Function at 0x402350
Capabilities:
Create directory
Delete directory
Enumerate gui resources
Identify system language via api
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x760
mov eax, dword [ebp + 8]
push str._DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push 0x40db14
mov dword [0x40ea78], eax
call fcn.00404369
pop ecx
test eax, eax
pop ecx
je 0x40237d
xor eax, eax
jmp 0x4032f5
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ebx, ebx
and eax, 0x3ff
push ebx
push 0x4036fc
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [ebp + 0x10]
push 0x40e514
push edi
call fcn.00404369
mov esi, eax
push 0x40e510
neg esi
sbb esi, esi
push edi
neg esi
mov dword [ebp - 0x10], esi
call fcn.00404369
add esp, 0x10
neg eax
sbb eax, eax
neg eax
cmp esi, ebx
mov dword [0x40ea74], eax
jne 0x4023e9
push 0x40e50c
push edi
call fcn.00404369
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [0x40ea74], eax
push str._ieto
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
je 0x402410
push str.cf0b41c0_7c8a_486a_a701_cc804248bfea
call fcn.00401252
test eax, eax
pop ecx
mov dword [ebp - 0xc], 1
je 0x402413
mov dword [ebp - 0xc], ebx
push str._ffto
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
je 0x40243a
push str.0297a026_3011_46d3_ad62_bb9a7612aea7
call fcn.00401252
test eax, eax
pop ecx
mov dword [ebp - 0x24], 1
je 0x40243d
mov dword [ebp - 0x24], ebx
call fcn.004011f2
cmp esi, ebx
mov dword [ebp - 0x1c], eax
mov edi, 0x40518c
jne 0x40249b
cmp eax, ebx
push 1
jne 0x402469
push 0x40ea80
push str.PartnerPixelNotSet
push edi
call fcn.00404b43
add esp, 0x10
jmp 0x40247b
push str.Visible
push edi
call fcn.0040483c
add esp, 0xc
test eax, eax
jne 0x40248b
push 1
push str.Maximized
push edi
call fcn.004048c1
add esp, 0xc
push 1
push str.Visible
push edi
call fcn.004048c1
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], ebx
jne 0x4024f3
push 0x40e494
push dword [ebp + 0x10]
call fcn.00404369
pop ecx
test eax, eax
pop ecx
je 0x4024f3
cmp dword [ebp - 0x1c], ebx
push 1
pop edi
mov dword [ebp - 0x20], edi
jne 0x4024c6
mov dword [ebp - 8], edi
call fcn.00401589
mov esi, eax
push str.0297a026_3011_46d3_ad62_bb9a7612aea7
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0xc], esi
call fcn.00401252
neg eax
sbb eax, eax
pop ecx
inc eax
cmp esi, ebx
mov dword [ebp - 0x24], eax
je 0x4024f3
cmp eax, ebx
je 0x4024f3
mov dword [ebp - 8], edi
push 0x34
mov esi, str._pAFAman000YYA__tc0x33050__hwlHPWL_DDE0BB24_8F8C_44e9_B962_8289B302DEF90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
pop ecx
lea edi, [ebp - 0x378]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x10], ebx
movsb byte es:[edi], byte [esi]
jne 0x4026ed
cmp dword [ebp - 0x1c], ebx
jne 0x4026be
mov esi, 0x40e3bc
push esi
push dword [ebp + 0x10]
call fcn.00404369
pop ecx
cmp eax, ebx
pop ecx
jne 0x40254d
cmp byte [ebp - 0x378], bl
je 0x4025cd
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.00404369
pop ecx
cmp eax, ebx
pop ecx
je 0x4025cd
push 0x3d
push eax
call fcn.0040426c
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4025cd
movsx eax, byte [esi + 1]
xor edi, edi
inc esi
push eax
call fcn.00404412
test eax, eax
pop ecx
jne 0x402593
mov al, byte [edi + esi]
cmp al, 0x2f
je 0x40258b
cmp al, bl
je 0x40258b
movsx eax, byte [edi + esi + 1]
inc edi
push eax
call fcn.00404412
test eax, eax
pop ecx
je 0x40256f
cmp edi, 0xc8
jae 0x4025cd
inc edi
lea eax, [ebp - 0x268]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push ebx
mov esi, 0x40518c
push str.pid2
push esi
call fcn.00404b43
lea eax, [ebp - 0x268]
push ebx
push eax
push 0x40d8f4
push esi
call fcn.00404b43
add esp, 0x20
jmp 0x4025d2
mov esi, 0x40518c
mov dword [ebp - 0x18], str._psid
mov dword [ebp - 0x14], str._ic
mov dword [ebp - 0x2c], str.psid
mov dword [ebp - 0x28], 0x40dd88
mov dword [ebp + 8], ebx
jmp 0x4025f8
mov esi, 0x40518c
mov eax, dword [ebp + 8]
push dword [ebp + eax - 0x18]
push dword [ebp + 0x10]
call fcn.00404369
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40267f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [ebp + eax - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
movsx eax, byte [edi]
push eax
call fcn.00404412
test eax, eax
pop ecx
jne 0x40265b
mov eax, dword [ebp - 4]
mov al, byte [eax + edi]
cmp al, 0x2f
je 0x402652
cmp al, bl
je 0x402652
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movsx eax, byte [eax + edi]
push eax
call fcn.00404412
test eax, eax
pop ecx
je 0x40262f
cmp dword [ebp - 4], 0xc8
jae 0x4026b0
mov eax, dword [ebp - 4]
inc eax
push eax
lea eax, [ebp - 0x268]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x268]
push ebx
push eax
mov eax, dword [ebp + 8]
push dword [ebp + eax - 0x2c]
jmp 0x4026a7
mov eax, dword [ebp + 8]
cmp eax, ebx
jle 0x4026b0
mov edi, dword [ebp + eax - 0x2c]
lea eax, [ebp - 0x268]
push 0xc8
push eax
push edi
push esi
call fcn.00404951
add esp, 0x10
test eax, eax
je 0x4026b0
push ebx
push ebx
push edi
push esi
call fcn.00404b43
add esp, 0x10
add dword [ebp + 8], 4
cmp dword [ebp + 8], 8
jb 0x4025f3
cmp dword [ebp - 8], ebx
jne 0x4026ed
mov esi, str.CV_DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push str._DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push esi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
jne 0x4026ed
push ebx
push esi
push 0x40e3a0
push 0x40518c
call fcn.00404b43
add esp, 0x10
push ebx
mov esi, 0x40e39c
push ebx
mov edi, 0x40518c
push esi
push edi
call fcn.00404b43
add esp, 0x10
cmp dword [ebp - 0x10], ebx
jne 0x4029a7
cmp dword [ebp - 8], ebx
jne 0x40272b
push ebx
push str.CouponXplorer
push esi
push edi
call fcn.00404b43
add esp, 0x10
cmp dword [ebp - 0x20], ebx
jne 0x40272b
call fcn.0040374b
mov esi, str._tc
push esi
push dword [ebp + 0x10]
call fcn.00404369
pop ecx
cmp eax, ebx
pop ecx
jne 0x402762
cmp byte [ebp - 0x378], bl
je 0x4027fd
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.00404369
pop ecx
cmp eax, ebx
pop ecx
je 0x4027fd
add eax, 4
push eax
call fcn.0040444b
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x4027fd
mov edi, str.tiec
push eax
mov esi, 0x40518c
push edi
push esi
call fcn.004048c1
push 3
push dword [ebp + 8]
push edi
push esi
call fcn.004048ef
mov eax, dword [ebp + 8]
mov esi, str.SoftwareCouponXplorer_5z_barSwitches
shr eax, 0x10
and eax, 1
mov edi, SysStringLen
push eax
push 0x40e350
push esi
push edi
call fcn.00404920
mov eax, dword [ebp + 8]
shr eax, 0x11
and eax, 1
push eax
push 0x40e34c
push esi
push edi
call fcn.00404920
mov eax, dword [ebp + 8]
shr eax, 9
and eax, 1
push eax
push 0x40e348
push esi
push edi
call fcn.00404920
mov eax, dword [ebp + 8]
add esp, 0x4c
shr eax, 0xf
and eax, 1
push eax
push 0x40e344
push esi
push edi
call fcn.00404920
add esp, 0x10
cmp dword [ebp - 8], ebx
jne 0x4029a7
cmp dword [ebp - 0x1c], ebx
jne 0x4028ec
push str._idate
push dword [ebp + 0x10]
call fcn.00404369
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x402898
mov esi, str.0123456789:_TZtz
lea edi, [ebp - 0x19c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add dword [ebp + 8], 7
push 0x15
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x188]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.0040451a
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x188]
add esp, 0xc
mov dword [ebp - 0x14], ebx
sub edi, esi
movsx eax, byte [esi]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.0040426c
pop ecx
test eax, eax
pop ecx
je 0x40287e
mov al, byte [esi]
inc dword [ebp - 0x14]
mov byte [edi + esi], al
inc esi
cmp dword [ebp - 0x14], 0x14
jl 0x402859
lea eax, [ebp - 0x188]
push ebx
push eax
push str.idate
push 0x40518c
call fcn.00404b43
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x28]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x32]
push eax
movzx eax, word [ebp - 0x34]
push eax
lea eax, [ebp - 0x1e0]
push str._04d__02d__02dT_02d:_02d:_02dZ
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1e0]
push ebx
push eax
push str.lidate
push 0x40518c
call fcn.00404b43
add esp, 0x30
mov esi, str._hwl
push esi
push dword [ebp + 0x10]
call fcn.00404369
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x402937
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.00404369
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40292e
lea eax, [ebp - 0x378]
push str._hwlHPWL_DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push eax
call fcn.00404369
pop ecx
test eax, eax
pop ecx
je 0x402933
mov edi, str._hwl.mywebsearch.com_.google.com_.yahoo.com_.bing.com_.msn.com
cmp edi, ebx
je 0x4029a7
push 0x3d
push edi
call fcn.0040426c
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x4029a7
movsx eax, byte [edi + 1]
xor esi, esi
inc edi
push eax
call fcn.00404412
test eax, eax
pop ecx
jne 0x40297d
mov al, byte [esi + edi]
cmp al, 0x2f
je 0x402975
cmp al, bl
je 0x402975
movsx eax, byte [esi + edi + 1]
inc esi
push eax
call fcn.00404412
test eax, eax
pop ecx
je 0x402959
cmp esi, 0x3e8
jae 0x4029a7
inc esi
lea eax, [ebp - 0x760]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x760]
push ebx
push eax
push str.hpwl
push 0x40518c
call fcn.00404b43
add esp, 0x10
mov al, byte [0x40ea80]
push 0x4a
mov byte [ebp - 0x170], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x16f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x10]
push ebx
neg eax
sbb eax, eax
mov esi, 0x40518c
and eax, 2
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x44], eax
xor eax, eax
push str.CurInstall
mov dword [ebp - 0x40], ebx
push esi
stosd dword es:[edi], eax
call fcn.0040483c
add esp, 0xc
cmp dword [ebp - 0x10], ebx
mov dword [ebp + 8], eax
jne 0x4029fc
cmp dword [ebp - 8], ebx
jne 0x4029fc
inc dword [ebp + 8]
push ebx
lea eax, [ebp - 0x170]
push 0xfa
push eax
push ebx
push ebx
push 0x4051b8
push esi
call fcn.00404cde
add esp, 0x1c
test eax, eax
je 0x40325a
cmp byte [ebp - 0x170], bl
je 0x40325a
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 8]
mov edi, str._x.bin_
lea eax, [ebp + eax - 0x170]
push edi
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
cmp dword [ebp - 0x10], ebx
jne 0x402ad0
cmp dword [ebp - 8], ebx
jne 0x402ad0
lea eax, [ebp - 0x170]
push ebx
push eax
call esi
test eax, eax
jne 0x402ad0
mov eax, dword [ebp + 8]
lea ecx, [eax + 5]
cmp eax, ecx
jge 0x402ad0
inc eax
mov dword [ebp - 0x14], eax
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x170]
push ebx
push eax
call esi
test eax, eax
jne 0x402ab2
mov eax, dword [ebp + 8]
add eax, 5
cmp dword [ebp - 0x14], eax
jg 0x402ab8
inc dword [ebp - 0x14]
push dword [ebp - 0x14]
jmp 0x402a84
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + 8], eax
je 0x402ad0
push dword [ebp + 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x40325a
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jne 0x402c6a
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.PREPART
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402afa
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.assists_
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push str.ie_default_search_provider_
push eax
call edi
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.ASSIST
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402b92
mov eax, dword [ebp - 0x14]
mov byte [eax], bl
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.assists_
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push str.ie_enable_
push eax
call edi
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.ASSIST2
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402c2f
mov eax, dword [ebp - 0x14]
mov byte [eax], bl
cmp dword [ebp - 0x40], ebx
jne 0x403118
cmp dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], ebx
jne 0x402f49
cmp dword [ebp - 0xc], ebx
je 0x402c90
mov dword [ebp - 0x3c], str.5zffxtbr.jar
cmp dword [ebp - 0x3c], ebx
jne 0x402c9c
cmp dword [ebp - 0x20], ebx
je 0x402c9c
mov dword [ebp - 0x3c], str.5zffxtbr.jar
xor eax, eax
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
sete al
cmp dword [ebp - 8], ebx
mov dword [0x40ea7c], eax
jne 0x402d72
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.PART
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402cb8
cmp dword [ebp - 0x40], ebx
jne 0x402d72
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.5zbar.dll
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x170]
push 1
push eax
call fcn.004032fa
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xc]
pop ecx
mov byte [eax], bl
cmp dword [ebp - 0x40], ebx
pop ecx
je 0x402d72
mov dword [ebp - 0x44], 2
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.PART
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402d3c
cmp dword [ebp - 0x40], ebx
mov dword [0x40ea7c], ebx
jne 0x403118
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 8], ebx
jne 0x4030a2
cmp dword [ebp - 0x10], ebx
jne 0x4030a5
call fcn.004015bf
cmp dword [ebp - 0x1c], ebx
jne 0x402dd8
push ebx
push ebx
push str.ConfigDateStamp
push 0x40518c
call fcn.00404b43
push 3
push ebx
push ebx
push str.ConfigDateStamp
push 0x40518c
call fcn.00404b5e
add esp, 0x24
push dword [ebp + 8]
push str.CurInstall
push 0x40518c
call fcn.004048c1
add esp, 0xc
dec dword [ebp + 8]
cmp dword [ebp - 0x20], ebx
jne 0x402e07
call fcn.00401d13
lea eax, [ebp - 0x170]
push eax
call fcn.00401f4a
pop ecx
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.chrome_
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.CHROME
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402e40
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], ebx
mov byte [eax], bl
jne 0x402f88
lea eax, [ebp - 0x170]
push str.5zPlugin
push eax
call edi
lea eax, [ebp - 0x170]
push str..DLL
push eax
call edi
push 8
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x402f83
push str.UUEX
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x402f7a
mov edi, dword [ebp + 0x10]
push str._fsa
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
jne 0x402efa
push 0x40e208
push edi
call fcn.00404369
pop ecx
mov dword [ebp - 0xc], ebx
test eax, eax
pop ecx
je 0x402f01
mov dword [ebp - 0xc], 1
push str._ffhp
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
jne 0x402f55
push str._fhp
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
jne 0x402f55
push 0x40e1f4
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
je 0x402f45
push str._ffto
push edi
call fcn.00404369
pop ecx
test eax, eax
pop ecx
jne 0x402f55
xor edi, edi
jmp 0x402f58
mov dword [ebp - 0x3c], str.5zREGIET.DLL
jmp 0x402c8b
push 1
pop edi
push str._ftab
push dword [ebp + 0x10]
call fcn.00404369
pop ecx
pop ecx
push dword [ebp - 0xc]
neg eax
push dword [ebp - 0xc]
sbb eax, eax
neg eax
push edi
push eax
push ebx
push ebx
call dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x1c]
mov byte [eax], bl
push str.Message_
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov edi, 0x4033f6
lea eax, [ebp - 0x170]
push eax
push edi
push str.MESSAGE
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402faf
push str.gen1_
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push edi
push str.GEN1
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x403003
push str.assists_
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push edi
push str.IEENABLE
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x403057
call fcn.004013d1
call fcn.004010e6
lea eax, [ebp - 0x2a4]
push eax
call fcn.0040110b
pop ecx
jmp 0x4030a5
dec dword [ebp + 8]
cmp dword [ebp + 8], ebx
jle 0x403110
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp + 8]
push str._x.bin_
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
call edi
test eax, eax
je 0x403108
lea eax, [ebp - 0x170]
mov dword [ebp - 0x40], ebx
push eax
push 0x4033f6
push str.PART
mov dword [ebp - 0x44], 3
push dword [0x40ea78]
call esi
push 0x40e1b8
call edi
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
dec dword [ebp + 8]
cmp dword [ebp + 8], ebx
jg 0x4030b0
mov dword [ebp - 0x40], ebx
jmp 0x403254
mov eax, dword [ebp - 0x40]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.assists_
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push str.ie_default_search_provider_
push eax
call edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], 2
lea eax, [ebp - 0x170]
push eax
push 0x4033f6
push str.ASSIST
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x403168
mov eax, dword [ebp + 0x10]
push str.assists_
mov byte [eax], bl
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push str.ie_enable_
push eax
call edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], 2
mov edi, 0x4033f6
lea eax, [ebp - 0x170]
push eax
push edi
push str.ASSIST2
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x4031db
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], 2
lea eax, [ebp - 0x170]
push eax
push edi
push str.PREPART
push dword [0x40ea78]
call esi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40536c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x40321c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [0x40ea74], ebx
jne 0x4032aa
cmp dword [ebp - 0x10], ebx
mov ecx, 0x40e39c
jne 0x403271
mov ecx, 0x40ea80
cmp dword [ebp - 0x40], ebx
mov eax, str.The_CouponXplorer_has_been_successfully__sinstalled
je 0x403280
mov eax, str.Failed_to__sinstall_the_CouponXplorer
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x1000
push str.CouponXplorer_Installer
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x10], ebx
jne 0x4032b4
call fcn.004012be
push dword [ebp - 0x40]
mov esi, 0x40518c
push 0x40e174
push esi
call fcn.004048c1
movzx eax, word [ebp - 0x38]
push eax
push 0x40e170
push esi
call fcn.004048c1
add esp, 0x18
push dword [ebp - 0x40]
push str.result_x
push str.http:__imgfarm.com_images_nocache_tr_au1.gif
call fcn.004032f9
mov eax, dword [ebp - 0x40]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0x10