Function at 0x43c6fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x471080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movups xmm1, xmmword [eax]
xor ebx, ebx
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [ebp - 0x5c], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movd esi, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x68]
movd edx, xmm0
imul edi, esi, 0x4008
mov dword [0x4934a4], eax
imul ecx, edx, 0x4008
movd eax, xmm1
mov dword [ebp - 0x2d0], ebx
add edi, section..ndata
add eax, 0xfffffffe
mov dword [ebp - 0x2c4], edi
add ecx, section..ndata
mov dword [ebp - 0x2c0], ecx
movups xmmword [ebp - 0x6c], xmm1
cmp eax, 0x3a
ja case.0x43bd92.8
jmp dword [eax*4 + 0x43d590]
push esi
push str.Jump:__d
call fcn.0043abb0
mov eax, dword [ebp - 0x68]
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push esi
push 0x4934a8
call fcn.0043a530
push eax
push str.Aborting:___s_
call fcn.0043abb0
add esp, 8
push 0
push dword [ebp - 0x68]
call fcn.0043bb30
pop edi
pop esi
mov eax, closesocket
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
inc dword [0x4a88b0]
mov eax, closesocket
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0043d860
lea esi, [eax - 1]
push esi
push str.Call:__d
call fcn.0043abb0
add esp, 8
push 0
push esi
call fcn.0043bc30
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push esi
push 0x4934a8
call fcn.0043a530
push eax
push str.detailprint:__s
call fcn.0043abb0
add esp, 8
push 0
push dword [ebp - 0x68]
call fcn.0043bb30
jmp case.0x43bd92.8
push 0
call fcn.0043d6b0
mov esi, eax
push esi
push str.Sleep__d_
call fcn.0043abb0
add esp, 8
mov ecx, 1
cmp esi, ecx
cmovg ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x43bd92.8
cmp dword [ebp - 0x60], ebx
jne 0x43bec6
mov eax, dword [esi*4 + 0x4a8860]
push 1
mov dword [esi*4 + 0x4a8820], eax
call fcn.0043d6b0
mov ecx, dword [ebp - 0x68]
mov dword [ecx*4 + 0x4a8860], eax
jmp case.0x43bd92.8
mov eax, dword [esi*4 + 0x4a8820]
mov dword [esi*4 + 0x4a8860], eax
jmp case.0x43bd92.8
mov ecx, dword [ebp - 0x60]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*4 + 0x4a8860]
mov eax, edx
and eax, dword [ebp - 0x5c]
mov dword [ecx*4 + 0x4a8860], eax
xor eax, eax
test edx, edx
mov ecx, 4
cmove eax, ecx
mov eax, dword [ebp + eax - 0x68]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push dword [edx*4 + 0x4a8860]
push edi
call fcn.0043b420
jmp case.0x43bd92.8
push esi
push 0x4974b0
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push dword [ebp - 0x64]
push esi
push str.SetFileAttributes:___s_:_08X
call fcn.0043abb0
add esp, 0xc
push dword [ebp - 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x43bd92.8
push str.SetFileAttributes_failed.
lea ebx, [eax + 1]
call fcn.0043abb0
add esp, 4
jmp 0x43d575
push esi
push 0x4974b0
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push dword [ebp - 0x64]
push esi
push str.CreateDirectory:___s____d_
call fcn.0043abb0
add esp, 0xc
push esi
call fcn.0043b480
mov edi, eax
test edi, edi
je 0x43c031
push 0x5c
push edi
call fcn.0043a9e0
mov edi, eax
movzx eax, word [edi]
mov dword [ebp - 0x2c4], eax
xor eax, eax
push eax
push esi
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43c008
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43bfec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.0043abb0
add esp, 0xc
inc ebx
jmp 0x43c016
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x43c016
push esi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.0043abb0
add esp, 8
inc ebx
jmp 0x43c016
push esi
push str.CreateDirectory:___s__created
call fcn.0043abb0
add esp, 8
mov eax, dword [ebp - 0x2c4]
mov word [edi], ax
add edi, 2
test ax, ax
jne 0x43bfa3
mov dword [ebp - 0x2d0], ebx
cmp dword [ebp - 0x64], 0
push 0x4974b0
je 0x43c060
push 0xffffffffffffffe6
call fcn.0043bb30
push esi
push 0x5160b0
call fcn.0043b450
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 0x2d0]
jmp 0x43d575
push 0xfffffffffffffff5
call fcn.0043bb30
mov ebx, dword [ebp - 0x2d0]
jmp 0x43d575
push esi
push 0x4934a8
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043a9b0
test eax, eax
je 0x43c0b0
push dword [ebp - 0x64]
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.0043abb0
mov eax, dword [ebp - 0x64]
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x60]
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.0043abb0
mov eax, dword [ebp - 0x60]
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push esi
push 0x49f4c0
call fcn.0043a530
mov edi, eax
push edi
call fcn.0043b550
mov ecx, dword [0x4934a4]
push dword [ecx + 4]
push 0x49b4b8
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
mov ecx, dword [0x4934a4]
push dword [ecx + 0xc]
push 0x4974b0
call fcn.0043a530
push eax
push str.Rename:__s
mov dword [ebp - 0x2c4], eax
call fcn.0043abb0
add esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x43c149
push 0x4974b0
push 0xffffffffffffffe3
call fcn.0043bb30
jmp case.0x43bd92.8
push dword [ebp - 0x2c4]
mov ebx, 1
push str.Rename_failed:__s
call fcn.0043abb0
add esp, 8
jmp 0x43d575
push esi
push 0x4934a8
call fcn.0043a530
mov esi, dword [ebp - 0x2c0]
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push 0x2004
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x43c19d
xor eax, eax
mov ebx, 1
mov word [esi], ax
jmp 0x43c1c7
mov eax, dword [ebp - 0x2c8]
cmp eax, edi
jbe 0x43c1c5
cmp word [eax], bx
je 0x43c1c5
push edi
call fcn.0043a9b0
test eax, eax
je 0x43c191
add eax, 0x2c
push eax
push dword [ebp - 0x2c8]
call fcn.0043b450
xor ebx, ebx
cmp dword [ebp - 0x60], 0
jne 0x43d575
push 0x2004
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x43d575
push edx
push 0x4934a8
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
lea eax, [ebp - 8]
push eax
push edi
push 0x2004
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x43bd92.8
xor eax, eax
mov ebx, 1
mov word [edi], ax
jmp 0x43d575
push edx
push 0x4974b0
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push esi
push edi
call fcn.0043b230
test eax, eax
jne case.0x43bd92.8
mov ebx, 1
jmp 0x43d575
push esi
push 0x4934a8
call fcn.0043a530
mov esi, eax
push esi
push str.Delete:___s_
call fcn.0043abb0
add esp, 8
push dword [ebp - 0x64]
push esi
call fcn.0043ae60
jmp case.0x43bd92.8
push edx
push 0x49f4c0
call fcn.0043a530
mov esi, eax
push esi
push dword [ebp - 0x68]
push str.MessageBox:__d___s_
call fcn.0043abb0
add esp, 0xc
push dword [ebp - 0x68]
push esi
call fcn.0043b2c0
test eax, eax
je 0x43c244
cmp eax, dword [ebp - 0x60]
je 0x43c479
cmp eax, dword [ebp - 0x58]
jne case.0x43bd92.8
mov eax, dword [ebp - 0x54]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push esi
push 0x4974b0
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push esi
push str.RMDir:___s_
jmp 0x43c261
push edx
push 0x4934a8
call fcn.0043a530
push eax
call fcn.0043b470
push eax
push edi
call fcn.0043b420
jmp case.0x43bd92.8
push 2
call fcn.0043d6b0
push 3
mov esi, eax
call fcn.0043d6b0
mov ecx, dword [0x4934a4]
mov ebx, eax
push dword [ecx + 4]
push 0x4934a8
call fcn.0043a530
xor ecx, ecx
mov dword [ebp - 0x2c4], eax
mov word [edi], cx
cmp dword [ebp - 0x60], ecx
je 0x43c342
test esi, esi
je case.0x43bd92.8
push eax
call fcn.0043b470
test ebx, ebx
jns 0x43c354
add ebx, eax
js case.0x43bd92.8
cmp ebx, eax
cmovg ebx, eax
mov eax, dword [ebp - 0x2c4]
lea eax, [eax + ebx*2]
push eax
push edi
call fcn.0043b450
test esi, esi
je case.0x43bd92.8
jns 0x43c37b
push edi
call fcn.0043b470
add esi, eax
xor eax, eax
test esi, esi
cmovns eax, esi
cmp eax, 0x2004
jge case.0x43bd92.8
xor ecx, ecx
mov word [edi + eax*2], cx
jmp case.0x43bd92.8
push esi
push 0x49b4b8
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov esi, eax
push dword [ecx + 4]
push 0x49f4c0
call fcn.0043a530
push eax
push esi
cmp dword [ebp - 0x58], ebx
jne 0x43c3e3
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43c479
mov eax, dword [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x43c3c5
push edx
push 0x4934a8
call fcn.0043a530
push 0x2004
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43c41a
cmp dword [ebp - 0x60], ebx
je 0x43c430
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43c430
xor eax, eax
mov ebx, 1
mov word [edi], ax
mov word [edi + 0x4006], ax
jmp 0x43d575
xor ebx, ebx
xor eax, eax
mov word [edi + 0x4006], ax
jmp 0x43d575
push 0
call fcn.0043d6b0
push 1
mov esi, eax
call fcn.0043d6b0
cmp dword [ebp - 0x54], ebx
jne 0x43c475
cmp esi, eax
jl 0x43c479
jle 0x43c3cd
mov eax, dword [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
cmp esi, eax
jae 0x43c48f
mov eax, dword [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
jbe 0x43c3cd
mov eax, dword [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
push 1
call fcn.0043d6b0
push 2
mov esi, eax
call fcn.0043d6b0
mov ecx, eax
mov eax, dword [ebp - 0x5c]
cmp eax, 0xc
ja case.default.0x43c4c9
jmp dword [eax*4 + 0x43d67c]
add esi, ecx
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
sub esi, ecx
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
imul esi, ecx
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
test ecx, ecx
je 0x43c51a
mov eax, esi
xor ebx, ebx
cdq
idiv ecx
mov esi, eax
push esi
push edi
call fcn.0043b420
jmp 0x43d575
xor esi, esi
push esi
push edi
lea ebx, [esi + 1]
call fcn.0043b420
jmp 0x43d575
or esi, ecx
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
and esi, ecx
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
xor esi, ecx
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
xor eax, eax
test esi, esi
sete al
xor ebx, ebx
mov esi, eax
push esi
push edi
call fcn.0043b420
jmp 0x43d575
test esi, esi
jne 0x43c592
test ecx, ecx
jne 0x43c592
xor esi, esi
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
test esi, esi
je 0x43c57a
test ecx, ecx
je 0x43c57a
mov esi, 1
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
test ecx, ecx
je 0x43c51a
mov eax, esi
xor ebx, ebx
cdq
idiv ecx
mov esi, edx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
shl esi, cl
xor ebx, ebx
push esi
push edi
call fcn.0043b420
jmp 0x43d575
sar esi, cl
push esi
push edi
xor ebx, ebx
call fcn.0043b420
jmp 0x43d575
push edx
push 0x4934a8
call fcn.0043a530
push 2
mov esi, eax
call fcn.0043d6b0
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp case.0x43bd92.8
mov ecx, dword [ebp - 0x60]
mov eax, ecx
mov esi, dword [0x4934a0]
test eax, eax
je 0x43c694
dec eax
test esi, esi
je 0x43c65a
mov esi, dword [esi]
test eax, eax
jne 0x43c616
test esi, esi
je 0x43c65a
add esi, 4
push esi
push 0x4934a8
call fcn.0043b450
mov eax, dword [0x4934a0]
add eax, 4
push eax
push esi
call fcn.0043b450
mov eax, dword [0x4934a0]
push 0x4934a8
add eax, 4
push eax
call fcn.0043b450
jmp case.0x43bd92.8
push ecx
push str.Exch:_stack____d_elements
call fcn.0043abb0
add esp, 8
push 0x200010
push 0xffffffffffffffe8
push 0
call fcn.0043a530
push eax
call fcn.0043b2c0
pop edi
pop esi
mov eax, closesocket
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4
test edx, edx
je 0x43c6ce
test esi, esi
jne 0x43c6b1
push str.Pop:_stack_empty
call fcn.0043abb0
add esp, 4
lea ebx, [esi + 1]
jmp 0x43d575
lea eax, [esi + 4]
push eax
push edi
call fcn.0043b450
mov eax, dword [esi]
push esi
mov dword [0x4934a0], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x43bd92.8
push 0x400c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp - 0x68]
mov esi, eax
lea ecx, [esi + 4]
push ecx
call fcn.0043a530
mov ecx, dword [0x4934a0]
mov dword [esi], ecx
mov dword [0x4934a0], esi
jmp case.0x43bd92.8
push esi
push 0x4934a8
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov esi, eax
push dword [ecx + 4]
push 0x49f4c0
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov ebx, eax
push dword [ecx + 8]
push 0x49b4b8
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov edi, eax
push dword [ecx + 0x14]
push 0x4974b0
call fcn.0043a530
push 0x4974b0
push 0xffffffffffffffec
call fcn.0043bb30
push dword [ebp - 0x5c]
xor eax, eax
cmp word [edi], ax
push 0x5160b0
cmovne eax, edi
push eax
xor eax, eax
cmp word [esi], ax
push ebx
cmovne eax, esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
jge 0x43c795
push eax
push edi
push ebx
push esi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.0043abb0
add esp, 0x14
mov ebx, 1
jmp 0x43d575
push edi
push ebx
push esi
push str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.0043abb0
add esp, 0x10
jmp case.0x43bd92.8
push esi
push 0x4934a8
call fcn.0043a530
mov esi, eax
push esi
push str.Exec:_command__s_
call fcn.0043abb0
add esp, 8
push esi
push 0xffffffffffffffeb
call fcn.0043bb30
push esi
call fcn.0043ae00
mov edi, eax
push esi
test edi, edi
je 0x43c872
push str.Exec:_success____s__
call fcn.0043abb0
add esp, 8
cmp dword [ebp - 0x60], ebx
je 0x43c860
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push edi
call esi
cmp eax, 0x102
jne 0x43c815
push 0xf
call fcn.0043a8a0
push 0x64
push edi
call esi
cmp eax, 0x102
je 0x43c802
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x64], ebx
jl 0x43c84c
push dword [ebp - 0x2c8]
mov esi, dword [ebp - 0x2c0]
push esi
call fcn.0043b420
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2d0]
jmp 0x43d575
cmp dword [ebp - 0x2c8], ebx
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x2d0], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2d0]
jmp 0x43d575
push str.Exec:_failed_createprocess____s__
mov ebx, 1
call fcn.0043abb0
add esp, 8
jmp 0x43d575
push dword [ebp - 0x60]
push 0x4934a8
call fcn.0043a530
push eax
call fcn.0043a9b0
mov esi, dword [ebp - 0x2c0]
mov ebx, eax
test ebx, ebx
je 0x43c8bf
push dword [ebx + 0x14]
push esi
call fcn.0043b420
push dword [ebx + 0x18]
push edi
call fcn.0043b420
jmp case.0x43bd92.8
xor eax, eax
mov word [edi], ax
mov word [esi], ax
lea ebx, [eax + 1]
jmp 0x43d575
push dword [ebp - 0x60]
push 0x4974b0
call fcn.0043a530
mov ebx, eax
push ebx
mov dword [ebp - 0x2d4], ebx
call fcn.0043b550
lea eax, [ebp - 8]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, dword [ebp - 0x2c0]
xor ecx, ecx
mov word [edi], cx
mov dword [ebp - 0x2c4], eax
mov word [esi], cx
lea ebx, [ecx + 1]
test eax, eax
je 0x43d575
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2c0], eax
test eax, eax
je 0x43d575
push eax
push dword [ebp - 0x2c4]
push 0
push dword [ebp - 0x2d4]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43c984
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0x463f74
push dword [ebp - 0x2c0]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43c984
mov eax, dword [ebp - 0x2c8]
push dword [eax + 8]
push edi
call fcn.0043b420
mov eax, dword [ebp - 0x2c8]
push dword [eax + 0xc]
push esi
call fcn.0043b420
xor ebx, ebx
push dword [ebp - 0x2c0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x43d575
push esi
push 0x4934a8
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov esi, eax
push dword [ecx + 4]
push 0x4974b0
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov edi, eax
push dword [ecx + 0xc]
push 0x49b4b8
call fcn.0043a530
push edi
push esi
push str.CopyFiles___s_____s_
mov ebx, eax
call fcn.0043abb0
add esp, 0xc
push esi
call fcn.0043a9b0
test eax, eax
je 0x43ca4c
push esi
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 2
call fcn.0043b470
xor ecx, ecx
push edi
mov word [esi + eax*2 + 2], cx
call fcn.0043b470
xor ecx, ecx
push ebx
push ecx
mov word [edi + eax*2 + 2], cx
mov ax, word [ebp - 0x60]
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], edi
mov dword [ebp - 0x2da], ebx
mov word [ebp - 0x2e4], ax
call fcn.0043bb30
lea eax, [ebp - 0x2f4]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x43bd92.8
push 0
push 0xfffffffffffffff9
call fcn.0043bb30
mov ebx, 1
jmp 0x43d575
push str._RM_
xor ebx, ebx
xor edi, edi
push 0x4974b0
mov dword [ebp - 0x2c8], ebx
call fcn.0043b450
push 0x4974b0
push 0x49b4b8
call fcn.0043b450
cmp dword [ebp - 0x68], ebx
je 0x43ca9f
mov eax, dword [0x4934a4]
push dword [eax]
push 0x4934a8
call fcn.0043a530
mov edi, eax
cmp dword [ebp - 0x64], ebx
je 0x43cab9
mov ecx, dword [0x4934a4]
push dword [ecx + 4]
push 0x4974b0
call fcn.0043a530
mov ebx, eax
cmp dword [ebp - 0x58], 0
je 0x43cad8
mov ecx, dword [0x4934a4]
push dword [ecx + 8]
push 0x49b4b8
call fcn.0043a530
mov dword [ebp - 0x2c8], eax
mov ecx, dword [0x4934a4]
push dword [ecx + 0xc]
push 0x49f4c0
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push esi
push 0x49b4b8
push 0x4974b0
push 0x4934a8
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.0043abb0
add esp, 0x14
push esi
push dword [ebp - 0x2c8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne case.0x43bd92.8
lea ebx, [eax + 1]
jmp 0x43d575
mov eax, dword [0x45d0b8]
push edx
mov dword [ebp - 0xc], eax
mov eax, dword [0x45d0bc]
push 0x4934a8
mov dword [ebp - 8], eax
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov ebx, eax
push dword [ecx + 8]
push 0x4974b0
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov edi, eax
push dword [ecx + 0xc]
push 0x49b4b8
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push esi
mov esi, dword [ebp - 0x2c4]
lea eax, [ebp - 0xc]
push 0x2003
push esi
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.0x43bd92.8
lea ebx, [eax + 1]
mov word [esi], ax
jmp 0x43d575
push edx
mov edi, 1
call fcn.0043a8f0
add esp, 4
mov ebx, eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 0x2c4], ebx
jne 0x43cc2b
push 2
call fcn.0043d800
mov ebx, eax
test ebx, ebx
je 0x43cc71
mov ecx, dword [0x4934a4]
push dword [ecx + 0xc]
push 0x49f4c0
call fcn.0043a530
mov esi, eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push 0x49b4b8
push dword [ebp - 0x2c4]
mov edi, eax
push str.DeleteRegValue:___s_s____s_
call fcn.0043abb0
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
setne bl
jmp 0x43d575
mov eax, dword [0x4934a4]
push dword [eax + 8]
push 0x49b4b8
call fcn.0043a530
mov esi, eax
push esi
push ebx
push str.DeleteRegKey:___s_s_
call fcn.0043abb0
mov ecx, dword [ebp - 0x64]
add esp, 0xc
test ecx, ecx
jne 0x43cc61
mov ecx, dword [0x4a8864]
add ecx, 0x80000001
mov eax, dword [ebp - 0x58]
and eax, 2
push eax
push esi
push ecx
call fcn.0043d6d0
mov edi, eax
xor ebx, ebx
test edi, edi
setne bl
jmp 0x43d575
test esi, esi
jne 0x43cc8d
mov esi, dword [0x4a8864]
add esi, 0x80000001
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x58]
push 0x4934a8
mov dword [ebp - 0x2c8], eax
call fcn.0043a530
mov ecx, dword [0x4934a4]
mov dword [ebp - 0x2c0], eax
push dword [ecx + 4]
push 0x4974b0
call fcn.0043a530
push esi
mov edi, eax
call fcn.0043a8f0
mov ecx, dword [0x4a8890]
add esp, 4
mov dword [ebp - 0x2d0], eax
or ecx, 2
lea eax, [ebp - 0x2c4]
mov ebx, 1
push 0
push eax
push 0
push ecx
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43ce0c
mov ecx, dword [ebp - 0x2c8]
cmp ecx, ebx
jne 0x43cd75
mov eax, dword [0x4934a4]
push dword [eax + 0xc]
push 0x49b4b8
call fcn.0043a530
push 0x49b4b8
call fcn.0043b470
mov esi, dword [ebp - 0x2d0]
push 0x49b4b8
push dword [ebp - 0x2c0]
lea eax, [eax*2 + 2]
push edi
mov dword [ebp - 0x2c8], eax
push esi
cmp dword [ebp - 0x2d4], ebx
jne 0x43cd60
push str.WriteRegStr:___s_s____s___s_
call fcn.0043abb0
mov eax, dword [ebp - 0x2c8]
add esp, 0x14
jmp 0x43cdaf
push str.WriteRegExpandStr:___s_s____s___s_
call fcn.0043abb0
mov eax, dword [ebp - 0x2c8]
add esp, 0x14
jmp 0x43cdaf
cmp ecx, 4
jne 0x43cda9
push 3
call fcn.0043d6b0
mov esi, dword [ebp - 0x2d0]
push eax
push dword [ebp - 0x2c0]
mov dword [0x49b4b8], eax
push edi
push esi
push str.WriteRegDWORD:___s_s____s__0x_08x_
call fcn.0043abb0
add esp, 0x14
mov eax, 4
jmp 0x43cdaf
mov esi, dword [ebp - 0x2d0]
push eax
push 0x49b4b8
push dword [ebp - 0x2d4]
push 0
push dword [ebp - 0x2c0]
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x43cde6
push dword [ebp - 0x2c4]
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d575
push dword [ebp - 0x2c0]
push edi
push esi
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.0043abb0
add esp, 0x10
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d575
mov esi, dword [ebp - 0x2d0]
push edi
push esi
push str.WriteReg:_error_creating_key___s_s_
call fcn.0043abb0
add esp, 0xc
jmp 0x43d575
push 0x20019
call fcn.0043d800
mov ecx, dword [0x4934a4]
mov esi, eax
push dword [ecx + 0xc]
push 0x49f4c0
call fcn.0043a530
xor ecx, ecx
mov word [edi], cx
test esi, esi
je 0x43c244
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 0x4008
push ecx
push edi
lea ecx, [ebp - 0x2d4]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43cec5
mov eax, dword [ebp - 0x2d4]
cmp eax, 4
je 0x43cea9
cmp eax, 1
je 0x43ce8e
cmp eax, 2
jne 0x43cec5
mov eax, dword [ebp - 0x2c4]
xor ecx, ecx
mov ebx, dword [ebp - 0x58]
push esi
mov word [edi + eax*2], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d575
push dword [edi]
xor ebx, ebx
cmp dword [ebp - 0x58], ebx
push edi
sete bl
call fcn.0043b420
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d575
xor eax, eax
push esi
mov word [edi], ax
lea ebx, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d575
push 0x20019
call fcn.0043d800
push 3
mov esi, eax
call fcn.0043d6b0
xor ecx, ecx
mov word [edi], cx
test esi, esi
je 0x43c244
mov dword [ebp - 0x2c4], 0x2003
cmp dword [ebp - 0x58], ecx
je 0x43cf18
push 0x2003
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x43cf38
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c4]
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x43c244
xor eax, eax
push esi
mov word [edi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x43bd92.8
cmp word [edi], bx
je case.0x43bd92.8
push edi
call fcn.0043b320
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x43bd92.8
push dword [ebp - 0x5c]
push 0x4974b0
call fcn.0043a530
mov esi, eax
push esi
call fcn.0043b550
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push esi
call fcn.0043b180
cmp eax, 0xffffffff
jne 0x43c2f9
xor eax, eax
mov word [edi], ax
lea ebx, [eax + 1]
jmp 0x43d575
push 0x2004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp dword [ebp - 0x60], ebx
je 0x43cfc3
push 1
call fcn.0043d6b0
mov byte [esi], al
mov eax, 1
jmp 0x43cff7
mov eax, dword [0x4934a4]
push dword [eax + 4]
push 0x4974b0
call fcn.0043a530
push 0
push 0
push 0x2004
push esi
push 0xffffffffffffffff
push 0x4974b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp word [edi], bx
je 0x43d015
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push edi
call fcn.0043b320
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43d026
push esi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x43d575
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x43d575
xor ebx, ebx
push 2
mov dword [ebp - 0x2c8], ebx
call fcn.0043d6b0
mov esi, eax
cmp esi, 1
jl case.0x43bd92.8
mov eax, 0x2003
cmp esi, eax
cmovg esi, eax
mov dword [ebp - 0x2d4], esi
cmp word [edi], bx
je 0x43d1ad
push edi
mov byte [ebp - 0x2cd], bl
call fcn.0043b320
test esi, esi
mov dword [ebp - 0x2c4], eax
mov esi, dword [ebp - 0x2c0]
jle 0x43d1b3
mov edi, dword [ebp - 0x2d4]
nop dword [eax]
push 0
lea ecx, [ebp - 8]
push ecx
push 1
lea ecx, [ebp - 0x2c9]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d1b3
cmp dword [ebp - 8], 1
jne 0x43d1b3
cmp dword [ebp - 0x5c], 0
jne 0x43d19a
push 2
lea eax, [ebp - 0x2c0]
push eax
push 1
lea eax, [ebp - 0x2c9]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov al, byte [ebp - 0x2cd]
cmp al, 0xd
je 0x43d136
cmp al, 0xa
je 0x43d136
mov ax, word [ebp - 0x2c0]
mov word [esi + ebx*2], ax
inc ebx
mov al, byte [ebp - 0x2c9]
mov dword [ebp - 0x2c8], ebx
mov byte [ebp - 0x2cd], al
test al, al
je 0x43d1b3
mov eax, dword [ebp - 0x2c4]
cmp ebx, edi
jl 0x43d090
xor eax, eax
mov word [esi + ebx*2], ax
xor ebx, ebx
cmp dword [ebp - 0x2c8], eax
sete bl
jmp 0x43d575
mov cl, byte [ebp - 0x2c9]
cmp al, cl
je 0x43d172
cmp cl, 0xd
je 0x43d14a
cmp cl, 0xa
jne 0x43d172
mov ax, word [ebp - 0x2c0]
mov word [esi + ebx*2], ax
inc ebx
xor eax, eax
mov dword [ebp - 0x2c8], ebx
mov word [esi + ebx*2], ax
xor ebx, ebx
cmp dword [ebp - 0x2c8], eax
sete bl
jmp 0x43d575
push 1
push 0
push 0xffffffffffffffff
push dword [ebp - 0x2c4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov word [esi + ebx*2], ax
xor ebx, ebx
cmp dword [ebp - 0x2c8], eax
sete bl
jmp 0x43d575
movzx eax, byte [ebp - 0x2c9]
push eax
push esi
call fcn.0043b420
jmp 0x43d57b
mov esi, dword [ebp - 0x2c0]
xor eax, eax
mov word [esi + ebx*2], ax
xor ebx, ebx
cmp dword [ebp - 0x2c8], eax
sete bl
jmp 0x43d575
cmp dword [ebp - 0x60], ebx
je 0x43d1e2
push 1
call fcn.0043d6b0
mov word [0x4974b0], ax
mov eax, 1
jmp 0x43d1f3
push edx
push 0x4974b0
call fcn.0043a530
push eax
call fcn.0043b470
cmp word [edi], bx
je 0x43c244
push 0
lea ecx, [ebp - 8]
add eax, eax
push ecx
push eax
push 0x4974b0
push edi
call fcn.0043b320
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne case.0x43bd92.8
lea ebx, [eax + 1]
jmp 0x43d575
xor ebx, ebx
push 2
mov dword [ebp - 0x2c8], ebx
call fcn.0043d6b0
mov esi, eax
cmp esi, 1
jl case.0x43bd92.8
mov eax, 0x2003
cmp esi, eax
cmovg esi, eax
mov dword [ebp - 0x2d4], esi
cmp word [edi], bx
je 0x43d1ad
push edi
call fcn.0043b320
test esi, esi
mov dword [ebp - 0x2c4], eax
mov esi, dword [ebp - 0x2c0]
jle 0x43d1b3
xor edi, edi
push 0
lea ecx, [ebp - 8]
push ecx
push 2
lea ecx, [ebp - 0x2d0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d1b3
cmp dword [ebp - 8], 2
jne 0x43d1b3
cmp dword [ebp - 0x5c], 0
jne 0x43d33e
cmp di, 0xd
je 0x43d2f6
cmp di, 0xa
je 0x43d2f6
mov ax, word [ebp - 0x2d0]
mov word [esi + ebx*2], ax
inc ebx
movzx edi, ax
mov dword [ebp - 0x2c8], ebx
test di, di
je 0x43d1b3
mov eax, dword [ebp - 0x2c4]
cmp ebx, dword [ebp - 0x2d4]
jl 0x43d276
xor eax, eax
mov word [esi + ebx*2], ax
xor ebx, ebx
cmp dword [ebp - 0x2c8], eax
sete bl
jmp 0x43d575
mov ax, word [ebp - 0x2d0]
cmp di, ax
je 0x43d316
cmp ax, 0xd
je 0x43d151
cmp ax, 0xa
je 0x43d151
push 1
push 0
push 0xfffffffffffffffe
push dword [ebp - 0x2c4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov word [esi + ebx*2], ax
xor ebx, ebx
cmp dword [ebp - 0x2c8], eax
sete bl
jmp 0x43d575
movzx eax, word [ebp - 0x2d0]
push eax
push esi
call fcn.0043b420
jmp 0x43d57b
cmp word [edi], bx
je case.0x43bd92.8
push dword [ebp - 0x5c]
push 0
push 2
call fcn.0043d6b0
push eax
push edi
call fcn.0043b320
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x64], ebx
jl case.0x43bd92.8
mov esi, dword [ebp - 0x2c0]
push eax
push esi
call fcn.0043b420
jmp case.0x43bd92.8
cmp word [edi], bx
je case.0x43bd92.8
push edi
call fcn.0043b320
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x43bd92.8
cmp word [ecx], bx
je 0x43c213
lea eax, [ebp - 0x2bc]
push eax
push ecx
call fcn.0043b320
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x43c213
lea eax, [ebp - 0x290]
push eax
push edi
call fcn.0043b450
jmp case.0x43bd92.8
push dword [ebp - 0x60]
push 0x4934a8
call fcn.0043a530
lea ecx, [ebp - 0x2bc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [ebp - 0x2c0]
cmp eax, 0xffffffff
jne 0x43d417
xor eax, eax
mov word [esi], ax
mov word [edi], ax
lea ebx, [eax + 1]
jmp 0x43d575
push eax
push esi
call fcn.0043b420
lea eax, [ebp - 0x290]
push eax
push edi
call fcn.0043b450
jmp case.0x43bd92.8
push edx
test esi, esi
je 0x43d470
push str.settings_logging_to__d
call fcn.0043abb0
mov eax, dword [ebp - 0x64]
push eax
push str.logging_set_to__d
mov dword [0x4a9100], eax
call fcn.0043abb0
add esp, 0x10
cmp dword [ebp - 0x64], ebx
je 0x43d464
call fcn.0043b810
jmp case.0x43bd92.8
push 1
call fcn.0043acc0
jmp case.0x43bd92.8
push 0x4934a8
call fcn.0043a530
push eax
push 0x46351c
call fcn.0043abb0
add esp, 8
jmp case.0x43bd92.8
push edx
push 0x4934a8
call fcn.0043a530
push eax
call fcn.0043a0a0
push eax
push edi
call fcn.0043b420
jmp case.0x43bd92.8
push edx
push 0x4934a8
call fcn.0043a530
push 0x42
mov esi, eax
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.0043fa60
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0043d890
add esp, 0x14
test eax, eax
je 0x43c244
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.0043b450
jmp case.0x43bd92.8
test esi, esi
mov ecx, str.false
mov eax, str.true
cmove eax, ecx
push eax
push 0x53a0f8
call fcn.0043b450
jmp case.0x43bd92.8
push esi
push 0x4934a8
call fcn.0043a530
push str.url
push 0x53e100
mov esi, eax
call fcn.0043b450
push esi
push 0x53e100
jmp 0x43d56e
push esi
push 0x4934a8
call fcn.0043a530
push str.arg
push 0x542108
mov esi, eax
call fcn.0043b450
push esi
push 0x542108
jmp 0x43d56e
push esi
push 0x4934a8
call fcn.0043a530
push str.url
push 0x546110
mov esi, eax
call fcn.0043b450
push esi
push 0x546110
call fcn.0043b440
xor ebx, ebx
add dword [0x4a8868], ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret 4