Function at 0x40c4d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1f7c
call fcn.0049df10
mov eax, dword [0x4f3480]
xor eax, esp
mov dword [esp + 0x1f78], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0xc], 0
call fcn.00408860
push dword [esp + 0x358]
lea ecx, [esp + 0x404]
mov dword [0x4f6a8c], esi
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x408]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x62c]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x630]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x3ec]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x3f0]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x3d4]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x3d8]
call fcn.0041d980
push 0x104
lea eax, [esp + 0x1e7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x4f0]
call fcn.004039f0
lea ecx, [esp + 0x658]
call fcn.00403c10
lea edx, [esp + 0x4f0]
lea ecx, [esp + 0x568]
call fcn.00404430
lea edx, [esp + 0x1640]
mov ecx, 0x104
call fcn.00409ce0
test eax, eax
je 0x410f21
lea ecx, [esp + 0x568]
call fcn.00417f60
push eax
lea eax, [esp + 0x1644]
push 0x104
push eax
call fcn.004ad38e
add esp, 0xc
lea edx, [esp + 0x1640]
mov ecx, 0x6b
push 0
push 0
call fcn.00408370
add esp, 8
test eax, eax
je 0x410f21
lea eax, [esp + 0x568]
push eax
lea ecx, [esp + 0x554]
call fcn.004182e0
lea ecx, [esp + 0x8c8]
call fcn.00414880
push 1
push 0x40
push 1
lea eax, [esp + 0x164c]
push eax
lea ecx, [esp + 0x128]
call fcn.00413e20
push 0x34
call fcn.0049d2fc
add esp, 4
mov ecx, eax
push 0
call fcn.00414740
mov ecx, dword [esp + 0x118]
mov esi, eax
mov ecx, dword [ecx + 4]
push dword [esp + ecx + 0x148]
lea ecx, [esp + 0x4c]
call fcn.00401bd0
push esi
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x368]
call fcn.0041c740
mov ecx, dword [esp + 0x118]
lea esi, [esp + 0x118]
mov edi, eax
lea eax, [esp + 0x50]
push edi
push eax
add esi, dword [ecx + 4]
mov ecx, esi
call fcn.00402e50
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x40c6f0
push edi
lea eax, [esp + 0x5c]
push eax
call fcn.004195d0
lea ecx, [esp + 0x58]
call fcn.00401bf0
lea ecx, [esp + 0x50]
call fcn.00401bf0
lea ecx, [esp + 0x360]
call fcn.00401bf0
lea ecx, [esp + 0x48]
call fcn.00401bf0
cmp dword [esp + 0x174], 0
je 0x41113a
push 1
lea ecx, [esp + 0x2ac]
call fcn.004129c0
lea ecx, [esp + 0x118]
call fcn.00413d20
push eax
lea ecx, [esp + 0x2bc]
call fcn.00412bb0
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00412810
lea ecx, [esp + 0x118]
call fcn.00413cd0
lea eax, [esp + 0x370]
push eax
lea eax, [esp + 0x3a4]
push eax
lea ecx, [esp + 0x8d0]
call fcn.00414760
push eax
lea ecx, [esp + 0x554]
call fcn.004181a0
lea ecx, [esp + 0x3a0]
call fcn.00418150
lea ecx, [esp + 0x370]
call fcn.00417b60
lea ecx, [esp + 0x2a8]
call fcn.00411250
push 0x10
push 0
lea eax, [esp + 0x6dc]
push eax
lea ecx, [esp + 0x55c]
call fcn.00417d50
push 0x10
push 0x10
lea eax, [esp + 0x6c4]
push eax
lea ecx, [esp + 0x55c]
call fcn.00417d50
push str..dat
lea edx, [esp + 0x6d8]
lea ecx, [esp + 0x6a8]
call fcn.0041bbe0
add esp, 4
lea edx, [esp + 0xb08]
mov ecx, 0x104
call fcn.00409ce0
test eax, eax
jne 0x40c927
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7e3c
call fcn.0042aa20
add esp, 8
lea ecx, [esp + 0x670]
push str.Unable_to_get_temp_path:_Error_1
call fcn.00415f10
push 0x4e7a88
lea ecx, [esp + 0x364]
call fcn.00415fe0
lea ecx, [esp + 0x670]
call fcn.00415ee0
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
push eax
lea ecx, [esp + 0x678]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x6a4]
call fcn.00418150
lea ecx, [esp + 0x6bc]
call fcn.00418150
lea ecx, [esp + 0x6d4]
call fcn.00418150
lea ecx, [esp + 0x118]
call fcn.004111c0
lea ecx, [esp + 0x8c8]
call fcn.004147c0
lea ecx, [esp + 0x550]
call fcn.00418150
lea ecx, [esp + 0x568]
call fcn.00418150
lea ecx, [esp + 0x658]
call fcn.00418150
lea ecx, [esp + 0x4f0]
call fcn.00418150
lea ecx, [esp + 0x3d0]
call fcn.00418150
lea ecx, [esp + 0x3e8]
call fcn.00418150
lea ecx, [esp + 0x628]
call fcn.00418150
lea ecx, [esp + 0x400]
call fcn.00418150
jmp 0x410f75
lea ecx, [esp + 0x6a4]
call fcn.00417f60
push eax
lea eax, [esp + 0xb0c]
push 0x104
push eax
call fcn.004ad38e
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
lea eax, [esp + 0xb08]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40c98c
push 0
push 0
lea edx, [esp + 0xb10]
mov ecx, 0x6a
call fcn.00408370
add esp, 8
test eax, eax
je 0x40e7e1
push str.Released_excat1.exe_successfully._n
call fcn.0042aa20
add esp, 4
push dword [esp + 0x358]
lea ecx, [esp + 0x38c]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x390]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x494]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x498]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x53c]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x540]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x524]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x528]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x50c]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x510]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x47c]
call fcn.0041d2c0
push 2
push 0x4e7ed0
lea ecx, [esp + 0x480]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x464]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x468]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x44c]
call fcn.0041d2c0
push 1
push 0x4e7ed4
lea ecx, [esp + 0x450]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x614]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x618]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x5fc]
call fcn.0041d2c0
push 1
push 0x4e7ed8
lea ecx, [esp + 0x600]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x3bc]
call fcn.0041d2c0
push 0xb
push 0x4e7a3c
lea ecx, [esp + 0x3c0]
call fcn.0041d3c0
push dword [esp + 0x358]
lea ecx, [esp + 0x5e4]
call fcn.0041d2c0
push 1
push 0x4e7ed4
lea ecx, [esp + 0x5e8]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x5cc]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x5d0]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x4ac]
mov dword [esp + 0x48], 0x84
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x4b0]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x4c4]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x4c8]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x5b4]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x5b8]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x59c]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x5a0]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x584]
call fcn.0041d2c0
push 0
push 0x4e7312
lea ecx, [esp + 0x588]
call fcn.0041d980
push dword [esp + 0x358]
lea ecx, [esp + 0x434]
call fcn.0041d2c0
push 1
push 0x4e7ed8
lea ecx, [esp + 0x438]
call fcn.0041d980
lea ecx, [esp + 0x878]
call fcn.00414880
push 1
push 0x40
push 1
lea eax, [esp + 0xb14]
push eax
lea ecx, [esp + 0x70]
call fcn.00413e20
push 0x34
call fcn.0049d2fc
add esp, 4
mov esi, eax
mov ecx, esi
push 0
call fcn.00401c90
mov dword [esi], vtable.std::codecvt_utf8_utf16_wchar_t__1114111__0_.0
mov ecx, dword [esp + 0x60]
mov ecx, dword [ecx + 4]
push dword [esp + ecx + 0x90]
lea ecx, [esp + 0x5c]
call fcn.00401bd0
push esi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x1e8]
call fcn.0041c740
mov edi, eax
mov ecx, dword [esp + 0x60]
lea esi, [esp + 0x60]
push edi
lea eax, [esp + 0x1dc]
push eax
add esi, dword [ecx + 4]
mov ecx, esi
call fcn.00402e50
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x40cd0b
push edi
lea eax, [esp + 0x1d4]
push eax
call fcn.004195d0
lea ecx, [esp + 0x1d0]
call fcn.00401bf0
lea ecx, [esp + 0x1d8]
call fcn.00401bf0
lea ecx, [esp + 0x1e0]
call fcn.00401bf0
lea ecx, [esp + 0x58]
call fcn.00401bf0
push dword [esp + 0x358]
lea ecx, [esp + 0x41c]
call fcn.0041d2c0
push 0
push 0x4e7478
lea ecx, [esp + 0x420]
call fcn.0041d3c0
cmp dword [esp + 0xbc], 0
je 0x4110c9
push 1
lea ecx, [esp + 0x1f4]
call fcn.004129c0
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x204]
call fcn.00412bb0
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x20c]
call fcn.004191e0
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x41c]
call fcn.00417bc0
lea ecx, [esp + 0x370]
call fcn.00417b60
lea ecx, [esp + 0x60]
call fcn.00413cd0
lea ecx, [esp + 0x258]
call fcn.00412900
lea ecx, [esp + 0x258]
call fcn.00414260
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x644]
push eax
lea ecx, [esp + 0x880]
call fcn.00414760
push 0
push 0x4e7f08
lea ecx, [esp + 0x648]
call fcn.00417db0
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cff0
lea ecx, [esp + 0xb08]
call fcn.00404660
test al, al
je 0x40ce2c
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
lea edx, [esp + 0xb10]
mov ecx, 0x6a
call fcn.00408370
add esp, 8
test eax, eax
je 0x40ec94
push 1
push 0x40
push 1
lea eax, [esp + 0xb14]
push eax
lea ecx, [esp + 0x200]
call fcn.00413e20
lea ecx, [esp + 0x918]
call fcn.00414880
push 0x34
call fcn.0049d2fc
add esp, 4
mov ecx, eax
push 0
call fcn.00414740
push eax
lea eax, [esp + 0x708]
push eax
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x1f8]
add ecx, dword [eax + 4]
call fcn.00402e30
push eax
lea ecx, [esp + 0x838]
call fcn.0041c740
push eax
lea eax, [esp + 0x1ec]
push eax
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x1f8]
add ecx, dword [eax + 4]
call fcn.00414130
lea ecx, [esp + 0x1e8]
call fcn.00401bf0
lea ecx, [esp + 0x830]
call fcn.00401bf0
lea ecx, [esp + 0x704]
call fcn.00401bf0
push 0x4e7478
lea ecx, [esp + 0x41c]
call fcn.00417b30
lea ecx, [esp + 0x1f0]
call fcn.00413d10
test al, al
je 0x40eae9
push 1
lea ecx, [esp + 0x2ac]
call fcn.004129c0
lea ecx, [esp + 0x1f0]
call fcn.00413d20
push eax
lea ecx, [esp + 0x2bc]
call fcn.00412bb0
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00412810
push eax
lea ecx, [esp + 0x41c]
call fcn.00417bc0
lea ecx, [esp + 0x370]
call fcn.00417b60
lea ecx, [esp + 0x1f0]
call fcn.00413cd0
lea ecx, [esp + 0x2a8]
call fcn.00411250
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x374]
push eax
lea ecx, [esp + 0x920]
call fcn.00414760
push eax
lea ecx, [esp + 0x644]
call fcn.004181a0
lea ecx, [esp + 0x370]
call fcn.00418150
push 0
push 0x4e7f08
lea ecx, [esp + 0x648]
call fcn.00417db0
mov esi, eax
cmp esi, 0xffffffff
je 0x40e8a6
lea ecx, [esp + 0x918]
call fcn.004147c0
lea ecx, [esp + 0x1f0]
call fcn.004111c0
push esi
push 0
lea eax, [esp + 0x724]
push eax
lea ecx, [esp + 0x424]
call fcn.00417820
push 0xffffffffffffffff
lea eax, [esi + 3]
push eax
lea eax, [esp + 0x76c]
push eax
lea ecx, [esp + 0x424]
call fcn.00417820
lea eax, [esp + 0x71c]
push eax
lea eax, [esp + 0x780]
push eax
lea ecx, [esp + 0x880]
call fcn.00414760
lea eax, [esp + 0x764]
push eax
lea eax, [esp + 0x750]
push eax
lea ecx, [esp + 0x880]
call fcn.00414760
push 0x7c
lea edx, [esp + 0x750]
lea ecx, [esp + 0x14]
call fcn.00404670
add esp, 4
lea ecx, [esp + 0x6ec]
mov edi, 1
push 0x4e7312
call fcn.00418270
lea ecx, [esp + 0x10]
call fcn.00417070
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00417060
mov ebx, eax
cmp esi, ebx
je 0x40d288
cmp edi, 0x16
jg 0x40d105
push esi
lea edx, [esp + 0x6f0]
lea ecx, [esp + 0x3a4]
call fcn.0041bca0
add esp, 4
mov ecx, eax
push 1
push 0x4e7f58
call fcn.00418090
push eax
lea ecx, [esp + 0x374]
call fcn.00418220
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x6f0]
call fcn.004181a0
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00418150
cmp edi, 1
jne 0x40d116
lea ecx, [esp + 0x388]
jmp 0x40d276
cmp edi, 2
jne 0x40d127
lea ecx, [esp + 0x490]
jmp 0x40d276
cmp edi, 3
jne 0x40d138
lea ecx, [esp + 0x538]
jmp 0x40d276
cmp edi, 4
jne 0x40d149
lea ecx, [esp + 0x520]
jmp 0x40d276
cmp edi, 5
jne 0x40d15a
lea ecx, [esp + 0x508]
jmp 0x40d276
cmp edi, 6
jne 0x40d16b
lea ecx, [esp + 0x478]
jmp 0x40d276
cmp edi, 7
jne 0x40d17c
lea ecx, [esp + 0x460]
jmp 0x40d276
cmp edi, 8
jne 0x40d18d
lea ecx, [esp + 0x448]
jmp 0x40d276
cmp edi, 9
jne 0x40d19e
lea ecx, [esp + 0x610]
jmp 0x40d276
cmp edi, 0xb
jne 0x40d1af
lea ecx, [esp + 0x5f8]
jmp 0x40d276
cmp edi, 0xc
jne 0x40d1e0
mov edx, esi
lea ecx, [esp + 0x370]
call fcn.00405d10
push eax
lea ecx, [esp + 0x3bc]
call fcn.00417bc0
lea ecx, [esp + 0x370]
call fcn.00417b60
jmp 0x40d27c
cmp edi, 0xd
jne 0x40d1ef
mov ecx, 0x4f3f58
jmp 0x40d276
cmp edi, 0xe
jne 0x40d1fd
lea ecx, [esp + 0x5e0]
jmp 0x40d276
cmp edi, 0xf
jne 0x40d20b
lea ecx, [esp + 0x5c8]
jmp 0x40d276
cmp edi, 0x10
jne 0x40d224
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
add esp, 4
mov dword [esp + 0x44], eax
jmp 0x40d27c
cmp edi, 0x11
jne 0x40d232
lea ecx, [esp + 0x4a8]
jmp 0x40d276
cmp edi, 0x12
jne 0x40d240
lea ecx, [esp + 0x4c0]
jmp 0x40d276
cmp edi, 0x15
jne 0x40d24e
lea ecx, [esp + 0x5b0]
jmp 0x40d276
cmp edi, 0x16
jne 0x40d25c
lea ecx, [esp + 0x598]
jmp 0x40d276
cmp edi, 0x17
jne 0x40d26a
lea ecx, [esp + 0x580]
jmp 0x40d276
cmp edi, 0x18
jne 0x40d27c
lea ecx, [esp + 0x430]
push esi
call fcn.00418120
add esi, 0x18
inc edi
cmp esi, ebx
jne 0x40d0a2
lea edx, [esp + 0x6ec]
lea ecx, [esp + 0x734]
call fcn.00404430
lea eax, [esp + 0x580]
push eax
lea ecx, [esp + 0x738]
call fcn.0041eca0
test al, al
jne 0x40d43b
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
lea ecx, [esp + 0x640]
call fcn.00418150
lea ecx, [esp + 0x418]
call fcn.00417b60
lea ecx, [esp + 0xd0]
call fcn.00413d30
lea ecx, [esp + 0xd0]
call fcn.00414260
lea ecx, [esp + 0x878]
call fcn.004147c0
lea ecx, [esp + 0x430]
call fcn.00418150
lea ecx, [esp + 0x580]
call fcn.00418150
lea ecx, [esp + 0x598]
call fcn.00418150
lea ecx, [esp + 0x5b0]
call fcn.00418150
lea ecx, [esp + 0x4c0]
call fcn.00418150
lea ecx, [esp + 0x4a8]
call fcn.00418150
lea ecx, [esp + 0x5c8]
call fcn.00418150
lea ecx, [esp + 0x5e0]
call fcn.00418150
lea ecx, [esp + 0x3b8]
call fcn.00417b60
lea ecx, [esp + 0x5f8]
call fcn.00418150
lea ecx, [esp + 0x610]
call fcn.00418150
lea ecx, [esp + 0x448]
call fcn.00418150
lea ecx, [esp + 0x460]
call fcn.00418150
lea ecx, [esp + 0x478]
call fcn.00418150
lea ecx, [esp + 0x508]
call fcn.00418150
lea ecx, [esp + 0x520]
call fcn.00418150
lea ecx, [esp + 0x538]
call fcn.00418150
lea ecx, [esp + 0x490]
call fcn.00418150
lea ecx, [esp + 0x388]
call fcn.00418150
jmp 0x40c949
push 0x4e7312
lea ecx, [esp + 0x4ac]
call fcn.0041ec10
test al, al
jne 0x410f91
push 0x2c
lea edx, [esp + 0x4ac]
lea ecx, [esp + 0x20]
call fcn.00404670
add esp, 4
lea ecx, [esp + 0x1c]
mov edi, 1
call fcn.00417070
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00417060
mov ebx, eax
cmp esi, ebx
je 0x40d4d9
cmp edi, 1
jne 0x40d49e
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
mov dword [esp + 0x44], eax
jmp 0x40d4ce
cmp edi, 2
jne 0x40d4b7
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
mov dword [esp + 0x82c], eax
jmp 0x40d4ce
cmp edi, 3
jne 0x40d4d1
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
mov dword [esp + 0x36c], eax
add esp, 4
add esi, 0x18
inc edi
cmp esi, ebx
jne 0x40d488
cmp dword [esp + 0x40], 0x1388
jl 0x40d4f0
call fcn.0040c020
test al, al
jne 0x40ecbd
push 0x4e7ed8
lea ecx, [esp + 0x494]
call fcn.0041ec10
test al, al
jne 0x40d548
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x388]
or eax, 3
lea ecx, [esp + 0x3a0]
mov dword [esp + 0xc], eax
call fcn.00405d10
mov edx, eax
lea ecx, [esp + 0x370]
call fcn.004069b0
lea ecx, [esp + 0x4f0]
push ecx
mov ecx, eax
call fcn.0041eca0
test al, al
je 0x40d548
mov bl, 1
jmp 0x40d54a
xor bl, bl
mov eax, dword [esp + 0xc]
test al, 2
je 0x40d569
and eax, 0xfffffffd
lea ecx, [esp + 0x370]
mov dword [esp + 0xc], eax
call fcn.00418150
mov eax, dword [esp + 0xc]
test al, 1
je 0x40d580
and eax, 0xfffffffe
lea ecx, [esp + 0x3a0]
mov dword [esp + 0xc], eax
call fcn.00417b60
test bl, bl
jne 0x410c3e
push dword [esp + 0x358]
lea ecx, [esp + 0x7b0]
call fcn.0041d2c0
push 0x10
push str.SbOmI5PlV3rRkPMj
lea ecx, [esp + 0x7b4]
call fcn.0041d980
push str..dat
lea edx, [esp + 0x6c0]
lea ecx, [esp + 0x798]
call fcn.0041bbe0
add esp, 4
lea edx, [esp + 0xc10]
mov ecx, 0x104
call fcn.00409ce0
test eax, eax
je 0x410c25
lea ecx, [esp + 0x794]
call fcn.00417f60
push eax
lea eax, [esp + 0xc14]
push 0x104
push eax
call fcn.004ad38e
add esp, 0xc
lea eax, [esp + 0x460]
mov edx, str.http:__www.aqianniao.com_ver_json_
lea ecx, [esp + 0x370]
push str..json
push eax
call fcn.0041c5d0
add esp, 4
lea ecx, [esp + 0x7c8]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x370]
call fcn.00418150
push 0
lea ecx, [esp + 0x2c]
call fcn.004174a0
mov edx, 0x4e7ed0
lea ecx, [esp + 0x478]
call fcn.0041c8d0
test al, al
je 0x40d836
lea edx, [esp + 0x28]
lea ecx, [esp + 0x7c4]
call fcn.004085c0
test al, al
je 0x40d836
mov edx, 0x4e7ed8
lea ecx, [esp + 0x430]
call fcn.0041c5a0
test al, al
je 0x40d6fd
push str.auto_update
lea ecx, [esp + 0x2c]
call fcn.0041c910
mov ecx, eax
call fcn.0041c960
cmp eax, 1
jne 0x40d6fd
lea eax, [esp + 0x3a0]
push eax
push ecx
push str.download_url
lea ecx, [esp + 0x34]
call fcn.0041c910
add esp, 4
mov ecx, eax
call fcn.0041ca70
lea eax, [esp + 0xc10]
push eax
lea ecx, [esp + 0x374]
call fcn.00418270
lea eax, [esp + 0x3a0]
push eax
push str.now_version
lea ecx, [esp + 0x30]
call fcn.0041c910
jmp 0x40d7d2
mov edx, 0x4e8134
lea ecx, [esp + 0x430]
call fcn.0041c5a0
test al, al
jne 0x40d72b
mov edx, 0x4e8138
lea ecx, [esp + 0x430]
call fcn.0041c5a0
test al, al
je 0x40d836
sub esp, 0x18
lea eax, [esp + 0x448]
mov ecx, esp
mov edx, str.auto_update
push eax
call fcn.0041c5d0
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00417240
mov ecx, eax
call fcn.0041c960
cmp eax, 1
jne 0x40d836
lea eax, [esp + 0x3a0]
mov edx, str.download_url
push eax
sub esp, 0x1c
lea eax, [esp + 0x450]
mov ecx, esp
push eax
call fcn.0041c5d0
add esp, 4
lea ecx, [esp + 0x48]
call fcn.00417240
add esp, 4
mov ecx, eax
call fcn.0041ca70
lea eax, [esp + 0xc10]
push eax
lea ecx, [esp + 0x374]
call fcn.00418270
lea eax, [esp + 0x3a0]
mov edx, str.now_version
push eax
sub esp, 0x18
lea eax, [esp + 0x44c]
mov ecx, esp
push eax
call fcn.0041c5d0
add esp, 4
lea ecx, [esp + 0x44]
call fcn.00417240
push ecx
mov ecx, eax
call fcn.0041c960
add esp, 4
lea ecx, [esp + 0x4dc]
mov edx, eax
call fcn.00403100
push eax
lea eax, [esp + 0x378]
push eax
lea eax, [esp + 0x46c]
push eax
lea edx, [esp + 0x398]
lea ecx, [esp + 0x488]
call fcn.00409d90
add esp, 0x10
lea ecx, [esp + 0x4d8]
call fcn.00418150
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00418150
mov edx, 0x4e7ed8
lea ecx, [esp + 0x5e0]
call fcn.0041c5a0
test al, al
je 0x40d94d
lea ecx, [esp + 0x3a0]
call fcn.00409710
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x3a0]
or ebx, 4
lea ecx, [esp + 0x848]
push 0x4e813c
mov dword [esp + 0x10], ebx
call fcn.0041bdc0
add esp, 4
mov ecx, eax
call fcn.00409930
test al, al
je 0x40d8ea
or ebx, 8
lea edx, [esp + 0x3a0]
push 0x4e8148
lea ecx, [esp + 0x4dc]
mov dword [esp + 0x10], ebx
call fcn.0041bdc0
add esp, 4
mov ecx, eax
call fcn.00409930
test al, al
je 0x40d8ea
or ebx, 0x10
lea edx, [esp + 0x3a0]
push 0x4e8150
lea ecx, [esp + 0x374]
mov dword [esp + 0x10], ebx
call fcn.0041bdc0
add esp, 4
mov ecx, eax
call fcn.00409930
test al, al
je 0x40d8ea
xor bl, bl
jmp 0x40d8ec
mov bl, 1
mov eax, dword [esp + 0xc]
test al, 0x10
je 0x40d90b
and eax, 0xffffffef
lea ecx, [esp + 0x370]
mov dword [esp + 0xc], eax
call fcn.00417b60
mov eax, dword [esp + 0xc]
test al, 8
je 0x40d926
and eax, 0xfffffff7
lea ecx, [esp + 0x4d8]
mov dword [esp + 0xc], eax
call fcn.00417b60
mov eax, dword [esp + 0xc]
and eax, 0xfffffffb
lea ecx, [esp + 0x848]
mov dword [esp + 0xc], eax
call fcn.00417b60
test bl, bl
jne 0x40eefd
lea ecx, [esp + 0x3a0]
call fcn.00417b60
mov edx, 0x4e7ed4
lea ecx, [esp + 0x508]
call fcn.0041c8d0
test al, al
je 0x40d9a0
lea eax, [esp + 0x1e78]
push eax
lea ecx, [esp + 0x374]
call fcn.00418270
lea eax, [esp + 0x520]
push eax
lea edx, [esp + 0x374]
lea ecx, [esp + 0x4f4]
call fcn.00407ce0
add esp, 4
lea ecx, [esp + 0x370]
call fcn.00418150
lea eax, [esp + 0x388]
push eax
lea eax, [esp + 0x7e0]
push eax
lea ecx, [esp + 0x880]
call fcn.00414790
lea ecx, [esp + 0xc10]
call fcn.00404660
push 1
test al, al
lea eax, [esp + 0xc14]
push 0x40
jne 0x40dbb0
push 2
push eax
lea ecx, [esp + 0x978]
call fcn.00411a30
lea ecx, [esp + 0x968]
call fcn.00411870
test al, al
je 0x40f67b
mov edx, 0x10
lea ecx, [esp + 0x370]
call fcn.00405ac0
lea ecx, [esp + 0x7f4]
call fcn.00404930
push eax
push 0x4e79f8
lea edx, [esp + 0x378]
lea ecx, [esp + 0x4e0]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x84c]
mov edx, eax
call fcn.0041bda0
add esp, 4
lea ecx, [esp + 0x400]
push eax
call fcn.004181a0
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x4d8]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
push str.QND.dll
lea edx, [esp + 0x374]
lea ecx, [esp + 0x7f8]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x3e8]
push eax
call fcn.004181a0
lea ecx, [esp + 0x7f4]
call fcn.00418150
push str.QND.conf
lea edx, [esp + 0x374]
lea ecx, [esp + 0x7f8]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x3d0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea eax, [esp + 0x3d0]
push eax
push 0x4e7f58
lea eax, [esp + 0x3f0]
push eax
push 0x4e7f58
lea edx, [esp + 0x410]
lea ecx, [esp + 0x4e8]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x854]
mov edx, eax
call fcn.0041bcf0
add esp, 4
lea ecx, [esp + 0x7fc]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a4]
mov edx, eax
call fcn.0041bcf0
add esp, 4
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x4d8]
call fcn.00418150
lea edx, [esp + 0x3a0]
lea ecx, [esp + 0x968]
call fcn.0041cb70
lea ecx, [esp + 0x968]
call fcn.00411830
lea ecx, [esp + 0x3a0]
call fcn.00418150
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x968]
call fcn.00411350
jmp 0x40deb4
push 1
push eax
lea ecx, [esp + 0xd28]
call fcn.00415640
lea ecx, [esp + 0xd18]
call fcn.00413d10
test al, al
je 0x410bdd
push 1
lea ecx, [esp + 0x2ac]
call fcn.00416a00
lea ecx, [esp + 0xd18]
call fcn.00413d20
push eax
lea ecx, [esp + 0x2bc]
call fcn.00416d30
lea eax, [esp + 0x3a0]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00416700
lea ecx, [esp + 0xd18]
call fcn.00415600
push 1
push 3
lea eax, [esp + 0x3a8]
push eax
lea ecx, [esp + 0x1fc]
call fcn.004167f0
push 0x7c
lea edx, [esp + 0x404]
lea ecx, [esp + 0x1f4]
call fcn.0041bbc0
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00402d90
test al, al
je 0x40dca9
push 0x7c
lea edx, [esp + 0x3ec]
lea ecx, [esp + 0x1f4]
call fcn.0041bbc0
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00402d90
test al, al
je 0x40dca9
lea edx, [esp + 0x3d0]
lea ecx, [esp + 0x1f0]
call fcn.0041cb90
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00402d90
test al, al
jne 0x40de84
push 1
push 0x40
push 2
lea eax, [esp + 0xc1c]
push eax
lea ecx, [esp + 0x978]
call fcn.00411a30
lea ecx, [esp + 0x968]
call fcn.00411870
test al, al
je 0x410b65
mov edx, 0x10
lea ecx, [esp + 0x370]
call fcn.00405ac0
lea ecx, [esp + 0x670]
call fcn.00404930
push eax
push 0x4e79f8
lea edx, [esp + 0x378]
lea ecx, [esp + 0x850]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x7f8]
mov edx, eax
call fcn.0041bda0
add esp, 4
lea ecx, [esp + 0x400]
push eax
call fcn.004181a0
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x670]
call fcn.00418150
push str.QND.dll
lea edx, [esp + 0x374]
lea ecx, [esp + 0x674]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x3e8]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
push str.QND.conf
lea edx, [esp + 0x374]
lea ecx, [esp + 0x674]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x3d0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea eax, [esp + 0x3d0]
push eax
push 0x4e7f58
lea eax, [esp + 0x3f0]
push eax
push 0x4e7f58
lea edx, [esp + 0x410]
lea ecx, [esp + 0x858]
call fcn.0041bbe0
add esp, 4
lea ecx, [esp + 0x800]
mov edx, eax
call fcn.0041bcf0
add esp, 4
lea ecx, [esp + 0x678]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x4dc]
mov edx, eax
call fcn.0041bcf0
add esp, 4
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea edx, [esp + 0x4d8]
lea ecx, [esp + 0x968]
call fcn.0041cb70
lea ecx, [esp + 0x968]
call fcn.00411830
lea ecx, [esp + 0x4d8]
call fcn.00418150
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x968]
call fcn.00411350
lea ecx, [esp + 0x1f0]
call fcn.004047e0
lea ecx, [esp + 0x3a0]
call fcn.00418150
lea ecx, [esp + 0x2a8]
call fcn.004047e0
lea ecx, [esp + 0xd18]
call fcn.0040bec0
lea edx, [esp + 0x1330]
mov ecx, 0x104
call fcn.00409c50
test eax, eax
je 0x410b45
lea ecx, [esp + 0x400]
call fcn.00417f60
push eax
lea eax, [esp + 0x1334]
push 0x104
push eax
call fcn.004ad38e
add esp, 0xc
lea edx, [esp + 0x1958]
mov ecx, 0x104
call fcn.00409ce0
test eax, eax
je 0x410b45
lea ecx, [esp + 0x3e8]
call fcn.00417f60
push eax
lea eax, [esp + 0x195c]
push 0x104
push eax
call fcn.004ad38e
add esp, 0xc
lea edx, [esp + 0x1c68]
mov ecx, 0x104
call fcn.00409ce0
test eax, eax
je 0x410b45
lea ecx, [esp + 0x3d0]
call fcn.00417f60
push eax
lea eax, [esp + 0x1c6c]
push 0x104
push eax
call fcn.004ad38e
add esp, 0xc
lea edx, [esp + 0x1128]
mov ecx, 0x104
call fcn.00409b30
test eax, eax
je 0x410b45
lea edx, [esp + 0x400]
lea ecx, [esp + 0x670]
call fcn.00405d10
mov ecx, eax
call fcn.004179f0
push eax
lea eax, [esp + 0x112c]
push 0x104
push eax
call fcn.004ad3f1
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417b60
lea edx, [esp + 0x1438]
mov ecx, 0x104
call fcn.00409bd0
test eax, eax
je 0x410b45
lea edx, [esp + 0x3e8]
lea ecx, [esp + 0x670]
call fcn.00405d10
mov ecx, eax
call fcn.004179f0
push eax
lea eax, [esp + 0x143c]
push 0x104
push eax
call fcn.004ad3f1
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417b60
lea edx, [esp + 0x1a60]
mov ecx, 0x104
call fcn.00409bd0
test eax, eax
je 0x410b45
lea edx, [esp + 0x3d0]
lea ecx, [esp + 0x670]
call fcn.00405d10
mov ecx, eax
call fcn.004179f0
push eax
lea eax, [esp + 0x1a64]
push 0x104
push eax
call fcn.004ad3f1
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417b60
mov edx, 0x4e7ed8
lea ecx, [esp + 0x490]
call fcn.0041c8d0
test al, al
je 0x40e143
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x394]
call fcn.00417f60
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0
push 0xfde9
call ebx
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049d331
add esp, 4
lea ecx, [esp + 0x388]
mov edi, eax
push esi
push edi
push 0xffffffffffffffff
call fcn.00417f60
push eax
push 0
push 0xfde9
call ebx
lea ecx, [esp + 0x370]
call fcn.00408a70
lea ecx, [esp + 0x370]
call fcn.004179f0
push eax
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad460
add esp, 0xc
lea eax, [esp + 0xd18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea eax, [esp + 0xd1c]
push eax
lea eax, [esp + 0xf28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
call fcn.0049d32c
add esp, 4
lea ecx, [esp + 0x370]
call fcn.00417b60
jmp 0x40e1f1
lea edx, [esp + 0xd18]
mov ecx, 0x104
call fcn.00409bd0
test eax, eax
je 0x410b25
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x394]
call fcn.00417f60
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0
push 0xfde9
call ebx
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049d331
add esp, 4
lea ecx, [esp + 0x388]
mov edi, eax
push esi
push edi
push 0xffffffffffffffff
call fcn.00417f60
push eax
push 0
push 0xfde9
call ebx
push edi
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad3f1
add esp, 0xc
lea eax, [esp + 0xd18]
push eax
lea eax, [esp + 0xf24]
push 0x104
push eax
call fcn.004ad460
add esp, 0xc
push edi
call fcn.0049d32c
add esp, 4
lea eax, [esp + 0x1330]
push eax
lea eax, [esp + 0x174c]
push 0x104
push eax
call fcn.004ad4c4
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x1754]
add esp, 0xc
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x1748]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40e237
test al, 0x10
jne 0x40e26d
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x1748]
push 0
push eax
call edi
test eax, eax
jne 0x40e273
push 0x10
push 0x4e7a88
push str.Unable_to_create_directory
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f187
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x1958]
push eax
lea eax, [esp + 0x1854]
push 0x104
push eax
call fcn.004ad4c4
add esp, 0xc
lea eax, [esp + 0x1850]
push eax
call esi
lea eax, [esp + 0x1850]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40e2ad
test al, 0x10
jne 0x40e2bd
push 0
lea eax, [esp + 0x1854]
push eax
call edi
test eax, eax
je 0x40e24d
lea ecx, [esp + 0x1438]
call fcn.00404650
test al, al
jne 0x40e329
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
push 0
mov edx, 0x4e7ed8
lea ecx, [esp + 0x464]
call fcn.0041c5a0
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x1454]
movzx eax, al
push eax
call fcn.00407330
add esp, 0x20
test eax, eax
je 0x40f6c3
push str.Released_excat1.exe_successfully._n
call fcn.0042aa20
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 4
jmp 0x40e4d6
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea eax, [esp + 0x1438]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40e3a4
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
push eax
push esi
mov dword [esp + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e39d
mov eax, dword [esp + 0x50]
or eax, dword [esp + 0x54]
jne 0x40e39d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x1438]
jmp 0x40e631
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xa88]
lea ecx, [esp + 0x1438]
call fcn.004040c0
test al, al
je 0x40fe24
lea edx, [esp + 0xa98]
lea ecx, [esp + 0x5b0]
call fcn.00404260
test al, al
je 0x40ff76
lea ecx, [esp + 0xa88]
mov esi, 0xc
lea edx, [esp + 0xa98]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40e405
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40e3f0
xor eax, eax
jmp 0x40e42c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40e427
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40e427
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40e427
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x40e427
xor eax, eax
jmp 0x40e42c
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e4d6
lea edx, [esp + 0x1128]
lea ecx, [esp + 0x4d8]
call fcn.00404390
lea edx, [esp + 0x358]
lea ecx, [esp + 0x4d8]
call fcn.004081c0
test al, al
je 0x40e479
mov ecx, dword [esp + 0x358]
call fcn.00408330
test al, al
je 0x40e479
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
push 0
mov edx, 0x4e7ed8
lea ecx, [esp + 0x464]
call fcn.0041c5a0
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x1454]
movzx eax, al
push eax
call fcn.00407330
add esp, 0x20
test eax, eax
je 0x40fa2a
push str.Released_excat1.exe_successfully._n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x4d8]
call fcn.00417b60
lea ecx, [esp + 0x1958]
call fcn.0040bf50
lea ecx, [esp + 0x1a60]
call fcn.00404650
push 1
test al, al
lea ecx, [esp + 0x96c]
push 0x40
lea eax, [esp + 0x1a68]
jne 0x40e53d
push 0x20
push eax
call fcn.00411880
mov eax, dword [esp + 0x968]
lea ecx, [esp + 0x968]
add ecx, dword [eax + 4]
call fcn.00402da0
test al, al
jne 0x40fd8c
lea ecx, [esp + 0xb08]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e534
jmp 0x40e577
push 0x30
push eax
call fcn.00411880
mov eax, dword [esp + 0x968]
lea ecx, [esp + 0x968]
add ecx, dword [eax + 4]
call fcn.00402da0
test al, al
jne 0x40fd8c
lea ecx, [esp + 0xb08]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e570
push 0
sub ecx, edx
lea eax, [esp + 0xb0c]
push ecx
push eax
lea ecx, [esp + 0x974]
call fcn.00416bd0
lea ecx, [esp + 0x968]
call fcn.00411830
lea ecx, [esp + 0x968]
call fcn.00411350
lea ecx, [esp + 0x1128]
call fcn.00404650
test al, al
je 0x41035a
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea eax, [esp + 0x1140]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40fe09
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push eax
push esi
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40fe02
mov eax, dword [esp + 0x48]
or eax, dword [esp + 0x4c]
jne 0x40fe02
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x1128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x7dc]
call fcn.00417b60
lea ecx, [esp + 0x28]
call fcn.00417450
lea ecx, [esp + 0x7c4]
call fcn.00418150
lea ecx, [esp + 0x794]
call fcn.00418150
lea ecx, [esp + 0x7ac]
call fcn.00418150
lea ecx, [esp + 0x1c]
call fcn.00417080
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
lea ecx, [esp + 0x640]
call fcn.00418150
lea ecx, [esp + 0x418]
call fcn.00417b60
lea ecx, [esp + 0x60]
call fcn.004111c0
lea ecx, [esp + 0x878]
call fcn.004147c0
lea ecx, [esp + 0x430]
call fcn.00418150
lea ecx, [esp + 0x580]
call fcn.00418150
lea ecx, [esp + 0x598]
call fcn.00418150
lea ecx, [esp + 0x5b0]
call fcn.00418150
lea ecx, [esp + 0x4c0]
call fcn.00418150
lea ecx, [esp + 0x4a8]
call fcn.00418150
lea ecx, [esp + 0x5c8]
call fcn.00418150
lea ecx, [esp + 0x5e0]
call fcn.00418150
lea ecx, [esp + 0x3b8]
call fcn.00417b60
lea ecx, [esp + 0x5f8]
call fcn.00418150
lea ecx, [esp + 0x610]
call fcn.00418150
lea ecx, [esp + 0x448]
call fcn.00418150
lea ecx, [esp + 0x460]
call fcn.00418150
lea ecx, [esp + 0x478]
call fcn.00418150
lea ecx, [esp + 0x508]
call fcn.00418150
lea ecx, [esp + 0x520]
call fcn.00418150
lea ecx, [esp + 0x538]
call fcn.00418150
lea ecx, [esp + 0x490]
call fcn.00418150
lea ecx, [esp + 0x388]
call fcn.00418150
jmp 0x40c950
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aa20
add esp, 4
lea eax, [esp + 0xb08]
push 0x10
push 0x4e7a88
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x6a4]
call fcn.00418150
lea ecx, [esp + 0x6bc]
call fcn.00418150
lea ecx, [esp + 0x6d4]
call fcn.00418150
lea ecx, [esp + 0x118]
call fcn.004111c0
lea ecx, [esp + 0x8c8]
call fcn.004147c0
lea ecx, [esp + 0x550]
call fcn.00418150
lea ecx, [esp + 0x568]
call fcn.00418150
lea ecx, [esp + 0x658]
call fcn.00418150
lea ecx, [esp + 0x4f0]
call fcn.00418150
lea ecx, [esp + 0x3d0]
call fcn.00418150
lea ecx, [esp + 0x3e8]
call fcn.00418150
lea ecx, [esp + 0x628]
call fcn.00418150
lea ecx, [esp + 0x400]
call fcn.00418150
jmp 0x410f75
push 0x4e7f0c
lea ecx, [esp + 0x834]
call fcn.004157b0
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e7f20
lea ecx, [esp + 0x708]
call fcn.004157b0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Parsing_configuration_file_error
lea ecx, [esp + 0x674]
call fcn.00415f10
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x40e945
lea ecx, [esp + 0x704]
call fcn.00415790
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x708]
jmp 0x40e9ac
cmp eax, 3
jne 0x40e97f
lea ecx, [esp + 0x670]
call fcn.00415ee0
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x678]
call fcn.00411500
jmp 0x40e9b2
lea ecx, [esp + 0x830]
call fcn.00415790
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x834]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x918]
call fcn.004147c0
lea ecx, [esp + 0x1f0]
call fcn.004111c0
lea ecx, [esp + 0x640]
call fcn.00418150
lea ecx, [esp + 0x418]
call fcn.00417b60
lea ecx, [esp + 0x60]
call fcn.004111c0
lea ecx, [esp + 0x878]
call fcn.004147c0
lea ecx, [esp + 0x430]
call fcn.00418150
lea ecx, [esp + 0x580]
call fcn.00418150
lea ecx, [esp + 0x598]
call fcn.00418150
lea ecx, [esp + 0x5b0]
call fcn.00418150
lea ecx, [esp + 0x4c0]
call fcn.00418150
lea ecx, [esp + 0x4a8]
call fcn.00418150
lea ecx, [esp + 0x5c8]
call fcn.00418150
lea ecx, [esp + 0x5e0]
call fcn.00418150
lea ecx, [esp + 0x3b8]
call fcn.00417b60
lea ecx, [esp + 0x5f8]
call fcn.00418150
lea ecx, [esp + 0x610]
call fcn.00418150
lea ecx, [esp + 0x448]
call fcn.00418150
lea ecx, [esp + 0x460]
call fcn.00418150
lea ecx, [esp + 0x478]
call fcn.00418150
lea ecx, [esp + 0x508]
call fcn.00418150
lea ecx, [esp + 0x520]
call fcn.00418150
lea ecx, [esp + 0x538]
call fcn.00418150
lea ecx, [esp + 0x490]
call fcn.00418150
lea ecx, [esp + 0x388]
call fcn.00418150
jmp 0x40c886
push fcn.0041c820
push ecx
mov edx, str.Unable_to_open_the_param_file_for_reading.
mov ecx, 0x4f56d0
call fcn.0041c000
add esp, 4
mov ecx, eax
call fcn.00416fe0
push str.Unable_to_open_the_param_file_for_reading
lea ecx, [esp + 0x674]
call fcn.00412070
push 0x4e7a88
lea ecx, [esp + 0x364]
call fcn.00415fe0
lea ecx, [esp + 0x670]
call fcn.00412030
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
push eax
lea ecx, [esp + 0x678]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x918]
call fcn.004147c0
lea ecx, [esp + 0x1f0]
call fcn.004111c0
lea ecx, [esp + 0x640]
call fcn.00418150
lea ecx, [esp + 0x418]
call fcn.00417b60
lea ecx, [esp + 0x60]
call fcn.004111c0
lea ecx, [esp + 0x878]
call fcn.004147c0
lea ecx, [esp + 0x430]
call fcn.00418150
lea ecx, [esp + 0x580]
call fcn.00418150
lea ecx, [esp + 0x598]
call fcn.00418150
lea ecx, [esp + 0x5b0]
call fcn.00418150
lea ecx, [esp + 0x4c0]
call fcn.00418150
lea ecx, [esp + 0x4a8]
call fcn.00418150
lea ecx, [esp + 0x5c8]
call fcn.00418150
lea ecx, [esp + 0x5e0]
call fcn.00418150
lea ecx, [esp + 0x3b8]
call fcn.00417b60
lea ecx, [esp + 0x5f8]
call fcn.00418150
lea ecx, [esp + 0x610]
call fcn.00418150
lea ecx, [esp + 0x448]
call fcn.00418150
lea ecx, [esp + 0x460]
call fcn.00418150
lea ecx, [esp + 0x478]
call fcn.00418150
lea ecx, [esp + 0x508]
call fcn.00418150
lea ecx, [esp + 0x520]
call fcn.00418150
lea ecx, [esp + 0x538]
call fcn.00418150
lea ecx, [esp + 0x490]
call fcn.00418150
lea ecx, [esp + 0x388]
call fcn.00418150
jmp 0x40c886
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aa20
add esp, 4
lea eax, [esp + 0xb08]
push 0x10
push 0x4e7a88
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40e9d3
push 0
push 0x4e7fcc
push 0x4e7fd8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
call fcn.00417080
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00413cc0
lea ecx, [esp + 0x640]
call fcn.00418150
lea ecx, [esp + 0x418]
call fcn.00417b60
lea ecx, [esp + 0x60]
call fcn.004111c0
lea ecx, [esp + 0x878]
call fcn.004147c0
lea ecx, [esp + 0x430]
call fcn.00418150
lea ecx, [esp + 0x580]
call fcn.00418150
lea ecx, [esp + 0x598]
call fcn.00418150
lea ecx, [esp + 0x5b0]
call fcn.00418150
lea ecx, [esp + 0x4c0]
call fcn.00418150
lea ecx, [esp + 0x4a8]
call fcn.00418150
lea ecx, [esp + 0x5c8]
call fcn.00418150
lea ecx, [esp + 0x5e0]
call fcn.00418150
lea ecx, [esp + 0x3b8]
call fcn.00417b60
lea ecx, [esp + 0x5f8]
call fcn.00418150
lea ecx, [esp + 0x610]
call fcn.00418150
lea ecx, [esp + 0x448]
call fcn.00418150
lea ecx, [esp + 0x460]
call fcn.00418150
lea ecx, [esp + 0x478]
call fcn.00418150
lea ecx, [esp + 0x508]
call fcn.00418150
lea ecx, [esp + 0x520]
call fcn.00418150
lea ecx, [esp + 0x538]
call fcn.00418150
lea ecx, [esp + 0x490]
call fcn.00418150
lea ecx, [esp + 0x388]
call fcn.00418150
lea ecx, [esp + 0x6a4]
call fcn.00418150
lea ecx, [esp + 0x6bc]
call fcn.00418150
lea ecx, [esp + 0x6d4]
call fcn.00418150
lea ecx, [esp + 0x118]
call fcn.004111c0
lea ecx, [esp + 0x8c8]
call fcn.004147c0
lea ecx, [esp + 0x550]
call fcn.00418150
lea ecx, [esp + 0x568]
call fcn.00418150
lea ecx, [esp + 0x658]
call fcn.00418150
lea ecx, [esp + 0x4f0]
call fcn.00418150
lea ecx, [esp + 0x3d0]
call fcn.00418150
lea ecx, [esp + 0x3e8]
call fcn.00418150
lea ecx, [esp + 0x628]
call fcn.00418150
lea ecx, [esp + 0x400]
call fcn.00418150
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1f78]
xor ecx, esp
call fcn.0049d2bd
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0xd18]
mov ecx, 0x104
call fcn.00409b30
push str.weiduan.exe
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad3f1
add esp, 0xc
lea ecx, [esp + 0x388]
push 0
push 0x4e8170
call fcn.00417db0
push eax
push 0
lea eax, [esp + 0x378]
push eax
lea ecx, [esp + 0x394]
call fcn.00417d50
lea ecx, [esp + 0x4c0]
call fcn.00417ec0
test al, al
jne 0x40ef76
lea eax, [esp + 0x4c0]
push eax
lea ecx, [esp + 0x374]
call fcn.00418120
push 0x4e7b2c
lea ecx, [esp + 0x834]
call fcn.00408a70
push eax
push 0x4e8174
lea edx, [esp + 0x37c]
lea ecx, [esp + 0x710]
call fcn.00405d10
push eax
mov edx, 0x4e7b2c
lea ecx, [esp + 0x858]
call fcn.0041c540
add esp, 4
lea ecx, [esp + 0x800]
mov edx, eax
call fcn.0041be30
add esp, 4
lea ecx, [esp + 0x678]
mov edx, eax
call fcn.0041bea0
add esp, 4
lea ecx, [esp + 0x4dc]
mov edx, eax
call fcn.0041be30
add esp, 4
lea ecx, [esp + 0x670]
call fcn.00417b60
lea ecx, [esp + 0x7f4]
call fcn.00417b60
lea ecx, [esp + 0x848]
call fcn.00417b60
lea ecx, [esp + 0x704]
call fcn.00417b60
lea ecx, [esp + 0x830]
call fcn.00417b60
lea ecx, [esp + 0xd18]
call fcn.00404650
test al, al
je 0x40f5a3
lea edx, [esp + 0xaf8]
lea ecx, [esp + 0xd18]
call fcn.004040c0
test al, al
jne 0x40f218
push 0x4e817c
lea ecx, [esp + 0x7f8]
call fcn.00411cb0
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e81a0
lea ecx, [esp + 0x674]
call fcn.00411cb0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Unable_to_open_the_specified_file_to_calculate_its_MD5_hash_value.
lea ecx, [esp + 0x91c]
call fcn.00411bd0
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x40f0f2
lea ecx, [esp + 0x670]
call fcn.00411c70
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x674]
jmp 0x40f159
cmp eax, 3
jne 0x40f12c
lea ecx, [esp + 0x918]
call fcn.00411b80
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x920]
call fcn.00411500
jmp 0x40f15f
lea ecx, [esp + 0x7f4]
call fcn.00411c70
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x7f8]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x4d8]
call fcn.00417b60
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00417b60
lea ecx, [esp + 0x28]
call fcn.00417450
lea ecx, [esp + 0x7c4]
call fcn.00418150
lea ecx, [esp + 0x794]
call fcn.00418150
lea ecx, [esp + 0x7ac]
call fcn.00418150
lea ecx, [esp + 0x1c]
call fcn.00417080
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
jmp 0x40e9d3
lea edx, [esp + 0xae8]
lea ecx, [esp + 0x5c8]
call fcn.00404260
test al, al
jne 0x40f3f8
push 0x4e820c
lea ecx, [esp + 0x834]
call fcn.00415840
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e8220
lea ecx, [esp + 0x708]
call fcn.00415840
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Conversion_of_the_mini_client_MD5_failed.
lea ecx, [esp + 0x674]
call fcn.00412070
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x40f2d2
lea ecx, [esp + 0x704]
call fcn.00415820
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x708]
jmp 0x40f339
cmp eax, 3
jne 0x40f30c
lea ecx, [esp + 0x670]
call fcn.00412030
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x678]
call fcn.00411500
jmp 0x40f33f
lea ecx, [esp + 0x830]
call fcn.00415820
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x834]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x4d8]
call fcn.00417b60
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00417b60
lea ecx, [esp + 0x28]
call fcn.00417450
lea ecx, [esp + 0x7c4]
call fcn.00418150
lea ecx, [esp + 0x794]
call fcn.00418150
lea ecx, [esp + 0x7ac]
call fcn.00418150
lea ecx, [esp + 0x1c]
call fcn.00417080
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
jmp 0x40e9d3
lea ecx, [esp + 0xaf8]
mov esi, 0xc
lea edx, [esp + 0xae8]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40f425
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40f410
xor eax, eax
jmp 0x40f44c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40f447
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40f447
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40f447
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x40f447
xor eax, eax
jmp 0x40f44c
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f4d0
lea eax, [esp + 0xd18]
push eax
lea ecx, [esp + 0x674]
call fcn.00417c50
lea edx, [esp + 0x358]
mov ecx, eax
call fcn.004081c0
lea ecx, [esp + 0x670]
mov bl, al
call fcn.00417b60
test bl, bl
je 0x40f4a3
mov ecx, dword [esp + 0x358]
call fcn.00408330
test al, al
je 0x40f4a3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
mov ecx, dword [esp + 0x5c]
push 1
push 1
lea edx, [esp + 0xd38]
call fcn.00407330
add esp, 0x20
test eax, eax
je 0x40f4f3
lea ecx, [esp + 0x4d8]
call fcn.004179f0
push eax
push 1
mov edx, 1
lea ecx, [esp + 0xd20]
call fcn.004038b0
add esp, 8
lea ecx, [esp + 0x4d8]
call fcn.00417b60
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00417b60
lea ecx, [esp + 0x28]
call fcn.00417450
lea ecx, [esp + 0x7c4]
call fcn.00418150
lea ecx, [esp + 0x794]
call fcn.00418150
lea ecx, [esp + 0x7ac]
call fcn.00418150
lea ecx, [esp + 0x1c]
call fcn.00417080
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
jmp 0x40ed37
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0xd30]
push 1
push 1
call fcn.00407330
add esp, 0x20
test eax, eax
jne 0x40f4d0
lea edx, [esp + 0xd18]
mov ecx, 0x104
call fcn.00409b30
push 0x4e7470
push ecx
mov edx, 6
lea ecx, [esp + 0x850]
call fcn.00405ac0
add esp, 4
lea ecx, [esp + 0x7f8]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x670]
mov edx, eax
call fcn.00405d10
mov ecx, eax
call fcn.004179f0
push eax
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad3f1
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417b60
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
mov ecx, 0x84
jmp 0x40f4b9
lea eax, [esp + 0xc10]
push eax
push str.Unable_to_create_and_write_to_file:__s_n
call fcn.0042aa20
add esp, 8
push 0x10
push 0x4e7a88
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Error1:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x968]
call fcn.00411350
lea ecx, [esp + 0x7dc]
jmp 0x40f187
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x704]
push 0x4e833c
call fcn.00415e70
push 0x4e8354
lea ecx, [esp + 0xa54]
call fcn.004117b0
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e838c
lea ecx, [esp + 0x4dc]
call fcn.00415e70
push 0x4e83a4
lea ecx, [esp + 0xa1c]
call fcn.004117b0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x91c]
call fcn.004116e0
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
lea ecx, [esp + 0x96c]
call fcn.00411d80
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
lea ecx, [esp + 0x3a0]
call fcn.004183d0
lea ecx, [esp + 0x370]
call fcn.004183d0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x40f840
lea ecx, [esp + 0x4d8]
call fcn.00415e50
lea ecx, [esp + 0xa18]
call fcn.00411770
lea ecx, [esp + 0x360]
call fcn.00415fd0
lea ecx, [esp + 0xa18]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x4e0]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x360]
jmp 0x40f9ab
cmp eax, 3
jne 0x40f8ff
lea ecx, [esp + 0x918]
call fcn.004116a0
lea ecx, [esp + 0x968]
call fcn.00411d30
lea ecx, [esp + 0x368]
call fcn.00415f90
lea ecx, [esp + 0x968]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x920]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x368]
call fcn.00411500
jmp 0x40f9b0
lea ecx, [esp + 0x704]
call fcn.00415e50
lea ecx, [esp + 0xa50]
call fcn.00411770
lea ecx, [esp + 0x358]
call fcn.00415fd0
lea ecx, [esp + 0xa50]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x70c]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x358]
call fcn.00411500
push eax
lea ecx, [esp + 0x374]
call fcn.004180f0
push 0x135
lea ecx, [esp + 0x374]
call fcn.00417f60
push eax
lea ecx, [esp + 0x3a8]
call fcn.00417f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
je 0x40fa0d
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00418150
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea eax, [esp + 0xc10]
push eax
call fcn.004acb7f
add esp, 4
call fcn.0040bf80
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x830]
push 0x4e833c
call fcn.00415e70
push 0x4e8354
lea ecx, [esp + 0xa1c]
call fcn.004117b0
push 0x4e7a88
lea ecx, [esp + 0x36c]
call fcn.00415fe0
push 0x4e838c
lea ecx, [esp + 0x708]
call fcn.00415e70
push 0x4e83a4
lea ecx, [esp + 0xa54]
call fcn.004117b0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x91c]
call fcn.004116e0
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
lea ecx, [esp + 0x96c]
call fcn.00411d80
push str.Error
lea ecx, [esp + 0x82c]
call fcn.00415fb0
lea ecx, [esp + 0x3a0]
call fcn.004183d0
lea ecx, [esp + 0x370]
call fcn.004183d0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x40fba7
lea ecx, [esp + 0x704]
call fcn.00415e50
lea ecx, [esp + 0xa50]
call fcn.00411770
lea ecx, [esp + 0x360]
call fcn.00415fd0
lea ecx, [esp + 0xa50]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x70c]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x360]
jmp 0x40fd12
cmp eax, 3
jne 0x40fc66
lea ecx, [esp + 0x918]
call fcn.004116a0
lea ecx, [esp + 0x968]
call fcn.00411d30
lea ecx, [esp + 0x828]
call fcn.00415f90
lea ecx, [esp + 0x968]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x920]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x828]
call fcn.00411500
jmp 0x40fd17
lea ecx, [esp + 0x830]
call fcn.00415e50
lea ecx, [esp + 0xa18]
call fcn.00411770
lea ecx, [esp + 0x368]
call fcn.00415fd0
lea ecx, [esp + 0xa18]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x838]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x368]
call fcn.00411500
push eax
lea ecx, [esp + 0x374]
call fcn.004180f0
push 0x135
lea ecx, [esp + 0x374]
call fcn.00417f60
push eax
lea ecx, [esp + 0x3a8]
call fcn.00417f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
je 0x40fd80
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x3a0]
call fcn.00418150
lea ecx, [esp + 0x4d8]
call fcn.00417b60
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea eax, [esp + 0xc10]
jmp 0x40fa14
push 0x4e84bc
lea ecx, [esp + 0x708]
call fcn.004157b0
push 0x4e7a88
lea ecx, [esp + 0x364]
call fcn.00415fe0
lea ecx, [esp + 0x704]
call fcn.00415790
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
push eax
lea ecx, [esp + 0x70c]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x968]
call fcn.00411350
lea ecx, [esp + 0x7dc]
jmp 0x40f187
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xad8]
lea ecx, [esp + 0x1128]
call fcn.004040c0
test al, al
jne 0x40ff5b
push 0x4e817c
lea ecx, [esp + 0x7f8]
call fcn.00411cb0
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e81a0
lea ecx, [esp + 0x674]
call fcn.00411cb0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Unable_to_open_the_specified_file_to_calculate_its_MD5_hash_value.
lea ecx, [esp + 0x91c]
call fcn.00411bd0
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x40fec6
lea ecx, [esp + 0x670]
call fcn.00411c70
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x674]
jmp 0x40ff40
cmp eax, 3
jne 0x40ff13
lea ecx, [esp + 0x918]
call fcn.00411b80
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x920]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea ecx, [esp + 0x7f4]
call fcn.00411c70
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x7f8]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea edx, [esp + 0xac8]
lea ecx, [esp + 0x598]
call fcn.00404260
test al, al
jne 0x4100ad
push 0x4e8484
lea ecx, [esp + 0x834]
call fcn.00411650
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e8494
lea ecx, [esp + 0x708]
call fcn.00411650
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Conversion_MD5_failed.
lea ecx, [esp + 0x4dc]
call fcn.004115c0
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x410018
lea ecx, [esp + 0x704]
call fcn.00411640
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x708]
jmp 0x410092
cmp eax, 3
jne 0x410065
lea ecx, [esp + 0x4d8]
call fcn.004115a0
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x4e0]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea ecx, [esp + 0x830]
call fcn.00411640
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x834]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea ecx, [esp + 0xad8]
mov esi, 0xc
lea edx, [esp + 0xac8]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4100d5
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4100c0
xor eax, eax
jmp 0x4100fc
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4100f7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4100f7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4100f7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4100f7
xor eax, eax
jmp 0x4100fc
sbb eax, eax
or eax, 1
test eax, eax
je 0x4106d7
lea edx, [esp + 0x1128]
lea ecx, [esp + 0x4d8]
call fcn.00404390
lea edx, [esp + 0x358]
lea ecx, [esp + 0x4d8]
call fcn.004081c0
test al, al
je 0x410149
mov ecx, dword [esp + 0x358]
call fcn.00408330
test al, al
je 0x410149
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
push 1
mov edx, 0x4e7ed8
lea ecx, [esp + 0x464]
call fcn.0041c5a0
mov ecx, dword [esp + 0x844]
lea edx, [esp + 0x1144]
movzx eax, al
push eax
call fcn.00407330
add esp, 0x20
test eax, eax
jne 0x41033c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4e8354
call esi
mov edx, eax
lea ecx, [esp + 0x7f8]
call fcn.004031e0
push eax
mov edx, 0x4e833c
lea ecx, [esp + 0x678]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x3a4]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
push 0x4e7a88
lea ecx, [esp + 0x374]
call fcn.00418270
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x41027a
push 0x4e83a4
call esi
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
mov edx, 0x4e838c
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
push 0x4e7a90
jmp 0x4102f4
cmp eax, 3
jne 0x410300
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
call esi
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
mov edx, str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
push str.Error
lea ecx, [esp + 0x374]
call fcn.004180f0
push 0x135
lea ecx, [esp + 0x374]
call fcn.00417f60
push eax
lea ecx, [esp + 0x3a8]
call fcn.00417f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x40fd50
lea eax, [esp + 0xc10]
jmp 0x40fa14
push str.Released_excat1.exe_successfully._n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x4d8]
call fcn.00417b60
jmp 0x4106d7
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417ca0
push 1
mov edx, 0x4e7ed8
lea ecx, [esp + 0x464]
call fcn.0041c5a0
mov ecx, dword [esp + 0x844]
lea edx, [esp + 0x1144]
movzx eax, al
push eax
call fcn.00407330
add esp, 0x20
test eax, eax
jne 0x4106ca
push 0x4e833c
lea ecx, [esp + 0x708]
call fcn.00415e70
push 0x4e8354
lea ecx, [esp + 0xa1c]
call fcn.004117b0
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e838c
lea ecx, [esp + 0x4dc]
call fcn.00415e70
push 0x4e83a4
lea ecx, [esp + 0xa54]
call fcn.004117b0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x91c]
call fcn.004116e0
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
lea ecx, [esp + 0x96c]
call fcn.00411d80
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
lea ecx, [esp + 0x3a0]
call fcn.004183d0
lea ecx, [esp + 0x370]
call fcn.004183d0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x410511
lea ecx, [esp + 0x4d8]
call fcn.00415e50
lea ecx, [esp + 0xa50]
call fcn.00411770
lea ecx, [esp + 0x360]
call fcn.00415fd0
lea ecx, [esp + 0xa50]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x4e0]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x360]
jmp 0x41067c
cmp eax, 3
jne 0x4105d0
lea ecx, [esp + 0x918]
call fcn.004116a0
lea ecx, [esp + 0x968]
call fcn.00411d30
lea ecx, [esp + 0x368]
call fcn.00415f90
lea ecx, [esp + 0x968]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x920]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x368]
call fcn.00411500
jmp 0x410681
lea ecx, [esp + 0x704]
call fcn.00415e50
lea ecx, [esp + 0xa18]
call fcn.00411770
lea ecx, [esp + 0x358]
call fcn.00415fd0
lea ecx, [esp + 0xa18]
call fcn.00411500
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x70c]
call fcn.00411500
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c630
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bc40
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
lea ecx, [esp + 0x7f4]
call fcn.00418150
lea ecx, [esp + 0x848]
call fcn.00418150
lea ecx, [esp + 0x358]
call fcn.00411500
push eax
lea ecx, [esp + 0x374]
call fcn.004180f0
push 0x135
lea ecx, [esp + 0x374]
call fcn.00417f60
push eax
lea ecx, [esp + 0x3a8]
call fcn.00417f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x40f9e9
lea eax, [esp + 0xc10]
jmp 0x40fa14
push str.Released_excat1.exe_successfully._n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x1330]
call fcn.0040bf50
mov edx, 0x10
lea ecx, [esp + 0x670]
call fcn.00405ac0
push eax
mov ecx, 0x4f3f70
call fcn.004181a0
lea ecx, [esp + 0x670]
call fcn.00418150
mov ecx, 0x4f3f70
call fcn.00417f60
push eax
lea eax, [esp + 0xb0c]
push eax
push str.___file___s____debug__s
lea eax, [esp + 0x1d7c]
push 0x104
push eax
call fcn.0042a9b0
add esp, 0x14
lea eax, [esp + 0x1d70]
mov edx, 1
lea ecx, [esp + 0x1330]
push eax
push 1
call fcn.00403950
add esp, 8
lea ecx, [esp + 0xf20]
call fcn.00404650
test al, al
jne 0x410827
sub esp, 0x18
mov ecx, esp
push 0x4e7a3c
call fcn.00417c50
push 0
mov edx, 0x4e7ed4
lea ecx, [esp + 0x464]
call fcn.0041c8d0
mov ecx, dword [esp + 0x384]
lea edx, [esp + 0xf3c]
movzx eax, al
push eax
call fcn.00407330
add esp, 0x20
test eax, eax
jne 0x410815
push str.release_excat222.exe2333_error__n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x670]
push str.release_excat2.exe_error
call fcn.00411530
push 0x4e7a88
lea ecx, [esp + 0x364]
call fcn.00415fe0
lea ecx, [esp + 0x670]
call fcn.00411510
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
push eax
lea ecx, [esp + 0x678]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f187
push str.run_excat2.exe_ok__n
call fcn.0042aa20
add esp, 4
jmp 0x410952
lea edx, [esp + 0xab8]
lea ecx, [esp + 0xf20]
call fcn.004040c0
test al, al
je 0x40fe24
lea edx, [esp + 0xaa8]
lea ecx, [esp + 0x610]
call fcn.00404260
test al, al
je 0x40ff76
lea ecx, [esp + 0xab8]
mov esi, 0xc
lea edx, [esp + 0xaa8]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x410885
add ecx, 4
add edx, 4
sub esi, 4
jae 0x410870
xor eax, eax
jmp 0x4108ac
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4108a7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4108a7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4108a7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4108a7
xor eax, eax
jmp 0x4108ac
sbb eax, eax
or eax, 1
test eax, eax
je 0x410952
lea edx, [esp + 0xf20]
lea ecx, [esp + 0x370]
call fcn.00404390
lea edx, [esp + 0x358]
lea ecx, [esp + 0x370]
call fcn.004081c0
test al, al
je 0x4108f9
mov ecx, dword [esp + 0x358]
call fcn.00408330
test al, al
je 0x4108f9
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov ecx, esp
push 0x4e7a3c
call fcn.00417c50
push 0
mov edx, 0x4e7ed4
lea ecx, [esp + 0x464]
call fcn.0041c8d0
mov ecx, dword [esp + 0x384]
lea edx, [esp + 0xf3c]
movzx eax, al
push eax
call fcn.00407330
add esp, 0x20
test eax, eax
je 0x410946
push str.Re_released_excat1.exe_due_to_size_mismatch._n
call fcn.0042aa20
add esp, 4
lea ecx, [esp + 0x370]
call fcn.00417b60
lea edx, [esp + 0x1128]
lea ecx, [esp + 0x670]
call fcn.00404390
push eax
mov ecx, 0x4f3f28
call fcn.00417bc0
lea ecx, [esp + 0x670]
call fcn.00417b60
lea eax, [esp + 0x1438]
mov ecx, 0x4f3f40
push eax
call fcn.00417b30
xor ecx, ecx
mov al, byte [esp + ecx + 0xb08]
lea ecx, [ecx + 1]
mov byte [ecx + 0x4f677f], al
test al, al
jne 0x410990
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0xf20]
call fcn.00404650
test al, al
je 0x4109cb
lea ecx, [esp + 0xf20]
call fcn.00407300
mov edx, 0x4e7ed8
lea ecx, [esp + 0x538]
call fcn.0041c5a0
lea ecx, [esp + 0xf20]
mov edx, 1
push 0
push 2
test al, al
je 0x4109f7
call fcn.00403830
jmp 0x4109fc
call fcn.004038b0
add esp, 8
lea ecx, [esp + 0xf20]
call fcn.00404650
test al, al
je 0x410b19
mov edx, 0x4e7ed8
lea ecx, [esp + 0x5f8]
call fcn.0041c5a0
test al, al
je 0x410b19
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0xf20]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call edi
mov esi, eax
test esi, esi
jle 0x410b19
lea ecx, [esp + 0x3f]
call fcn.00411500
push eax
push esi
lea ecx, [esp + 0x70c]
call fcn.00411470
push 0
push 0
push esi
push 0
lea ecx, [esp + 0x714]
call fcn.004113f0
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xf34]
push eax
push 0
push 0
call edi
test eax, eax
jle 0x410b0d
push 1
lea eax, [esp + 0x364]
push eax
lea eax, [esp + 0x360]
push eax
lea ecx, [esp + 0x710]
call fcn.00411400
mov ecx, eax
call fcn.004113e0
mov edi, eax
lea ecx, [esp + 0x704]
lea eax, [esp + 0x368]
push eax
call fcn.00411410
lea ecx, [esp + 0x3f]
mov esi, eax
call fcn.00411500
push eax
push dword [edi]
lea ecx, [esp + 0x378]
push dword [esi]
call fcn.0041cc40
lea ecx, [esp + 0x370]
call fcn.00417f60
mov ecx, eax
call fcn.0040bf50
lea ecx, [esp + 0x370]
call fcn.00418150
lea ecx, [esp + 0x704]
call fcn.00411420
lea ecx, [esp + 0x7dc]
jmp 0x40f512
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_temp_path:_Error__d_n
call fcn.0042aa50
add esp, 8
lea ecx, [esp + 0x7dc]
jmp 0x40f187
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7e3c
call fcn.0042aa20
add esp, 8
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea eax, [esp + 0xc10]
push eax
push str.Unable_to_create_and_write_to_file:__s_n
call fcn.0042aa20
add esp, 8
push 0x10
push 0x4e7a88
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Error1:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x968]
call fcn.00411350
lea ecx, [esp + 0x1f0]
call fcn.004047e0
lea ecx, [esp + 0x3a0]
call fcn.00418150
lea ecx, [esp + 0x2a8]
call fcn.004047e0
lea ecx, [esp + 0xd18]
call fcn.0040bec0
lea ecx, [esp + 0x7dc]
jmp 0x40f187
lea eax, [esp + 0xc10]
push eax
push str.Unable_to_read_from_existing_file:__s_n
call fcn.0042aa20
add esp, 8
push 0x10
push 0x4e7a88
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Error2:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0xd18]
call fcn.0040bec0
lea ecx, [esp + 0x7dc]
jmp 0x40f187
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7e3c
call fcn.0042aa20
add esp, 8
jmp 0x40f1a1
push 0x4e7ff8
lea ecx, [esp + 0x7f8]
call fcn.00411e50
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e802c
lea ecx, [esp + 0x674]
call fcn.00411e50
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push 0x4e8060
lea ecx, [esp + 0x96c]
call fcn.00411d80
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x410cdd
lea ecx, [esp + 0x670]
call fcn.00411e10
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x674]
jmp 0x410d44
cmp eax, 3
jne 0x410d17
lea ecx, [esp + 0x968]
call fcn.00411d30
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x970]
call fcn.00411500
jmp 0x410d4a
lea ecx, [esp + 0x7f4]
call fcn.00411e10
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x7f8]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
call fcn.00417080
lea ecx, [esp + 0x734]
call fcn.00418150
lea ecx, [esp + 0x6ec]
call fcn.00418150
lea ecx, [esp + 0x10]
call fcn.00417080
lea ecx, [esp + 0x74c]
call fcn.00418150
lea ecx, [esp + 0x77c]
call fcn.00418150
lea ecx, [esp + 0x764]
call fcn.00417b60
lea ecx, [esp + 0x71c]
call fcn.00417b60
lea ecx, [esp + 0x640]
call fcn.00418150
lea ecx, [esp + 0x418]
call fcn.00417b60
lea ecx, [esp + 0xd0]
call fcn.00413d30
lea ecx, [esp + 0xd0]
call fcn.00414260
lea ecx, [esp + 0x878]
call fcn.004147c0
lea ecx, [esp + 0x430]
call fcn.00418150
lea ecx, [esp + 0x580]
call fcn.00418150
lea ecx, [esp + 0x598]
call fcn.00418150
lea ecx, [esp + 0x5b0]
call fcn.00418150
lea ecx, [esp + 0x4c0]
call fcn.00418150
lea ecx, [esp + 0x4a8]
call fcn.00418150
lea ecx, [esp + 0x5c8]
call fcn.00418150
lea ecx, [esp + 0x5e0]
call fcn.00418150
lea ecx, [esp + 0x3b8]
call fcn.00417b60
lea ecx, [esp + 0x5f8]
call fcn.00418150
lea ecx, [esp + 0x610]
call fcn.00418150
lea ecx, [esp + 0x448]
call fcn.00418150
lea ecx, [esp + 0x460]
call fcn.00418150
lea ecx, [esp + 0x478]
call fcn.00418150
lea ecx, [esp + 0x508]
call fcn.00418150
lea ecx, [esp + 0x520]
call fcn.00418150
lea ecx, [esp + 0x538]
call fcn.00418150
lea ecx, [esp + 0x490]
call fcn.00418150
lea ecx, [esp + 0x388]
call fcn.00418150
lea ecx, [esp + 0x6a4]
call fcn.00418150
lea ecx, [esp + 0x6bc]
call fcn.00418150
lea ecx, [esp + 0x6d4]
call fcn.00418150
lea ecx, [esp + 0x188]
call fcn.00413d30
lea ecx, [esp + 0x188]
call fcn.00414260
lea ecx, [esp + 0x8c8]
call fcn.004147c0
lea ecx, [esp + 0x550]
call fcn.00418150
lea ecx, [esp + 0x568]
call fcn.00418150
lea ecx, [esp + 0x658]
call fcn.00418150
lea ecx, [esp + 0x4f0]
call fcn.00418150
lea ecx, [esp + 0x3d0]
call fcn.00418150
lea ecx, [esp + 0x3e8]
call fcn.00418150
lea ecx, [esp + 0x628]
call fcn.00418150
lea ecx, [esp + 0x400]
call fcn.00418150
mov ecx, dword [esp + 0x1f84]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049d2bd
mov esp, ebp
pop ebp
ret 0x10
push 0x4e7f5c
lea ecx, [esp + 0x7f8]
call fcn.00411fc0
push 0x4e7a88
lea ecx, [esp + 0x35c]
call fcn.00415fe0
push 0x4e7f7c
lea ecx, [esp + 0x674]
call fcn.00411fc0
push 0x4e7a90
lea ecx, [esp + 0x364]
call fcn.00415fe0
push 0x4e7f9c
lea ecx, [esp + 0x84c]
call fcn.00411f10
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00415fb0
mov eax, dword [0x4f6a84]
cmp eax, 2
jne 0x411042
lea ecx, [esp + 0x670]
call fcn.00411fa0
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
lea ecx, [esp + 0x674]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f1c2
cmp eax, 3
jne 0x411088
lea ecx, [esp + 0x848]
call fcn.00411ed0
lea ecx, [esp + 0x368]
call fcn.00415f90
push 0x10
lea ecx, [esp + 0x36c]
call fcn.00411500
push eax
lea ecx, [esp + 0x850]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f1c2
lea ecx, [esp + 0x7f4]
call fcn.00411fa0
lea ecx, [esp + 0x358]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x35c]
call fcn.00411500
lea ecx, [esp + 0x7f8]
push eax
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f1c2
mov edx, str.Unable_to_open_the_param_file_for_reading.
mov ecx, 0x4f56d0
call fcn.0041c000
push eax
call fcn.0041c820
add esp, 4
lea ecx, [esp + 0x670]
push str.Unable_to_open_the_param_file_for_reading
call fcn.00412070
push 0x4e7a88
lea ecx, [esp + 0x364]
call fcn.00415fe0
lea ecx, [esp + 0x670]
call fcn.00412030
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea eax, [esp + 0x364]
push eax
lea eax, [esp + 0x678]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x410db9
push fcn.0041c820
push ecx
mov edx, str.Unable_to_open_the_param_file_for_reading.
mov ecx, 0x4f56d0
call fcn.0041c000
add esp, 4
mov ecx, eax
call fcn.00416fe0
push str.Unable_to_open_the_versionfile_file_for_reading
lea ecx, [esp + 0x674]
call fcn.00412130
push 0x4e7a88
lea ecx, [esp + 0x364]
call fcn.00415fe0
lea ecx, [esp + 0x670]
call fcn.004120f0
lea ecx, [esp + 0x360]
call fcn.00415fd0
push 0x10
lea ecx, [esp + 0x364]
call fcn.00411500
push eax
lea ecx, [esp + 0x678]
call fcn.00411500
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40c8aa