Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x120
push 0
push 0x411474
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x411478], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x411474], eax
call section..text
call fcn.0040d4a0
call fcn.0040d28c
call fcn.0040b793
call fcn.0040b2c3
call fcn.0040ac70
call fcn.0040a8f9
call fcn.0040a700
call fcn.0040a6e2
call fcn.0040a659
call fcn.00409dc1
call fcn.00408df0
call fcn.00408001
call fcn.00407cc6
call fcn.00407301
call fcn.00406f79
push dword [0x411580]
call fcn.00407ce5
push 7
push 0x41028c
lea eax, [0x411580]
push eax
push 8
call fcn.00407c34
push 0x411578
push 0x41029c
push 7
push 0x401
push 8
call fcn.0040d18d
mov eax, 0x200
push eax
lea eax, [0x411590]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040b7b2
push dword [0x411588]
call fcn.00407ce5
push 7
push 0x410294
lea eax, [0x411588]
push eax
push 8
call fcn.00407c34
mov edx, str.Continue_
lea ecx, [0x41148c]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x411560]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x4114b8]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x41150c]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x411534]
call fcn.00404068
mov edx, 0x410025
lea ecx, [0x411510]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x411490]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x4114a4]
call fcn.00404068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x411508]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x411548]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x411530]
call fcn.00404068
mov edx, str.Password
lea ecx, [0x41154c]
call fcn.00404068
mov edx, str.Please_enter_the_password.
lea ecx, [0x4114d8]
call fcn.00404068
call fcn.00408baf
mov ebx, eax
cmp ebx, 0x32
jge 0x40120f
push 0x10
push dword [0x411548]
push dword [0x411560]
call fcn.00406fb0
jmp 0x40223c
lea eax, [0x403274]
push eax
call fcn.00407a50
call fcn.0040743f
mov dword [0x41153c], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4114e8], eax
mov edx, dword [0x411868]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040a730
push 0x411538
call fcn.0040d520
push dword [0x411538]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x41153c]
and ebx, ebx
jle 0x401378
mov dword [0x4114bc], 0
mov ebx, dword [0x41153c]
dec ebx
cmp ebx, dword [0x4114bc]
jl 0x4012fb
mov edx, dword [0x411868]
push edx
push edx
push dword [0x4114bc]
call fcn.004073f1
push 0x411524
call fcn.0040d520
push dword [0x411524]
mov edx, str._b2epass
pop ecx
call fcn.0040d5a0
je 0x4012bf
mov dword [0x4114b0], 1
jmp 0x4012ef
mov ebx, dword [0x4114b0]
cmp ebx, 1
jne 0x4012ef
mov edx, dword [0x411524]
push dword [0x411868]
call fcn.0040d5d0
push 0x411554
call fcn.0040d520
mov dword [0x4114b0], 0
inc dword [0x4114bc]
jno 0x401274
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040a730
inc dword [0x411868]
mov edx, dword [0x410354]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x411868]
push eax
call fcn.0040a730
push 0x4114dc
call fcn.0040d520
mov edx, dword [0x411538]
push dword [0x411868]
call fcn.0040d5d0
mov edx, 0x41001f
call fcn.0040d5d0
mov edx, dword [0x4114dc]
call fcn.0040d5d0
push 0x4114dc
call fcn.0040d520
jmp 0x401393
mov edx, dword [0x411538]
push dword [0x411868]
call fcn.0040d5d0
push 0x4114dc
call fcn.0040d520
push 0x410087
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x4013be
mov eax, dword [0x411480]
mov dword [0x41151c], eax
push dword [0x41151c]
call fcn.004032be
jmp 0x4013de
push 0x10
push dword [0x411508]
push dword [0x411560]
call fcn.00406fb0
push 1
jmp 0x402241
push str.NOPSX
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x401417
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411494]
push dword [0x411480]
call fcn.0040a780
push 0x411504
call fcn.0040d520
jmp 0x401437
push 0x10
push dword [0x411508]
push dword [0x411560]
call fcn.00406fb0
push 1
jmp 0x402241
push 0x41006e
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x40146b
mov eax, dword [0x411480]
mov dword [0x4114c0], eax
mov eax, dword [0x411494]
mov dword [0x411484], eax
mov eax, dword [0x4114c0]
mov dword [0x411544], eax
jmp 0x40148b
push 0x10
push dword [0x411508]
push dword [0x411560]
call fcn.00406fb0
push 1
jmp 0x402241
push 0x410074
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x4014bd
mov eax, dword [0x411480]
mov dword [0x4114c8], eax
mov eax, dword [0x411494]
mov dword [0x4114d0], eax
mov eax, dword [0x4114c8]
mov dword [0x411518], eax
push 0x410072
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x4014ef
mov eax, dword [0x411480]
mov dword [0x4114c4], eax
mov eax, dword [0x411494]
mov dword [0x411488], eax
mov eax, dword [0x4114c4]
mov dword [0x411564], eax
push 0x410089
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x401787
mov edx, dword [0x411554]
xor ecx, ecx
call fcn.0040d5a0
jne 0x401536
mov edx, dword [0x411554]
push dword [0x411868]
call fcn.0040d5d0
push 0x41152c
call fcn.0040d520
jmp 0x4016aa
push 0xc80001
push dword [0x41154c]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00409100
push dword [0x4114d8]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.004082e3
push 0x20
push 0x41001e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.004084bc
push 0x410210
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.004087c9
push 4
push 0xd
push 0
call fcn.00409123
push 2
call fcn.004087e9
call fcn.00409327
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401616
push dword [0x41155c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402241
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x40165e
call fcn.0040b38c
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40165b
mov edx, dword [0x411868]
push edx
push edx
push 2
call fcn.00408824
push 0x41152c
call fcn.0040d520
push 0
call fcn.00408cc3
add esp, 8
jmp 0x4016aa
pop eax
jmp 0x4016a4
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4016a4
call fcn.0040b39b
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4016a3
mov edx, dword [0x411868]
push edx
push edx
push 2
call fcn.00408824
push 0x41152c
call fcn.0040d520
push 0
call fcn.00408cc3
add esp, 8
jmp 0x4016aa
pop eax
pop eax
jmp 0x4015ec
mov edx, dword [0x411868]
push edx
push edx
push dword [0x41152c]
call fcn.004040d0
push eax
mov eax, dword [0x41152c]
push eax
call fcn.0040bd70
inc dword [0x411868]
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411494]
push dword [0x411480]
call fcn.0040a780
pop edx
pop ecx
mov dword [0x411868], ecx
add ecx, dword [0x410354]
add edx, dword [0x410354]
call fcn.0040d5a0
jne 0x40172e
push 0x10
push dword [0x411534]
push dword [0x411560]
call fcn.00406fb0
push dword [0x41155c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x402241
push 0x41008b
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x40174c
mov eax, dword [0x411480]
mov dword [0x411540], eax
push dword [0x411488]
push dword [0x4114d0]
push dword [0x411484]
push dword [0x411540]
push dword [0x4114c4]
push dword [0x4114c8]
push dword [0x4114c0]
push dword [0x41152c]
push dword [0x4114e8]
call fcn.00403c4f
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411484]
push dword [0x411544]
call fcn.0040a780
push 0x411500
call fcn.0040d520
mov edx, dword [0x411868]
push edx
push edx
push dword [0x4114d0]
push dword [0x411518]
call fcn.0040a780
push 0x4114a8
call fcn.0040d520
push 0x410070
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x401a45
mov edx, dword [0x411868]
push edx
push edx
push 0
call fcn.004073f1
inc dword [0x411868]
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411494]
push dword [0x411480]
call fcn.0040a780
pop edx
pop ecx
mov dword [0x411868], ecx
add ecx, dword [0x410354]
add edx, dword [0x410354]
call fcn.0040d5a0
je 0x401843
mov ebx, dword [0x41153c]
cmp ebx, 1
jne 0x401843
mov eax, 1
jmp 0x401845
xor eax, eax
and eax, eax
je 0x401a45
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
call fcn.0040a905
inc dword [0x411868]
push dword [0x411530]
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.00407023
push 0x4114a0
call fcn.0040d520
mov edx, dword [0x4114a0]
xor ecx, ecx
call fcn.0040d5a0
jne 0x4019f3
mov edx, dword [0x4114a0]
push dword [0x411868]
call fcn.0040d5d0
push 0x4114f8
call fcn.0040d520
push dword [0x4114f8]
call fcn.0040a945
mov edx, dword [0x4114a8]
xor ecx, ecx
call fcn.0040d5a0
jne 0x4018da
push dword [0x4114a8]
call fcn.004033ec
push dword [0x411504]
push 1
call fcn.0040aee0
and eax, eax
je 0x4019c5
push 1
call fcn.0040abf0
push dword [0x411868]
push 0x24
mov edx, dword [0x411490]
push dword [0x411868]
call fcn.0040d5d0
mov edx, 0x410021
call fcn.0040d5d0
mov edx, dword [0x411504]
call fcn.0040d5d0
mov edx, 0x410021
call fcn.0040d5d0
mov edx, dword [0x4114a4]
call fcn.0040d5d0
inc dword [0x411868]
push dword [0x411510]
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.00406fb0
pop dword [0x411868]
mov dword [0x4114fc], eax
mov ebx, dword [0x4114fc]
cmp ebx, 7
jne 0x4019c5
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call fcn.00407452
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a957
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a945
pop dword [0x411868]
push dword [0x41155c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402241
push dword [0x411504]
push 1
call fcn.0040ae10
and eax, eax
je 0x4019f3
push dword [0x411500]
push 1
call fcn.0040af90
push 1
call fcn.0040abf0
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call fcn.00407452
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a957
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a945
pop dword [0x411868]
push dword [0x41155c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402241
push 0x41008d
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x401b81
push 0x400
call fcn.0040a820
mov dword [0x4114e0], eax
mov edx, dword [0x411868]
push edx
push edx
call fcn.0040a9cd
push 0x41156c
call fcn.0040d520
push dword [0x4114e0]
push 0
push 0x41001e
push dword [0x41156c]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x411868]
push edx
push edx
push dword [0x4114e0]
call fcn.0040a730
push 0x411558
call fcn.0040d520
push dword [0x4114e0]
call fcn.0040a840
push dword [0x411558]
call fcn.0040aa5c
push dword [0x411558]
call fcn.0040aa6a
push dword [0x411558]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x411558]
push dword [0x411868]
call fcn.0040d5d0
mov edx, str.extd.exe
call fcn.0040d5d0
push 0x4114f4
call fcn.0040d520
push dword [0x4114f4]
push 0
call fcn.0040ae10
push dword [0x411494]
push dword [0x411480]
push 0
call fcn.0040b010
push 0
call fcn.0040abf0
mov edx, dword [0x4114f4]
push dword [0x411868]
call fcn.0040d5d0
push 0x4114ec
call fcn.0040d520
push dword [0x4114ec]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x4114ec]
push str.b2eextd
call fcn.004074ad
push str._call:extd
push str.extd
call fcn.004074ad
mov edx, dword [0x41155c]
push dword [0x411868]
call fcn.0040d5d0
mov edx, str.BDFI
call fcn.0040d5d0
mov edx, dword [0x411504]
call fcn.0040d5d0
push 0x411504
call fcn.0040d520
push dword [0x411504]
push 1
call fcn.0040ae10
and eax, eax
je 0x401d60
push str._shift__0
push 1
call fcn.0040b070
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040a730
inc dword [0x411868]
mov edx, dword [0x410354]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x411868]
push eax
call fcn.0040a730
inc dword [0x411868]
push 0x41008f
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.004074ad
pop dword [0x411868]
push dword [0x411500]
push 1
call fcn.0040b070
push 0x41008d
push dword [0x4114e8]
call fcn.00403b3c
and eax, eax
je 0x401d54
mov edx, dword [0x411868]
push edx
push edx
mov ebp, 0x410351
mov ebx, ebp
mov ebp, 0x4102a4
sub ebx, ebp
push ebx
mov ebp, 0x4102a4
push ebp
call fcn.0040a780
push 0x4114cc
call fcn.0040d520
push dword [0x4114cc]
call fcn.004040d0
mov dword [0x4114e4], eax
push dword [0x4114e4]
call fcn.0040a820
mov dword [0x4114f0], eax
push dword [0x4114e4]
call fcn.0040a820
mov dword [0x4114d4], eax
push dword [0x4114cc]
push dword [0x4114f0]
call fcn.0040a860
mov dword [0x4114bc], 0
mov eax, dword [0x4114e4]
cmp eax, dword [0x4114bc]
jl 0x401d1b
mov ebx, dword [0x4114f0]
add ebx, dword [0x4114bc]
mov eax, ebx
call fcn.0040a890
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x4114d4]
add ebx, dword [0x4114bc]
mov eax, ebx
call fcn.0040a8a0
inc dword [0x4114bc]
jno 0x401cda
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
push dword [0x4114d4]
call fcn.0040a730
inc dword [0x411868]
push 1
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.0040b070
pop dword [0x411868]
push 1
call fcn.0040abf0
jmp 0x401d9b
push dword [0x411504]
call fcn.0040aa5c
call fcn.00403efc
push 0x10
push dword [0x411508]
push dword [0x411560]
call fcn.00406fb0
push dword [0x41155c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x402241
mov edx, dword [0x4114a8]
xor ecx, ecx
call fcn.0040d5a0
jne 0x401db5
push dword [0x4114a8]
call fcn.004033ec
push 0x400
call fcn.0040a820
mov dword [0x411550], eax
mov edx, dword [0x411868]
push edx
push edx
call fcn.0040a9cd
push 0x41149c
call fcn.0040d520
push dword [0x411550]
push 0
push 0x41001e
push dword [0x41149c]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411550]
call fcn.0040a730
push 0x411568
call fcn.0040d520
mov edx, dword [0x411868]
push edx
push edx
push 0x800
call fcn.00404100
push 0x411520
call fcn.0040d520
push dword [0x411868]
push 0x800
push dword [0x411520]
mov edx, dword [0x411868]
push edx
push edx
call fcn.00407452
inc dword [0x411868]
mov edx, dword [0x410354]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x411868]
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call fcn.00407452
inc dword [0x411868]
push str.b2eprogramname
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.004074ad
pop dword [0x411868]
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call fcn.00407452
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040ab88
inc dword [0x411868]
push str.b2eprogramfilename
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.004074ad
pop dword [0x411868]
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call fcn.00407452
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a957
inc dword [0x411868]
push str.b2eprogrampathname
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.004074ad
pop dword [0x411868]
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
push dword [0x411520]
call fcn.00404200
inc dword [0x411868]
push str.b2eprogramshortname
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.004074ad
pop dword [0x411868]
mov edx, dword [0x4114f8]
push dword [0x411868]
call fcn.0040d5d0
push 0x411574
call fcn.0040d520
push dword [0x411574]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x411574]
push 0x410076
call fcn.004074ad
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
mov eax, dword [0x411498]
cdq
push edx
push eax
call fcn.00404390
inc dword [0x411868]
push str.b2eincfilecount
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.004074ad
pop dword [0x411868]
push dword [0x411568]
push str.b2etempfile
call fcn.004074ad
call fcn.00403b08
and eax, eax
je 0x402056
mov edx, dword [0x411868]
push edx
push edx
push 0x800
call fcn.00404100
push 0x411570
call fcn.0040d520
push 0x800
push dword [0x411570]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [0x411570]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x411570]
push dword [0x411868]
call fcn.0040d5d0
mov edx, str.sysnative
call fcn.0040d5d0
push 0x411570
call fcn.0040d520
push dword [0x411570]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x411504]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x411504]
push dword [0x411868]
call fcn.0040d5d0
mov edx, 0x41001f
call fcn.0040d5d0
mov edx, dword [0x4114dc]
call fcn.0040d5d0
push 0x4114dc
call fcn.0040d520
push dword [0x4114dc]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
call fcn.00408baf
mov ebx, eax
cmp ebx, 0x41
jne 0x4020fb
push dword [0x411868]
push 0x44
push dword [0x4114f8]
push dword [0x411868]
mov edx, 0x4100c7
call fcn.0040d5d0
mov edx, dword [0x4114dc]
call fcn.0040d5d0
inc dword [0x411868]
push 0x41010c
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.00407929
pop dword [0x411868]
mov dword [0x411514], eax
jmp 0x40216b
push dword [0x411868]
push 0x44
push dword [0x4114f8]
push dword [0x411868]
mov edx, 0x4100c7
call fcn.0040d5d0
mov edx, dword [0x4114dc]
call fcn.0040d5d0
inc dword [0x411868]
mov edx, dword [0x411570]
push dword [0x411868]
call fcn.0040d5d0
mov edx, 0x41010c
call fcn.0040d5d0
mov edx, dword [0x410354]
add dword [esp], edx
mov edx, dword [0x410354]
add dword [esp + 4], edx
call fcn.00407929
pop dword [0x411868]
mov dword [0x411514], eax
push dword [0x411514]
call fcn.00407943
mov ebx, eax
and ebx, ebx
jne 0x40217e
jmp 0x40218a
push 5
call fcn.00408ca2
jmp 0x40216b
push dword [0x411514]
call fcn.0040798a
push dword [0x411514]
call fcn.0040799b
mov dword [0x4114b4], eax
push dword [0x411514]
call fcn.004079b9
call fcn.00403efc
push dword [0x411504]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x411504]
call fcn.0040aa5c
push dword [0x411568]
call fcn.0040aa5c
push dword [0x4114f4]
call fcn.0040aa5c
mov edx, dword [0x411868]
push edx
push edx
mov edx, dword [0x411868]
push edx
push edx
push dword [0x411868]
call fcn.00407452
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a957
mov edx, dword [0x410354]
add dword [esp], edx
call fcn.0040a945
pop dword [0x411868]
push dword [0x411558]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x41155c]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x4114b4]
jmp 0x402241
push 0
call 0x40225b
call fcn.0040d4f0
push dword [0x411474]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00407ba0
call fcn.00408071
call fcn.00408dd9
call fcn.00409e4f
call fcn.0040a64d
call fcn.0040ab9a
call fcn.0040ac60
call fcn.0040b68e
call fcn.0040a720
ret