
xor eax, eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
push eax
call fcn.00407df0
mov ecx, dword [esp + 0x28]
test eax, eax
pop edi
cmovne ecx, dword [esp + 0x20]
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x12ac
ret 4
mov eax, 0xffffffd0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov edi, eax
push edi
call fcn.00408730
mov eax, 0xffffffdf
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407660
mov ebx, eax
push ebx
call fcn.00408730
mov eax, 0x13
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407660
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4018bb
push 0x40f108
push 0xffffffffffffffe3
jmp 0x4015c2
cmp dword [esp + 0x28], 0
je 0x4016ec
push edi
call fcn.00407df0
test eax, eax
je 0x4016ec
push ebx
push edi
call fcn.00407a00
push 0x40f108
push 0xffffffffffffffe4
jmp 0x4015c2
xor eax, eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov edi, eax
lea eax, [esp + 0x18]
push eax
push esi
push 0x800
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x40192f
xor eax, eax
mov ebx, 1
mov word [esi], ax
jmp 0x401955
mov eax, dword [esp + 0x18]
cmp eax, edi
jbe 0x401953
cmp word [eax], bx
je 0x401953
push edi
call fcn.00407df0
test eax, eax
je 0x401923
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call fcn.00408510
xor ebx, ebx
cmp dword [esp + 0x28], 0
jne 0x4015c9
push 0x800
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x4015c9
or eax, 0xffffffff
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
lea eax, [esp + 0x38]
push eax
push ebp
push 0x800
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x40154f.65
xor eax, eax
mov ebx, 1
mov word [ebp], ax
jmp 0x4015c9
mov eax, 0xffffffef
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
push esi
push ebp
call fcn.00408400
test eax, eax
jne case.0x40154f.65
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, 0x31
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov esi, dword [esp + 0x20]
mov ebx, eax
push ebx
mov dword [esp + 0x1c], ebx
and esi, 7
call fcn.00408840
push ebx
test eax, eax
je 0x401a5e
push 0x40e108
call fcn.00408510
jmp 0x401a79
push 0x451000
push 0x40e108
call fcn.00408510
push eax
call fcn.00407d50
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x40e108
call fcn.00408730
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esp, [esp]
cmp esi, 3
jl 0x401ac6
push 0x40e108
call fcn.00407df0
xor ecx, ecx
test eax, eax
je 0x401ab6
lea ecx, [esp + 0x2c]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
add esi, 0xfffffffd
or esi, 0x80000000
and esi, ecx
neg esi
sbb esi, esi
inc esi
test esi, esi
jne 0x401ad4
push 0x40e108
call fcn.004085a0
xor eax, eax
cmp esi, 1
setne al
inc eax
push eax
push 0x40000000
push 0x40e108
mov dword [esp + 0x48], eax
call fcn.004082a0
mov edi, eax
cmp edi, 0xffffffff
jne 0x401caf
push 0x40e108
call sub.KERNEL32.dll_lstrlenW
push 0xffe
mov ebx, eax
lea eax, [esp + 0x2c2]
push 0
push eax
call fcn.00409ed0
add esp, 0xc
mov eax, 0x7fe
cmp ebx, 0x7fe
cmova ebx, eax
xor eax, eax
xor edi, edi
mov word [esp + 0x2bc], ax
test ebx, ebx
je 0x401b86
lea ecx, [ecx]
cmp word [edi*2 + 0x40e108], 0x5c
jne 0x401b67
lea eax, [esp + 0x2bc]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x401b67
lea eax, [esp + 0x2bc]
push eax
call fcn.004075b0
mov ax, word [edi*2 + 0x40e108]
mov word [esp + edi*2 + 0x2bc], ax
xor eax, eax
mov word [esp + edi*2 + 0x2be], ax
inc edi
cmp edi, ebx
jb 0x401b40
push dword [esp + 0x3c]
push 0x40000000
push 0x40e108
call fcn.004082a0
mov edi, eax
cmp edi, 0xffffffff
jne 0x401caf
test esi, esi
jne 0x401c93
push section..ndata
push 0x410108
call fcn.00408510
push 0x40e108
push section..ndata
call fcn.00408510
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401c16
push 0x40c2f0
push section..ndata
call sub.KERNEL32.dll_lstrcatW
push dword [esp + 0x10]
push section..ndata
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x34]
mov dword [esp + 0x14], 0
push 0x40f108
call fcn.00407660
push 0x410108
push section..ndata
call fcn.00408510
mov eax, dword [esp + 0x20]
sar eax, 3
push eax
push 0x40f108
call fcn.00408480
sub eax, 4
je 0x401a90
dec eax
je 0x401c7e
push 0x40e108
push 0xfffffffffffffffa
call fcn.004074c0
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12ac
ret 4
inc dword [0x439608]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
push dword [esp + 0x18]
push 0xffffffffffffffe2
call fcn.004074c0
cmp esi, 2
jne case.0x40154f.65
lea ebx, [esi - 1]
jmp 0x4015c9
mov ebx, dword [esp + 0x18]
push ebx
push 0xffffffffffffffea
call fcn.004074c0
inc dword [0x439634]
push 0
push 0
push edi
push dword [esp + 0x34]
call fcn.00404230
dec dword [0x439634]
mov esi, eax
cmp dword [esp + 0x2c], 0xffffffff
jne 0x401ce5
cmp dword [esp + 0x30], 0xffffffff
je 0x401cf4
lea eax, [esp + 0x2c]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jns 0x401dc2
cmp esi, 0xfffffffe
jne 0x401d7b
push 0xffffffffffffffe9
push 0x40e108
call fcn.00407660
push ebx
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401d72
push 0x40c2f0
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push dword [esp + 0x10]
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401d87
push 0xffffffffffffffee
push 0x40e108
call fcn.00407660
push 0x40c2f8
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push ebx
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push 0x200010
push 0x40e108
call fcn.00408480
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12ac
ret 4
cmp dword [0x413174], 0
je case.0x40154f.65
mov edx, dword [0x439574]
xor eax, eax
test edx, edx
jle case.0x40154f.65
mov ebx, dword [0x439570]
xor ecx, ecx
mov ebp, dword [esp + 0x28]
jmp 0x401df0
cmp dword [ebx + ecx], 0xc9
jne 0x401e07
mov esi, dword [ebx + ecx + 0x14]
mov edi, dword [ebx + ecx + 0x18]
cmp dword [ebx + ecx + 0x10], ebp
je 0x401e14
inc eax
add ecx, 0x1c
cmp eax, edx
jl 0x401df0
jmp case.0x40154f.65
test esi, esi
je case.0x40154f.65
cmp edi, 0xc9
jne case.0x40154f.65
push 0x40e108
call fcn.004089d0
add esp, 4
cmp esi, eax
je case.0x40154f.65
xor eax, eax
push 0xffe
push eax
mov word [esp + 0x2c4], ax
lea eax, [esp + 0x2c6]
push eax
call fcn.00409ed0
add esp, 0xc
lea eax, [esp + 0x2bc]
push 0x40c2fc
push eax
call fcn.00408510
push 0x40e108
lea eax, [esp + 0x2c0]
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x40c31c
lea eax, [esp + 0x2c0]
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x21
lea eax, [esp + 0x2c0]
push eax
call fcn.00408480
cmp eax, 2
jne case.0x40154f.65
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12ac
ret 4
xor eax, eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
push dword [esp + 0x24]
push eax
call fcn.00408030
jmp case.0x40154f.65
mov eax, 0x31
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
push dword [esp + 0x20]
push eax
call fcn.00408480
test eax, eax
je 0x4016ec
cmp eax, dword [esp + 0x28]
jne 0x401f40
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
cmp eax, dword [esp + 0x30]
jne case.0x40154f.65
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
mov eax, 0xfffffff0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
push dword [esp + 0x24]
push esi
call fcn.00408030
jmp case.0x40154f.65
mov eax, 1
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
push ebp
call fcn.00407e60
jmp case.0x40154f.65
push 2
call fcn.00403c00
push 3
mov edi, eax
call fcn.00403c00
mov ebx, eax
mov eax, 1
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407660
mov esi, eax
xor eax, eax
mov word [ebp], ax
cmp dword [esp + 0x28], eax
je 0x402025
test edi, edi
je case.0x40154f.65
push esi
call sub.KERNEL32.dll_lstrlenW
test ebx, ebx
jns 0x402037
add ebx, eax
js case.0x40154f.65
cmp ebx, eax
cmovg ebx, eax
lea eax, [esi + ebx*2]
push eax
push ebp
call fcn.00408510
test edi, edi
je case.0x40154f.65
jns 0x402068
push ebp
call sub.KERNEL32.dll_lstrlenW
add edi, eax
jns 0x402068
xor edi, edi
xor eax, eax
mov word [ebp + edi*2], ax
jmp case.0x40154f.65
cmp edi, 0x800
jge case.0x40154f.65
xor eax, eax
mov word [ebp + edi*2], ax
jmp case.0x40154f.65
mov eax, 0x20
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
mov edi, eax
mov eax, 0x31
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407660
push eax
push edi
cmp dword [esp + 0x38], ebx
jne 0x4020fb
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401f2f
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401f2f
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
mov eax, 1
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
push 0x800
mov esi, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x402166
cmp dword [esp + 0x28], ebx
je 0x40217d
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40217d
xor eax, eax
mov ebx, 1
mov word [ebp], ax
mov word [ebp + 0xffe], ax
jmp 0x4015c9
xor ebx, ebx
xor eax, eax
mov word [ebp + 0xffe], ax
jmp 0x4015c9
push 0
call fcn.00403c00
push 1
mov esi, eax
call fcn.00403c00
cmp dword [esp + 0x34], ebx
jne 0x4021c2
cmp esi, eax
jl 0x401f2f
jle 0x4020ea
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
cmp esi, eax
jb 0x401f2f
jbe 0x4020ea
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12ac
ret 4
push 1
call fcn.00403c00
push 2
mov esi, eax
call fcn.00403c00
mov ecx, eax
mov eax, dword [esp + 0x2c]
cmp eax, 0xc
ja case.default.0x402200
jmp dword [eax*4 + 0x403bc4]
add esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
sub esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
imul esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
test ecx, ecx
je 0x402251
mov eax, esi
xor ebx, ebx
cdq
idiv ecx
mov esi, eax
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
xor esi, esi
push esi
push ebp
lea ebx, [esi + 1]
call fcn.00407e60
jmp 0x4015c9
or esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
and esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
xor esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
xor eax, eax
test esi, esi
sete al
xor ebx, ebx
mov esi, eax
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
test esi, esi
jne 0x4022c9
test ecx, ecx
jne 0x4022c9
xor esi, esi
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
test esi, esi
je 0x4022b1
test ecx, ecx
je 0x4022b1
mov esi, 1
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
test ecx, ecx
je 0x402251
mov eax, esi
xor ebx, ebx
cdq
idiv ecx
mov esi, edx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
shl esi, cl
xor ebx, ebx
push esi
push ebp
call fcn.00407e60
jmp 0x4015c9
sar esi, cl
push esi
push ebp
xor ebx, ebx
call fcn.00407e60
jmp 0x4015c9
mov eax, 1
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407660
push 2
mov esi, eax
call fcn.00403c00
push eax
push esi
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp case.0x40154f.65
mov eax, dword [esp + 0x28]
mov esi, dword [0x40e100]
test eax, eax
je 0x4023d2
dec eax
test esi, esi
je 0x4023ac
mov esi, dword [esi]
test eax, eax
jne 0x402368
test esi, esi
je 0x4023ac
add esi, 4
push esi
push 0x40e108
call fcn.00408510
mov eax, dword [0x40e100]
add eax, 4
push eax
push esi
call fcn.00408510
mov eax, dword [0x40e100]
push 0x40e108
add eax, 4
push eax
call fcn.00408510
jmp case.0x40154f.65
push 0x200010
push 0xffffffffffffffe8
push 0
call fcn.00407660
push eax
call fcn.00408480
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12ac
ret 4
test edx, edx
je 0x4023fb
test esi, esi
je 0x4016ec
lea eax, [esi + 4]
push eax
push ebp
call fcn.00408510
mov eax, dword [esi]
push esi
mov dword [0x40e100], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x40154f.65
push 0x1004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [esp + 0x20]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.00407660
mov eax, dword [0x40e100]
mov dword [esi], eax
mov dword [0x40e100], esi
jmp case.0x40154f.65
push 3
call fcn.00403c00
push 4
mov ebx, eax
call fcn.00403c00
mov edi, eax
mov al, byte [esp + 0x34]
test al, 1
je 0x402474
mov eax, 0x33
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407660
mov ebx, eax
mov al, byte [esp + 0x34]
test al, 2
je 0x4024a5
mov eax, 0x44
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407660
mov edi, eax
cmp dword [esp + 0x1c], 0x21
jne 0x4024f7
push 1
call fcn.00403c00
push 2
mov esi, eax
call fcn.00403c00
mov ecx, dword [esp + 0x34]
sar ecx, 2
test ecx, ecx
je 0x4024eb
lea edx, [esp + 0x40]
push edx
push ecx
push 0
push edi
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb ebx, ebx
mov eax, dword [esp + 0x40]
inc ebx
mov dword [esp + 0x14], ebx
jmp 0x402569
push edi
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x402565
mov ecx, dword [0x40e104]
mov eax, 1
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x12
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
xor ecx, ecx
cmp word [eax], cx
cmovne ecx, eax
xor eax, eax
cmp word [esi], ax
push ecx
cmovne eax, esi
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x40], eax
cmp dword [esp + 0x20], 0
jl 0x4017c9
push eax
push ebp
call fcn.00407e60
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
push 0
call fcn.00403c00
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov ecx, dword [esp + 0x28]
test eax, eax
pop edi
cmovne ecx, dword [esp + 0x20]
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x12ac
ret 4
push 2
call fcn.00403c00
push eax
push 1
call fcn.00403c00
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push ebp
call fcn.00407e60
jmp case.0x40154f.65
mov eax, dword [0x439588]
add eax, edx
push eax
push 0xffffffffffffffeb
push 0
call fcn.00403c00
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40154f.65
push edx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [0x40e104]
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov edx, dword [esp + 0x28]
mov ecx, edx
imul ecx, dword [esp + 0x58]
imul edx, dword [esp + 0x54]
push 0x10
push ecx
push edx
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x40154f.65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x40154f.65
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 2
call fcn.00403c00
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x413108], eax
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
call fcn.00403c00
mov cl, byte [esp + 0x30]
push dword [esp + 0x24]
mov dword [0x413118], eax
mov al, cl
and al, 1
mov byte [0x41311f], 1
mov byte [0x41311c], al
mov al, cl
and al, 2
and cl, 4
push 0x413124
mov byte [0x41311d], al
mov byte [0x41311e], cl
call fcn.00407660
push 0x413108
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push ebp
call fcn.00407e60
jmp case.0x40154f.65
push 0
call fcn.00403c00
push 1
mov esi, eax
call fcn.00403c00
push eax
push esi
cmp dword [esp + 0x34], ebx
jne 0x402719
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x40154f.65
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x40154f.65
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov ebx, eax
mov eax, 0x31
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov edi, eax
mov eax, 0x22
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x15
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
push 0x40f108
push 0xffffffffffffffec
call fcn.004074c0
push dword [esp + 0x2c]
xor eax, eax
cmp word [esi], ax
push 0x451000
cmovne eax, esi
push eax
xor eax, eax
cmp word [ebx], ax
push edi
cmovne eax, ebx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
jge case.0x40154f.65
mov ebx, 1
jmp 0x4015c9
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.004074c0
push esi
call fcn.00407fd0
mov esi, eax
test esi, esi
je 0x4016ec
cmp dword [esp + 0x28], ebx
je 0x4028b2
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push esi
call edi
cmp eax, 0x102
jne 0x402873
nop
push 0xf
call fcn.004079b0
push 0x64
push esi
call edi
cmp eax, 0x102
je 0x402860
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x24], ebx
jl 0x4028a2
push dword [esp + 0x18]
push dword [esp + 0x44]
call fcn.00407e60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
cmp dword [esp + 0x18], ebx
mov eax, 1
cmovne ebx, eax
mov dword [esp + 0x14], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
push eax
call fcn.00407df0
mov edi, eax
test edi, edi
je 0x402909
push dword [edi + 0x14]
push esi
call fcn.00407e60
push dword [edi + 0x18]
push ebp
call fcn.00407e60
jmp case.0x40154f.65
xor eax, eax
mov word [ebp], ax
mov word [esi], ax
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, 0xffffffee
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ebx, eax
push ebx
mov dword [esp + 0x48], ebx
call fcn.00408730
lea eax, [esp + 0x38]
push eax
push ebx
push 8
call fcn.00408260
call eax
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov word [ebp], cx
mov word [esi], cx
lea ebx, [ecx + 1]
test eax, eax
je 0x4015c9
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4015c9
push 9
call fcn.00408260
push 0xa
mov esi, eax
call fcn.00408260
push edi
push dword [esp + 0x40]
mov dword [esp + 0x50], eax
push 0
push dword [esp + 0x50]
call esi
test eax, eax
je 0x4029e0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x40c358
push edi
call dword [esp + 0x58]
test eax, eax
je 0x4029e0
mov eax, dword [esp + 0x18]
push dword [eax + 8]
push ebp
call fcn.00407e60
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [esp + 0x44]
call fcn.00407e60
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4015c9
cmp dword [0x4395a0], 0
mov ebx, 1
jl 0x402b04
mov eax, 0xfffffff0
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov edi, eax
push edi
call fcn.00408730
mov ecx, dword [0x40e104]
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
cmp dword [esp + 0x30], 0
mov ebp, eax
je 0x402a66
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x402a77
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x402af3
push ebp
push esi
call fcn.00407a30
mov edi, eax
test edi, edi
je 0x402ac6
mov eax, dword [esp + 0x28]
xor ebx, ebx
test eax, eax
je 0x402aa6
push 0x40f108
push eax
call fcn.004074c0
call edi
test eax, eax
je 0x402ace
mov ebx, 1
jmp 0x402ace
mov eax, dword [esp + 0x10]
push section..data
push 0x40e100
push section..ndata
push 0x800
push eax
call edi
add esp, 0x14
jmp 0x402ace
push ebp
push 0xfffffffffffffff7
call fcn.004074c0
cmp dword [esp + 0x2c], 0
jne 0x4015c9
push esi
call fcn.00405180
test eax, eax
je 0x4015c9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4015c9
push 0x40f108
push 0xfffffffffffffff6
call fcn.004074c0
jmp 0x4015c9
push 0x40f108
push 0xffffffffffffffe7
call fcn.004074c0
jmp 0x4015c9
mov eax, 0xfffffff0
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
push eax
mov dword [esp + 0x3c], eax
call fcn.00408730
mov ecx, dword [0x40e104]
mov eax, 0xffffffdf
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov esi, eax
push esi
mov dword [esp + 0x40], esi
call fcn.00408730
mov ecx, dword [0x40e104]
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov dword [esp + 0x48], eax
mov eax, 0xffffffcd
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ebx, eax
push ebx
call fcn.00408730
mov ecx, dword [0x40e104]
mov eax, 0x45
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, ebp
and eax, 0xfff
mov dword [esp + 0x40], eax
mov eax, ebp
mov edi, ebp
and eax, 0x8000
sar edi, 0xc
sar ebp, 0x10
and edi, 7
push esi
mov dword [esp + 0x48], eax
and ebp, 0xffff
call fcn.00408840
test eax, eax
jne 0x402c61
mov ecx, dword [0x40e104]
mov eax, 0x21
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
lea eax, [esp + 0x14]
push eax
push 0x40caec
push 1
push 0
push 0x40cb0c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402d60
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x40cafc
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
js 0x402d44
mov eax, dword [esp + 0x14]
push dword [esp + 0x3c]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x50]
call eax
cmp dword [esp + 0x44], 0
mov esi, eax
jne 0x402ccb
mov eax, dword [esp + 0x14]
push 0x451000
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
test edi, edi
je 0x402cdc
mov eax, dword [esp + 0x14]
push edi
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
call eax
mov eax, dword [esp + 0x14]
push ebp
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x34]
call eax
cmp word [ebx], 0
je 0x402d00
mov eax, dword [esp + 0x14]
push dword [esp + 0x40]
push ebx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x48]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
test esi, esi
js 0x402d38
mov eax, dword [esp + 0x18]
push 1
push dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
test esi, esi
js 0x402d60
push 0x40f108
push 0xfffffffffffffff4
jmp 0x4015c2
push 0x40f108
push 0xfffffffffffffff0
mov ebx, 1
call fcn.004074c0
jmp 0x4015c9
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov edi, eax
mov eax, 0x23
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
push esi
mov ebx, eax
call fcn.00407df0
test eax, eax
je 0x402e53
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 2
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push edi
mov word [esi + eax*2 + 2], cx
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push ebx
push ecx
mov word [edi + eax*2 + 2], cx
mov ax, word [esp + 0x30]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], edi
mov dword [esp + 0x6e], ebx
mov word [esp + 0x64], ax
call fcn.004074c0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x40154f.65
push 0
push 0xfffffffffffffff9
call fcn.004074c0
mov ebx, 1
jmp 0x4015c9
cmp edi, 0xbadf00d
jne 0x4023ac
inc dword [0x439614]
jmp case.0x40154f.65
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x18], ebx
test edi, edi
je 0x402eb0
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov edx, dword [esp + 0x24]
mov ebx, eax
test edx, edx
je 0x402edf
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x40e104]
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [edx + ecx*4]
push eax
call fcn.00407660
mov ebp, eax
cmp dword [esp + 0x30], 0
je 0x402f13
mov eax, 0x22
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x40e104]
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [edx + ecx*4]
push eax
call fcn.00407660
mov dword [esp + 0x18], eax
mov eax, 0xffffffcd
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x40e104]
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [edx + ecx*4]
push eax
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
push esi
push dword [esp + 0x1c]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne case.0x40154f.65
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, 1
mov dword [esp + 0x38], 0xa
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov ebx, eax
mov eax, 0x12
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov edi, eax
mov eax, 0xffffffdd
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
push esi
push 0x7ff
push ebp
lea eax, [esp + 0x44]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp], 0xa
jmp 0x4019b7
cmp dword [esp + 0x30], ebx
jne 0x40305c
push 2
call fcn.00403d20
mov esi, eax
test esi, esi
je 0x4016ec
mov ecx, dword [0x40e104]
mov eax, 0x33
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4030a7
mov eax, 0x22
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ecx, dword [esp + 0x24]
mov edx, eax
test ecx, ecx
jne 0x403096
mov ecx, dword [0x439604]
add ecx, 0x80000001
mov eax, dword [esp + 0x30]
and eax, 2
push eax
push edx
push ecx
call fcn.00403c20
mov edi, eax
test edi, edi
je case.0x40154f.65
mov ebx, 1
jmp 0x4015c9
test edi, edi
jne 0x4030c9
mov edi, dword [0x439604]
add edi, 0x80000001
mov esi, dword [esp + 0x30]
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ecx, dword [0x40e104]
mov ebp, eax
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
push 0
lea ecx, [esp + 0x1c]
mov ebx, 1
push ecx
mov ecx, dword [0x439630]
push 0
or ecx, 2
push ecx
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4015c9
cmp esi, ebx
jne 0x40318a
mov ecx, dword [0x40e104]
mov eax, 0x23
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
push 0x410108
call sub.KERNEL32.dll_lstrlenW
lea eax, [eax*2 + 2]
jmp 0x4031b9
cmp esi, 4
jne 0x40319f
push 3
call fcn.00403c00
mov dword [0x410108], eax
mov eax, esi
jmp 0x4031b9
cmp esi, 3
jne 0x4031b9
push 0x3000
push 0x410108
push 0
push dword [esp + 0x38]
call fcn.00404230
push eax
push 0x410108
push dword [esp + 0x40]
push 0
push ebp
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
neg eax
sbb eax, eax
and ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
push 0x20019
call fcn.00403d20
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x33
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
xor ecx, ecx
mov word [ebp], cx
test esi, esi
je 0x4016ec
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0x1000
push ecx
push ebp
lea ecx, [esp + 0x44]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403293
mov eax, dword [esp + 0x3c]
cmp eax, 4
je 0x403275
cmp eax, 1
je 0x40325c
cmp eax, 2
jne 0x403293
mov ebx, dword [esp + 0x30]
xor eax, eax
push esi
mov word [ebp + 0xffe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
push dword [ebp]
xor ebx, ebx
cmp dword [esp + 0x34], ebx
push ebp
sete bl
call fcn.00407e60
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
xor eax, eax
push esi
mov word [ebp], ax
lea ebx, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
push 0x20019
call fcn.00403d20
push 3
mov esi, eax
call fcn.00403c00
xor ecx, ecx
mov word [ebp], cx
test esi, esi
je 0x4016ec
mov dword [esp + 0x38], 0x7ff
cmp dword [esp + 0x30], ecx
je 0x4032e7
push 0x7ff
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x403305
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x48]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4016ec
xor eax, eax
push esi
mov word [ebp + 0xffe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40154f.65
push ebp
call fcn.00408650
test eax, eax
je case.0x40154f.65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40154f.65
mov eax, 0xffffffed
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov esi, eax
push esi
call fcn.00408730
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call fcn.004082a0
cmp eax, 0xffffffff
jne 0x401fc6
xor eax, eax
mov word [ebp], ax
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, dword [esp + 0x3c]
xor ebx, ebx
mov ecx, dword [esp + 0x28]
cmp eax, 0x38
mov dword [esp + 0x38], ecx
sete bl
test ecx, ecx
je 0x4033b8
push 1
call fcn.00403c00
mov esi, ebx
mov word [0x40f108], ax
neg esi
sbb esi, esi
add esi, 2
jmp 0x40343d
cmp eax, 0x38
jne 0x40340f
mov eax, 0x21
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
push 0
push 0
push 0x800
push 0x40f108
push 0xffffffffffffffff
push 0x410108
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x40f108
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
jmp 0x40343d
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
push eax
call sub.KERNEL32.dll_lstrlenW
mov esi, eax
add esi, esi
cmp word [ebp], 0
je 0x4016ec
push ebp
call fcn.00408650
or ebx, dword [esp + 0x38]
mov edi, eax
jne 0x40346b
cmp dword [esp + 0x2c], ebx
je 0x40346b
push edi
push edi
call fcn.00407c40
test eax, eax
js 0x4016ec
push esi
push 0x40f108
push edi
call fcn.004083a0
test eax, eax
jne case.0x40154f.65
lea ebx, [eax + 1]
jmp 0x4015c9
mov edi, 2
mov dword [esp + 0x18], ebx
push edi
call fcn.00403c00
cmp eax, 1
jl case.0x40154f.65
mov ecx, 0x7ff
cmp eax, ecx
cmovg eax, ecx
mov dword [esp + 0x3c], eax
cmp word [ebp], bx
je 0x4035cf
xor edx, edx
push ebp
mov dword [esp + 0x48], edx
call fcn.00408650
cmp dword [esp + 0x3c], 0
mov ebx, eax
jle 0x4035cf
mov ecx, dword [esp + 0x2c]
xor ebp, ebp
jmp 0x4034e0
cmp dword [esp + 0x1c], 0x39
jne 0x4035e9
push 0
lea eax, [esp + 0x4c]
push eax
mov eax, 2
sub eax, ecx
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4035cf
mov edi, dword [esp + 0x48]
test edi, edi
je 0x4035cf
cmp dword [esp + 0x2c], 0
movzx eax, byte [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x40363f
push 1
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40360d
mov esi, edi
neg esi
dec dword [esp + 0x48]
mov eax, 0xfffd
mov dword [esp + 0x10], eax
je 0x403590
push 1
push 0
inc esi
dec edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x50]
lea eax, [esp + 0x20]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403551
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x40363f
mov edx, dword [esp + 0x44]
cmp dx, 0xd
je 0x403613
cmp dx, 0xa
je 0x403613
mov word [esi + ebp*2], ax
inc ebp
movzx edx, ax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], edx
test ax, ax
je 0x4035cf
cmp ebp, dword [esp + 0x3c]
jl 0x4034e0
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov word [esi + eax*2], cx
test eax, eax
jne case.0x40154f.65
lea ebx, [ecx + 1]
jmp 0x4015c9
test ecx, ecx
jne 0x4035fc
test ebp, ebp
jne 0x4035fc
push ebp
push ebx
call fcn.00407c40
test eax, eax
js 0x4035cf
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004082d0
test eax, eax
je 0x4035cf
mov eax, dword [esp + 0x10]
jmp 0x403594
cmp dx, ax
je 0x40362f
cmp ax, 0xd
je 0x403624
cmp ax, 0xa
jne 0x40362f
mov word [esi + ebp*2], ax
inc ebp
mov dword [esp + 0x18], ebp
jmp 0x4035cf
push 1
push 0
neg edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4035cf
movzx eax, ax
push eax
push esi
call fcn.00407e60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12ac
ret 4
cmp word [ebp], bx
je case.0x40154f.65
push dword [esp + 0x2c]
push 0
push 2
call fcn.00403c00
push eax
push ebp
call fcn.00408650
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x24], ebx
jl case.0x40154f.65
push eax
push esi
call fcn.00407e60
jmp case.0x40154f.65
push ebp
call fcn.00408650
test eax, eax
je case.0x40154f.65
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x40154f.65
push esi
call fcn.00408650
test eax, eax
je 0x4019bd
lea ecx, [esp + 0x6c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4019bd
lea eax, [esp + 0x98]
push eax
push ebp
call fcn.00408510
jmp case.0x40154f.65
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
lea ecx, [esp + 0x6c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x403728
xor eax, eax
mov word [esi], ax
mov word [ebp], ax
lea ebx, [eax + 1]
jmp 0x4015c9
push eax
push esi
call fcn.00407e60
lea eax, [esp + 0x98]
push eax
push ebp
call fcn.00408510
jmp case.0x40154f.65
mov eax, 0xfffffff0
mov ebx, 0xfffffd66
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407660
mov ebp, eax
push ebp
call fcn.00408730
push ebp
call fcn.00408840
test eax, eax
jne 0x4037ac
mov ecx, dword [0x40e104]
mov eax, 0xffffffed
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407660
push eax
call fcn.00408730
push ebp
call fcn.004085a0
push 2
push 0x40000000
push ebp
call fcn.004082a0
mov esi, eax
mov dword [esp + 0x38], esi
cmp esi, 0xffffffff
je 0x40387f
mov edi, dword [0x43953c]
push edi
push 0x40
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x403873
push 0
call fcn.00403ef0
push edi
push ebx
call fcn.00403e20
push dword [esp + 0x28]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x3c], edi
test edi, edi
je 0x40384f
push dword [esp + 0x28]
push edi
push 0
push dword [esp + 0x30]
call fcn.00404230
cmp byte [edi], 0
je 0x403841
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebx
push eax
call fcn.00407fa0
add edi, esi
cmp byte [edi], 0
jne 0x403824
mov esi, dword [esp + 0x38]
push dword [esp + 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call edi
jmp 0x403855
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x44]
push ebx
push esi
call fcn.004083a0
push ebx
call edi
push 0
push 0
push esi
push 0xffffffffffffffff
call fcn.00404230
mov ebx, eax
jmp 0x403878
mov ebx, 0xfffffd66
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0xfffffff3
test ebx, ebx
jns 0x4038a7
push ebp
mov esi, 0xffffffef
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40f108
push esi
lea ebx, [esi + 0x12]
call fcn.004074c0
jmp 0x4015c9
push 0x40f108
push esi
xor ebx, ebx
call fcn.004074c0
jmp 0x4015c9
push 0
call fcn.00403c00
mov ebx, eax
cmp ebx, dword [0x43956c]
jae 0x4016ec
mov ecx, dword [esp + 0x28]
imul edi, ebx, 0x1018
add edi, dword [0x439568]
test ecx, ecx
js 0x4038fa
mov eax, dword [edi + ecx*4]
jne 0x403687
lea eax, [edi + 0x18]
push eax
push esi
call fcn.00408510
jmp case.0x40154f.65
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x28], eax
je 0x403914
push 1
call fcn.00403c00
mov ecx, eax
mov dword [esp + 0x24], ecx
jmp 0x40392c
push dword [esp + 0x30]
lea eax, [edi + 0x18]
push eax
call fcn.00407660
or dword [edi + 8], 0x100
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [edi + eax*4], ecx
cmp dword [esp + 0x2c], 0
je case.0x40154f.65
push ebx
call fcn.00401240
jmp case.0x40154f.65
push 0
call fcn.00403c00
mov edx, eax
cmp edx, 0x20
jae 0x4016ec
cmp dword [esp + 0x2c], ebx
je 0x40398e
cmp dword [esp + 0x28], ebx
je 0x40397b
push edx
call fcn.004012b0
push 0
push 0
call fcn.00401300
jmp case.0x40154f.65
push 0
call fcn.004011b0
push eax
push esi
call fcn.00407e60
jmp case.0x40154f.65
mov eax, dword [0x439544]
cmp dword [esp + 0x28], ebx
je 0x4039a9
mov ecx, dword [esp + 0x24]
mov dword [eax + edx*4 + 0x94], ecx
jmp case.0x40154f.65
push dword [eax + edx*4 + 0x94]
push esi
call fcn.00407660
jmp case.0x40154f.65
mov eax, dword [0x428238]
push 0
and eax, edi
push eax
push 0xb
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x20], ebx
je case.0x40154f.65
mov eax, dword [esp + 0x10]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x40154f.65
push edi
call fcn.00403e40
jmp case.0x40154f.65