Function at 0x40260e
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Print debug messages
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b7d0e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2644
call fcn.00492280
mov eax, dword [0x4eb664]
xor eax, esp
mov dword [esp + 0x2640], eax
push ebx
push esi
push edi
mov eax, dword [0x4eb664]
xor eax, esp
push eax
lea eax, [esp + 0x2658]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov ecx, 0x4ee640
push ebx
call fcn.0040572c
push 7
pop ecx
xor eax, eax
push 0x60
mov word [esp + 0x110], ax
mov word [esp + 0x128], ax
mov word [esp + 0x140], ax
lea eax, [esp + 0x158]
push ebx
push eax
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x12c], ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x158], ebx
call fcn.004921d0
xor eax, eax
add esp, 0xc
mov word [esp + 0x154], ax
push 7
pop ecx
mov word [esp + 0x16c], ax
mov word [esp + 0x184], ax
mov word [esp + 0x19c], ax
mov dword [esp + 0x168], ecx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x180], ecx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x198], ecx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x1ac], ebx
lea edi, [esp + 0x1b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x1d4], ebx
mov word [esp + 0x1c4], ax
mov dword [esp + 0x2660], ebx
lea edi, [esp + 0x1dc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x48
stosd dword es:[edi], eax
lea eax, [esp + 0x27c]
push ebx
push eax
mov dword [esp + 0x280], ebx
call fcn.004921d0
add esp, 0xc
xor eax, eax
push 7
pop edi
mov dword [esp + 0x220], edi
mov dword [esp + 0x21c], ebx
mov word [esp + 0x20c], ax
lea eax, [esp + 0x1c]
mov byte [esp + 0x2660], 1
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x1c], edi
mov esi, eax
jne 0x402bed
mov edi, 0x4d3c88
push edi
call fcn.00405113
pop ecx
push eax
push edi
lea ecx, [esp + 0x15c]
call fcn.0040509a
mov edi, str.ERROR_LOG
push edi
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1c4], 1
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x108], ebx
call fcn.00405113
pop ecx
push eax
push edi
lea ecx, [esp + 0x144]
call fcn.0040509a
push edi
call fcn.00405113
pop ecx
push eax
push edi
lea ecx, [esp + 0x12c]
call fcn.0040509a
push edi
call fcn.00405113
pop ecx
push eax
push edi
lea ecx, [esp + 0x114]
call fcn.0040509a
push 0x4eb630
lea ecx, [esp + 0x1c]
call fcn.004044ee
xor edi, edi
inc edi
mov byte [esp + 0x2660], 2
cmp dword [esp + 0x1c], edi
jle 0x4028e7
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str._reportlog
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x40288d
push dword [esi + edi*4 + 4]
call fcn.0040481a
pop ecx
push eax
push dword [esi + edi*4 + 4]
lea ecx, [esp + 0x20]
call fcn.004047a1
jmp 0x4028dc
push str._server_address
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x4028b8
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
push eax
push dword [esi + edi*4 + 4]
lea ecx, [esp + 0x1a4]
call fcn.0040509a
jmp 0x4028dc
push str._dump_channel
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x4028dc
push 0xa
push eax
push dword [esi + edi*4 + 4]
call fcn.00498734
add esp, 0xc
mov dword [esp + 0x1c0], eax
add edi, 2
cmp edi, dword [esp + 0x1c]
jl 0x402865
xor ebx, ebx
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x1bc], eax
xor eax, eax
push 0x206
mov word [esp + 0x1a18], ax
lea eax, [esp + 0x1a1a]
push ebx
push eax
call fcn.004921d0
add esp, 0xc
lea eax, [esp + 0x1a14]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
lea eax, [esp + 0x1a18]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x1a14]
push eax
call edi
cmp eax, 0xffffffff
je 0x402b83
test al, 0x10
je 0x402b83
push str.KingsoftDump
lea eax, [esp + 0x1a18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [esp + 0x1a18]
push eax
call esi
lea eax, [esp + 0x1a14]
push eax
call edi
cmp eax, 0xffffffff
je 0x402b83
test al, 0x10
je 0x402b83
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [esp + 0x1c24], ax
lea eax, [esp + 0x1c26]
push eax
call fcn.004921d0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push eax
call fcn.004921d0
mov esi, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x474]
push ebx
push esi
push eax
call fcn.00495430
add esp, 0xc
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [esp + 0x1c8]
lea eax, [esp + 0x1a20]
push eax
lea eax, [esp + 0x1c2c]
push str._skdumprep___log___channel____d___0x_x____s.inf
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
xor ebx, ebx
push ebx
lea eax, [esp + 0x1c20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x402a4e
lea ecx, [esi - 0x10]
call fcn.00404f8d
jmp 0x402b91
lea eax, [esp + 0x1c1c]
push eax
call edi
cmp eax, 0xffffffff
je 0x402a41
test al, 0x10
jne 0x402a41
lea eax, [esp + 0x1c1c]
push eax
call fcn.00405113
pop ecx
push eax
lea eax, [esp + 0x1c20]
push eax
lea ecx, [esp + 0x15c]
call fcn.0040509a
lea eax, [esp + 0x1c1c]
push eax
call fcn.00405113
pop ecx
push eax
lea eax, [esp + 0x1c20]
push eax
lea ecx, [esp + 0x174]
call fcn.0040509a
mov dword [esp + method.WTL::CMessageLoop.virtual_0], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x240], ebx
mov dword [esp + 0x244], ebx
mov dword [esp + 0x248], ebx
mov dword [esp + 0x24c], ebx
mov dword [esp + 0x250], ebx
mov dword [esp + 0x254], ebx
lea eax, [esp + 0x23c]
mov edi, 0x4ee640
push eax
mov ecx, edi
mov byte [esp + 0x2664], 3
call fcn.0040567a
lea ecx, [esp + 0x92c]
call fcn.004079d7
lea eax, [esp + 0x104]
push eax
push ecx
lea ecx, [esp + 0x934]
mov byte [esp + 0x2668], 4
call fcn.00404450
lea ecx, [esp + 0x23c]
call fcn.0040555c
mov ecx, edi
call fcn.0040540c
push dword [esp + 0x930]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, edi
call fcn.004052f2
lea ecx, [esp + 0x92c]
mov byte [esp + 0x2660], 3
call fcn.00407af0
lea ecx, [esp + 0x24c]
call fcn.00404a31
lea ecx, [esp + 0x240]
call fcn.00404a14
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov esi, ebx
jmp 0x402f7f
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
xor ebx, ebx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x214]
call fcn.00405ac5
push ebx
push esi
lea ecx, [esp + 0x1cc]
call fcn.00405ac5
lea ecx, [esp + 0x154]
call fcn.0040425d
push ebx
push esi
lea ecx, [esp + 0x144]
call fcn.00405ac5
push ebx
push esi
lea ecx, [esp + 0x12c]
call fcn.00405ac5
push ebx
push esi
lea ecx, [esp + 0x114]
call fcn.00405ac5
xor eax, eax
jmp 0x404239
cmp dword [esp + 0x1c], 0x15
jl 0x4041e1
xor edi, edi
inc edi
cmp dword [esp + 0x1c], edi
jle 0x402e3f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str._exception_code
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402c2f
push dword [esi + edi*4 + 4]
call fcn.00492c7d
pop ecx
mov dword [esp + 0x104], eax
jmp 0x402e30
push str._exception_address
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402c53
push dword [esi + edi*4 + 4]
call fcn.00492c7d
pop ecx
mov dword [esp + 0x108], eax
jmp 0x402e30
push str._program_path
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402c77
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x10c]
jmp 0x402dfc
push str._exception_file_path
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402c9b
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x124]
jmp 0x402dfc
push str._dump_file
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402cbf
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x154]
jmp 0x402dfc
push str._txt_file
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402ce3
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x16c]
jmp 0x402dfc
push str._log_file
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402d07
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x184]
jmp 0x402dfc
push str._server_address
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402d2b
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x19c]
jmp 0x402dfc
push str._show_gui
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402d4f
push dword [esi + edi*4 + 4]
call fcn.00492c7d
pop ecx
mov dword [esp + 0x1b4], eax
jmp 0x402e30
push str._up_dump
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402d73
push dword [esi + edi*4 + 4]
call fcn.00492c7d
pop ecx
mov dword [esp + 0x1b8], eax
jmp 0x402e30
push str._dump_channel
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402d99
push 0xa
push eax
push dword [esi + edi*4 + 4]
call fcn.00498734
mov dword [esp + 0x1cc], eax
jmp 0x402e2d
push str._liebao_QQ
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402dba
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x1c4]
jmp 0x402dfc
push str._try_except_count
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402ddd
push 0xa
push eax
push dword [esi + edi*4 + 4]
call fcn.00498734
mov dword [esp + 0x1e8], eax
jmp 0x402e2d
push str._browser_version
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402e08
push dword [esi + edi*4 + 4]
call fcn.00405113
pop ecx
lea ecx, [esp + 0x20c]
push eax
push dword [esi + edi*4 + 4]
call fcn.0040509a
jmp 0x402e30
push str._except_why
push dword [esi + edi*4]
call ebx
test eax, eax
jne 0x402f7a
push 0xa
push eax
push dword [esi + edi*4 + 4]
call fcn.00498734
mov dword [esp + 0x1ec], eax
add esp, 0xc
add edi, 2
cmp edi, dword [esp + 0x1c]
jl 0x402c0b
xor ebx, ebx
push ecx
call fcn.0040a551
cmp dword [esp + 0x120], 8
mov dword [esp + 0x1e8], eax
lea eax, [esp + 0x10c]
cmovae eax, dword [esp + 0x10c]
push eax
call fcn.0040a6fa
push 8
pop edi
cmp dword [esp + 0x180], edi
mov dword [esp + 0x1e4], eax
lea eax, [esp + 0x16c]
cmovae eax, dword [esp + 0x16c]
push eax
call fcn.0040a3ee
mov dword [esp + 0x1ec], eax
mov eax, dword [esp + 0x1b4]
push 0x4eb630
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c0], eax
call fcn.004044ee
mov byte [esp + 0x2660], 5
cmp dword [esp + 0x180], edi
lea esi, [esp + 0x16c]
cmovae esi, dword [esp + 0x16c]
test esi, esi
je 0x402f1c
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.004047a1
lea ecx, [esp + 0x18]
call fcn.0040bcd4
lea ecx, [esp + 0x18]
call fcn.0040bdc4
lea ecx, [esp + 0x18]
call fcn.0040be7f
lea ecx, [esp + 0x18]
call fcn.0040bfec
lea ecx, [esp + 0x18]
call fcn.0040c062
lea ecx, [esp + 0x18]
call fcn.0040c18c
push 0x88
lea eax, [esp + 0x64]
push ebx
push eax
mov dword [esp + 0x68], ebx
call fcn.004921d0
add esp, 0xc
lea ecx, [esp + 0x5c]
call fcn.00401ca4
cmp dword [esp + 0x70], 1
jne 0x40315b
push ebx
push ebx
mov dword [esp + 0x60], ebx
call fcn.004048ff
mov dword [esp + 0x54], eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x2660], 6
call fcn.0040202a
mov ebx, dword [esp + 0x54]
test eax, eax
je 0x40312d
mov edi, dword [ebx]
jmp 0x403125
or esi, 0xffffffff
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x214]
call fcn.00405ac5
push ebx
push edi
lea ecx, [esp + 0x1cc]
call fcn.00405ac5
lea ecx, [esp + 0x154]
call fcn.0040425d
push ebx
push edi
lea ecx, [esp + 0x144]
call fcn.00405ac5
push ebx
push edi
lea ecx, [esp + 0x12c]
call fcn.00405ac5
push ebx
push edi
lea ecx, [esp + 0x114]
call fcn.00405ac5
mov eax, esi
jmp 0x404239
push 7
pop ecx
xor edx, edx
xor eax, eax
mov dword [esp + 0x19c8], ecx
mov dword [esp + 0x19c4], edx
mov word [esp + 0x19b4], ax
mov dword [esp + 0x19e0], ecx
mov dword [esp + 0x19dc], edx
mov word [esp + 0x19cc], ax
mov dword [esp + 0x19f8], ecx
mov dword [esp + 0x19f4], edx
mov word [esp + 0x19e4], ax
lea esi, [edi + 8]
lea eax, [esp + 0x19b4]
mov byte [esp + 0x2660], cl
cmp eax, esi
je 0x403046
push 0xffffffffffffffff
push edx
push esi
mov ecx, eax
call fcn.00405a06
xor edx, edx
lea eax, [esi + 0x18]
lea ecx, [esp + 0x19cc]
cmp ecx, eax
je 0x40305d
push 0xffffffffffffffff
push edx
push eax
call fcn.00405a06
add esi, 0x30
lea eax, [esp + 0x19e4]
cmp eax, esi
je 0x403077
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00405a06
push 0x4eb630
lea ecx, [esp + 0x2c]
call fcn.004044ee
mov byte [esp + 0x2660], 8
cmp dword [esp + 0x19e0], 8
lea ecx, [esp + 0x19cc]
cmovae ecx, dword [esp + 0x19cc]
cmp dword [esp + 0x19f8], 8
push ecx
lea eax, [esp + 0x19e8]
cmovae eax, dword [esp + 0x19e8]
push eax
lea eax, [esp + 0x30]
push 0x4d3a2c
push eax
call fcn.00404994
mov esi, dword [esp + 0x38]
add esp, 0x10
cmp dword [esp + 0x180], 8
lea ecx, [esp + 0x16c]
cmovae ecx, dword [esp + 0x16c]
cmp dword [esp + 0x19c8], 8
push ecx
lea eax, [esp + 0x19b8]
cmovae eax, dword [esp + 0x19b8]
push esi
push eax
push str.ModuleVersion
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esi - 0x10]
call fcn.00404f8d
lea ecx, [esp + 0x19b4]
call fcn.004025ca
mov edi, dword [edi]
cmp edi, ebx
jne 0x402fdb
mov edi, dword [ebx]
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
cmp edi, ebx
je 0x40314f
mov esi, dword [edi]
lea ecx, [edi + 8]
call fcn.004025ca
push edi
call fcn.00449b2b
pop ecx
mov edi, esi
cmp esi, ebx
jne 0x403138
push ebx
call fcn.00449b2b
pop ecx
push 8
xor ebx, ebx
pop edi
cmp dword [esp + 0x180], edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [esp + 0x16c]
cmovae eax, dword [esp + 0x16c]
push eax
push ebx
push str.Value
push str.AutoRecovery
call esi
cmp dword [esp + 0x180], edi
lea ecx, [esp + 0x16c]
cmovae ecx, dword [esp + 0x16c]
push ecx
push ebx
push str.productid
push str.ProductInfo
mov dword [esp + 0x40], eax
call esi
push 7
pop edx
xor ecx, ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x208], edx
mov dword [esp + 0x204], ebx
mov word [esp + 0x1f4], cx
mov dword [esp + 0x238], edx
mov dword [esp + 0x234], ebx
mov word [esp + 0x224], cx
mov byte [esp + 0x2660], 0xa
sub eax, 0x11000
je 0x403256
sub eax, 0x1000
je 0x403256
dec eax
je 0x403248
sub eax, 0x3dfff
je 0x40321b
sub eax, 0x40000
je 0x40323a
sub eax, 0x10000
je 0x40322c
sub eax, 0x70000
jne 0x4032ac
lea ecx, [esp + 0x1f4]
call fcn.0040c97d
jmp 0x4032ac
lea ecx, [esp + 0x1f4]
call fcn.0040cc7a
jmp 0x4032ac
lea ecx, [esp + 0x1f4]
call fcn.0040cd4e
jmp 0x4032ac
lea ecx, [esp + 0x1f4]
call fcn.0040c83e
jmp 0x403262
lea ecx, [esp + 0x1f4]
call fcn.0040c732
lea ecx, [esp + 0x224]
call fcn.0040c501
cmp dword [esp + 0x180], edi
lea ecx, [esp + 0x16c]
cmovae ecx, dword [esp + 0x16c]
cmp dword [esp + 0x238], edi
push ecx
lea eax, [esp + 0x228]
cmovae eax, dword [esp + 0x228]
push eax
push str.TryNo
push str.ProductInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [esp + 0x180], edi
lea ecx, [esp + 0x16c]
cmovae ecx, dword [esp + 0x16c]
cmp dword [esp + 0x208], edi
push ecx
lea eax, [esp + 0x1f8]
cmovae eax, dword [esp + 0x1f8]
push eax
push str.Channel
push str.ProductInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x32
lea eax, [esp + 0x290]
push ebx
push eax
call fcn.004921d0
add esp, 0xc
cmp dword [esp + 0x204], 0
jne 0x403320
push 0x4d3ab0
lea eax, [esp + 0x290]
push 0x32
push eax
call fcn.00401bfc
add esp, 0xc
jmp 0x40339d
cmp dword [esp + 0x208], edi
lea eax, [esp + 0x1f4]
cmovae eax, dword [esp + 0x1f4]
lea ecx, [esp + 0x2c8]
push ebx
mov dword [esp + 0x2c8], ecx
push eax
lea ecx, [esp + 0x2cc]
call fcn.004045ee
sub esp, 0x84
lea eax, [esp + 0x310]
push 0x21
pop ecx
mov edi, esp
push 0x4d3ab4
push 0x32
lea esi, [esp + 0x350]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401bfc
lea eax, [esp + 0x358]
add esp, 0x90
cmp dword [esp + 0x2c4], eax
je 0x40339d
push dword [esp + 0x2c4]
call fcn.0048f255
pop ecx
lea ecx, [esp + 0x39c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x28], ebx
call fcn.004019f8
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x3ac]
mov byte [esp + 0x266c], 0xb
call fcn.00405a06
lea eax, [esp + 0x20c]
push eax
lea ecx, [esp + 0x738]
call fcn.0040cfb7
mov byte [esp + 0x2660], 0xc
cmp dword [esp + 0x3b0], 0
je 0x403413
push ecx
lea eax, [esp + 0x3a0]
push eax
lea ecx, [esp + 0x73c]
call fcn.0040d0c9
mov dword [esp + 0x50], ebx
mov byte [esp + 0x2660], 0xd
mov eax, dword [esp + 0x1b4]
test eax, eax
je 0x403884
cmp dword [esp + 0x450], 0
je 0x403490
push 0x17
pop ecx
lea eax, [esp + 0x19b4]
push eax
push 1
mov esi, str.D3E362A9_7181_4e9f_B979_43AFBDDAC023_kxecolct
lea edi, [esp + 0x19bc]
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [esp + 0x50], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40347b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x1b4]
xor ecx, ecx
test ebx, ebx
cmove eax, ecx
mov dword [esp + 0x1b4], eax
test eax, eax
je 0x403884
xor eax, eax
mov word [esp + 0xec], ax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], eax
lea edi, [esp + 0xee]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x40]
call fcn.0040e119
movzx esi, word [esp + 0xec]
mov cx, word [esp + 0xf2]
mov dx, word [esp + 0xee]
cmp esi, dword [esp + 0x44]
jne 0x403505
movzx eax, dx
cmp eax, dword [esp + 0x48]
jne 0x403505
movzx eax, cx
cmp eax, dword [esp + 0x4c]
je 0x40350f
xor eax, eax
mov byte [esp + 0x17], 0
inc eax
jmp 0x40351c
mov eax, dword [esp + 0x40]
cmp eax, 1
setge byte [esp + 0x17]
inc eax
push eax
movzx eax, cx
push eax
movzx eax, dx
push eax
push esi
call fcn.0040df83
mov cl, byte [esp + 0x17]
movzx eax, cl
mov dword [esp + 0x1b4], eax
test cl, cl
jne 0x403579
cmp dword [esp + 0x120], 8
push 5
push 0
push str.__restore_last_session
lea eax, [esp + 0x118]
cmovae eax, dword [esp + 0x118]
push eax
push 0x4d3ae8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x1b4], 0
je 0x403884
cmp dword [esp + 0x450], 0
je 0x403884
xor eax, eax
push eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0xf8], 1
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
call fcn.0042a4e3
mov edi, eax
xor eax, eax
mov dword [esp + 0x19b4], 0x4be074
mov dword [esp + 0x19b8], eax
mov dword [esp + 0x19bc], eax
mov dword [esp + 0x19c0], eax
mov dword [esp + 0x19c4], eax
mov dword [esp + 0x19c8], eax
mov dword [esp + 0x19cc], eax
lea eax, [esp + 0x19b4]
push eax
mov ecx, 0x4ee640
mov byte [esp + 0x2664], 0xe
call fcn.0040567a
push 0x48
call fcn.00449b05
pop ecx
test eax, eax
je 0x40362c
mov ecx, eax
call fcn.00427cd3
mov esi, eax
jmp 0x40362e
xor esi, esi
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0x2a8
mov dword [esp + 0x30], 0x1db
call fcn.00427d33
push 0
mov ecx, esi
call fcn.00427e44
mov eax, dword [esi]
push 0x4d3af4
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x68
call fcn.00449b05
pop ecx
mov dword [esp + 0x28], eax
mov byte [esp + 0x2660], 0xf
test eax, eax
je 0x40368d
lea ecx, [esp + 0x104]
push ecx
push esi
mov ecx, eax
call fcn.0040e1d6
jmp 0x40368f
xor eax, eax
push 1
push eax
mov ecx, esi
mov byte [esp + 0x2668], 0xe
call fcn.00428068
mov eax, dword [esi]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004280dd
lea ecx, [esp + 0x19b4]
call fcn.0040555c
mov ecx, 0x4ee640
call fcn.0040540c
mov ecx, edi
call fcn.0042a5d5
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
lea ecx, [esp + 0x1e24]
call fcn.0040ee18
lea eax, [esp + 0x39c]
push eax
lea ecx, [esp + 0x2c8]
mov byte [esp + 0x2664], 0x10
call fcn.00404302
lea eax, [esp + 0x2c4]
push eax
lea ecx, [esp + 0x2074]
mov byte [esp + 0x2664], 0x11
call fcn.00411d2f
lea ecx, [esp + 0x2c4]
mov byte [esp + 0x2660], 0x10
call fcn.00401a93
xor eax, eax
push eax
push eax
lea ecx, [esp + 0x1e40]
mov dword [esp + 0x44], eax
call fcn.00405036
test eax, eax
jne 0x403756
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40378d
lea eax, [esp + 0x1e24]
push eax
lea eax, [esp + 0x1e30]
push eax
push 0x4efca0
call fcn.00404fa9
lea eax, [esp + 0x104]
push eax
push 0x404933
push 0
push 9
push dword [0x4efc44]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [esp + 0x2408], 0
mov eax, dword [esp + 0x2068]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x206c]
mov dword [esp + 0x28], eax
je 0x40384b
push 0x17
pop ecx
lea eax, [esp + 0x2c4]
push eax
push 1
mov esi, str.9986BA31_649C_448f_AE49_D946A7A70B7D_kxecolct
lea edi, [esp + 0x2cc]
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4037f4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [esp + 0x24], esi
mov byte [esp + 0x2660], 0x12
test esi, esi
je 0x403844
cmp esi, 0xffffffff
je 0x403844
lea eax, [esp + 0x438]
push eax
lea ecx, [esp + 0x244]
mov dword [esp + method.CrashRepair.virtual_0], vtable.CrashRepair.0
call fcn.004043d6
lea ecx, [esp + 0x23c]
mov byte [esp + 0x2660], 0x13
call fcn.00413871
lea ecx, [esp + 0x23c]
call fcn.0041385e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1e24]
mov byte [esp + 0x2660], 0xe
call fcn.0040efac
lea ecx, [esp + 0x19c4]
mov byte [esp + 0x2660], 0xd
call fcn.00404a31
lea ecx, [esp + 0x19b8]
call fcn.00404a14
jmp 0x403cc6
xor eax, eax
inc eax
mov esi, str._BSOD_
push esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
call fcn.00405113
pop ecx
push eax
push 0
push esi
lea ecx, [esp + 0x160]
call fcn.00404521
cmp eax, 0xffffffff
jne 0x403bed
lea ecx, [esp + 0x1e24]
call fcn.0040ee18
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
push 0x1ac
push eax
mov dword [esp + 0x1a1c], eax
lea eax, [esp + 0x1a20]
push eax
call fcn.004921d0
and dword [esp + 0x108], 0
xor eax, eax
add esp, 0xc
mov dword [esp + 0x100], 7
mov word [esp + 0xec], ax
push 0x206
mov byte [esp + 0x2664], 0x16
push eax
mov word [esp + 0x1c24], ax
lea eax, [esp + 0x1c26]
push eax
call fcn.004921d0
add esp, 0xc
cmp dword [esp + 0x168], 8
push dword [esp + 0x164]
lea eax, [esp + 0x158]
cmovae eax, dword [esp + 0x158]
push eax
mov edx, 0x104
lea ecx, [esp + 0x1c24]
call fcn.00401b8e
test eax, eax
js 0x403eb1
lea eax, [esp + 0x1c1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [esp + 0x1c1c]
push eax
call fcn.00405113
pop ecx
push eax
lea eax, [esp + 0x1c20]
push eax
lea ecx, [esp + 0xf4]
call fcn.0040509a
push 0x4d3b10
lea ecx, [esp + 0x240]
call fcn.0040513a
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x240]
push eax
lea eax, [esp + 0xf4]
push eax
mov byte [esp + 0x266c], 0x17
call fcn.004104f7
push 0
cmp eax, 9
push 1
lea ecx, [esp + 0x244]
sete byte [esp + 0x1f]
mov byte [esp + 0x2668], 0x16
call fcn.00405ac5
cmp byte [esp + 0x17], 0
je 0x403eb1
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x14], 8
jb 0x403a03
mov eax, dword [esi]
jmp 0x403a05
mov eax, esi
push dword [esi + 0x10]
lea ecx, [esp + 0x1b28]
push eax
push 0x28
pop edx
call fcn.00401b8e
lea eax, [esi + 0x18]
cmp dword [eax + 0x14], 8
jb 0x403a23
mov eax, dword [eax]
push dword [esi + 0x28]
lea ecx, [esp + 0x1b78]
push eax
push 0x28
pop edx
call fcn.00401b8e
lea edi, [esi + 0x30]
cmp dword [edi + 0x14], 8
jb 0x403a43
mov eax, dword [edi]
jmp 0x403a45
mov eax, edi
push dword [esi + 0x40]
lea ecx, [esp + 0x1a88]
push eax
push 0x28
pop edx
call fcn.00401b8e
lea eax, [esi + 0x48]
cmp dword [eax + 0x14], 8
jb 0x403a63
mov eax, dword [eax]
push dword [esi + 0x58]
lea ecx, [esp + 0x1ad8]
push eax
push 0x28
pop edx
call fcn.00401b8e
lea eax, [esi + 0x90]
cmp dword [eax + 0x14], 8
jb 0x403a84
mov eax, dword [eax]
push eax
call fcn.00492c7d
mov dword [esp + 0x1a18], eax
lea eax, [esi + 0xc0]
pop ecx
cmp dword [eax + 0x14], 8
jb 0x403aa0
mov eax, dword [eax]
push dword [esi + 0xd0]
lea ecx, [esp + 0x1a38]
push eax
push 0x28
pop edx
call fcn.00401b8e
cmp dword [esp + 0x180], 8
lea eax, [esp + 0x16c]
cmovae eax, dword [esp + 0x16c]
push eax
push 0xc
lea eax, [esp + 0x1a24]
push eax
push 0
push str.Value
push str.DumpKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esi + 0x14], 8
jb 0x403af2
mov esi, dword [esi]
mov ecx, esi
call fcn.00401e7a
test eax, eax
je 0x403eb1
cmp dword [edi + 0x14], 8
jb 0x403b09
mov edi, dword [edi]
mov ecx, edi
call fcn.00401fd0
test eax, eax
jne 0x403eb1
and dword [esp + 0x474], eax
push 0x2b8
push eax
lea eax, [esp + 0x480]
push eax
call fcn.004921d0
add esp, 0xc
lea eax, [esp + 0x104]
push eax
sub esp, 0xc
lea eax, [esp + 0x1a44]
push eax
lea eax, [esp + 0x1b88]
push eax
lea eax, [esp + 0x1b3c]
push eax
lea eax, [esp + 0x1af0]
push eax
lea eax, [esp + 0x1aa4]
push eax
lea eax, [esp + 0x1a40]
push eax
push ecx
push dword [esp + 0x1a40]
lea ecx, [esp + 0x4a4]
call fcn.00419e1c
add esp, 0x30
test eax, eax
je 0x403bb4
cmp dword [esp + 0x478], 1
jne 0x403bb4
cmp dword [esp + 0x474], 0
je 0x403ba3
xor esi, esi
jmp 0x403bb8
xor eax, eax
cmp dword [esp + 0x494], 0x10
sete al
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x24]
push 0
push 1
lea ecx, [esp + 0xf4]
call fcn.00405ac5
lea ecx, [esp + 0x40]
call fcn.004046b7
lea ecx, [esp + 0x1e24]
mov byte [esp + 0x2660], 0xd
call fcn.0040efac
test esi, esi
je 0x403cc6
push str.ForceUpload_background
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x19b4]
call fcn.004042d1
lea eax, [esp + 0x19b4]
mov edi, 0x4ee640
push eax
mov ecx, edi
mov byte [esp + 0x2664], 0x18
call fcn.0040567a
xor esi, esi
inc esi
lea ecx, [esp + 0x92c]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x1b8], esi
call fcn.004079d7
lea eax, [esp + 0x104]
push eax
push ecx
lea ecx, [esp + 0x934]
mov byte [esp + 0x2668], 0x19
call fcn.00404450
lea ecx, [esp + 0x19b4]
call fcn.0040555c
mov ecx, edi
call fcn.0040540c
mov eax, dword [esp + 0x19b0]
push dword [esp + 0x930]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x964]
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0x30]
cmp eax, esi
je 0x403c9a
cmp eax, 2
jne 0x403c9e
mov dword [esp + 0x34], esi
lea ecx, [esp + 0x92c]
mov byte [esp + 0x2660], 0x18
call fcn.00407af0
lea ecx, [esp + 0x19b4]
mov byte [esp + 0x2660], 0xd
call fcn.004042ee
push 0x4eb630
lea ecx, [esp + 0x24]
call fcn.004045bb
push dword [esp + 0x30]
mov edi, dword [esp + 0x38]
push edi
lea eax, [esp + 0x28]
push str.bAutoRecoveryApp__d___uAutoRecoveryValue__d
push eax
mov byte [esp + 0x2670], 0x1a
call fcn.00404980
mov esi, dword [esp + 0x30]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp edi, 1
je 0x403d12
cmp dword [esp + 0x30], 1
jne 0x403e60
xor eax, eax
push 0x208
push eax
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push eax
call fcn.004921d0
add esp, 0xc
xor eax, eax
push 0x820
push eax
mov word [esp + 0x1e2c], ax
lea eax, [esp + 0x1e2e]
push eax
call fcn.004921d0
add esp, 0xc
lea eax, [esp + 0x474]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403d7c
lea edx, [esp + 0x474]
mov ecx, str.kdumpfix.exe
call fcn.0040188d
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403e60
test al, 0x10
jne 0x403e60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.00401984
cmp dword [esp + 0x180], 8
push eax
lea ecx, [esp + 0x170]
cmovae ecx, dword [esp + 0x170]
push ecx
lea eax, [esp + 0x47c]
push eax
push str._s__restartapp__s__waitpid__d
lea eax, [esp + 0x1e34]
push 0x410
push eax
call fcn.00401c4f
add esp, 0x18
test eax, eax
js 0x403e60
push 0x40
lea eax, [esp + 0x19bc]
push 0
push eax
call fcn.004921d0
xor ecx, ecx
xor eax, eax
mov dword [esp + 0xf8], ecx
add esp, 0xc
lea edi, [esp + 0xf0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0x19b8]
push eax
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
lea eax, [esp + 0x1e44]
push eax
push ecx
mov dword [esp + 0x19dc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xf0]
call edi
push dword [esp + 0xec]
call edi
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x54]
mov ecx, 0x50000
cmp eax, ecx
ja 0x403ef1
je 0x403f27
cmp eax, 0xb000
je 0x403ee4
cmp eax, 0xc000
je 0x403ed7
cmp eax, 0x11000
je 0x403eca
cmp eax, 0x11fff
jbe 0x403f0d
cmp eax, 0x12001
jbe 0x403eca
cmp eax, 0x40000
jne 0x403f0d
mov dword [esp + 0x274], 7
jmp 0x403f4c
lea edx, [esp + 0x20]
lea ecx, [esp + 0x104]
call fcn.00411034
mov esi, dword [esp + 0x20]
jmp 0x403bb8
mov dword [esp + 0x274], 1
jmp 0x403f4c
mov dword [esp + 0x274], 5
jmp 0x403f4c
mov dword [esp + 0x274], 3
jmp 0x403f4c
cmp eax, 0x90000
je 0x403f41
cmp eax, 0xa0000
je 0x403f34
cmp eax, 0x110000
je 0x403f27
cmp eax, 0x111000
je 0x403f1a
mov dword [esp + 0x274], 0x64
jmp 0x403f4c
mov dword [esp + 0x274], 8
jmp 0x403f4c
mov dword [esp + 0x274], 2
jmp 0x403f4c
mov dword [esp + 0x274], 6
jmp 0x403f4c
mov dword [esp + 0x274], 4
xor eax, eax
test edi, edi
sete al
mov edi, dword [esp + 0x38]
inc eax
mov dword [esp + 0x284], eax
xor eax, eax
cmp dword [esp + 0x3c], eax
sete al
inc eax
mov dword [esp + 0x27c], eax
xor eax, eax
test edi, edi
sete al
inc eax
cmp dword [esp + 0x164], 0
mov dword [esp + 0x280], eax
je 0x403fbc
cmp dword [esp + 0x168], 8
lea eax, [esp + 0x154]
cmovae eax, dword [esp + 0x154]
push str.BSOD
push eax
call fcn.00492e1b
pop ecx
pop ecx
mov dword [esp + 0x278], 2
test eax, eax
jne 0x403fc7
mov dword [esp + 0x278], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x288], eax
cmp edi, 1
jne 0x404123
cmp dword [esp + 0x78], edi
jne 0x404123
xor eax, eax
push eax
push eax
lea ecx, [esp + 0xf4]
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
call fcn.00405ac5
mov byte [esp + 0x2660], 0x1b
cmp dword [esp + 0x168], 8
lea eax, [esp + 0x154]
cmovae eax, dword [esp + 0x154]
push eax
lea ecx, [esp + 0xf0]
call fcn.004043fe
push str..zip
lea ecx, [esp + 0xf0]
call fcn.0040441d
cmp dword [esp + 0x168], 8
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x154]
cmovae eax, dword [esp + 0x154]
push eax
call edi
cmp dword [esp + 0x100], 8
lea eax, [esp + 0xec]
cmovae eax, dword [esp + 0xec]
push eax
call edi
cmp dword [esp + 0x180], 8
lea eax, [esp + 0x16c]
cmovae eax, dword [esp + 0x16c]
push eax
lea ecx, [esp + 0xf0]
call fcn.004043fe
push str..zip
lea ecx, [esp + 0xf0]
call fcn.0040441d
cmp dword [esp + 0x34], 1
je 0x4040f1
cmp dword [esp + 0x30], 1
je 0x4040f1
cmp dword [esp + 0x180], 8
lea eax, [esp + 0x16c]
cmovae eax, dword [esp + 0x16c]
push eax
call edi
cmp dword [esp + 0x198], 8
lea eax, [esp + 0x184]
cmovae eax, dword [esp + 0x184]
push eax
call edi
cmp dword [esp + 0x100], 8
lea eax, [esp + 0xec]
cmovae eax, dword [esp + 0xec]
push eax
call edi
push 0
push 1
lea ecx, [esp + 0xf4]
mov byte [esp + 0x2668], 0x1a
call fcn.00405ac5
mov ecx, 0x4ee640
call fcn.004052f2
lea ecx, [esi - 0x10]
call fcn.00404f8d
test ebx, ebx
je 0x404145
cmp ebx, 0xffffffff
je 0x404145
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x734]
mov byte [esp + 0x2660], 0xb
call fcn.0040d056
lea ecx, [esp + 0x39c]
call fcn.00401a93
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x22c]
call fcn.00405ac5
push ebx
push 1
lea ecx, [esp + 0x1fc]
call fcn.00405ac5
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push ebx
push 1
lea ecx, [esp + 0x214]
call fcn.00405ac5
push ebx
push 1
lea ecx, [esp + 0x1cc]
call fcn.00405ac5
lea ecx, [esp + 0x154]
call fcn.0040425d
push ebx
push 1
lea ecx, [esp + 0x144]
call fcn.00405ac5
push ebx
push 1
lea ecx, [esp + 0x12c]
call fcn.00405ac5
push ebx
push 1
jmp 0x402bda
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x214]
call fcn.00405ac5
push ebx
push esi
lea ecx, [esp + 0x1cc]
call fcn.00405ac5
lea ecx, [esp + 0x154]
call fcn.0040425d
push ebx
push esi
lea ecx, [esp + 0x144]
call fcn.00405ac5
push ebx
push esi
lea ecx, [esp + 0x12c]
call fcn.00405ac5
push ebx
push esi
lea ecx, [esp + 0x114]
call fcn.00405ac5
or eax, 0xffffffff
mov ecx, dword [esp + 0x2658]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2640]
xor ecx, esp
call fcn.0048f059
mov esp, ebp
pop ebp
ret