Function at 0x4016ee
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x284]
sub esp, 0x2cc
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x43124c]
mov dword [ebp - 0x2a0], eax
mov edx, dword [ebp - 0x280]
mov ebx, dword [ebp - 0x284]
mov eax, edx
shl eax, 0xd
add eax, dword [0x410ad4]
mov edi, eax
mov eax, dword [ebp - 0x27c]
mov ecx, eax
shl ecx, 0xd
add ecx, dword [0x410ad4]
mov dword [ebp - 0x29c], ecx
lea ecx, [ebp - 0x280]
mov dword [0x4130fc], ecx
lea ecx, [ebx - 2]
cmp ecx, 0x44
ja case.0x40175d.67
jmp dword [ecx*4 + 0x40fca0]
mov dword [esp + 4], edx
mov dword [esp], str.Jump:__d
call fcn.0040a271
mov eax, dword [ebp - 0x280]
jmp 0x4041ab
xor eax, eax
mov dword [esp], eax
call fcn.00401458
push edx
mov dword [esp + 4], eax
mov dword [esp], str.Aborting:___s_
call fcn.0040a271
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
jmp 0x401f71
inc dword [0x43529c]
cmp dword [ebp - 0x2a0], 0
je 0x4017c9
xor esi, esi
mov dword [esp], esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
push edi
mov eax, 0x7fffffff
jmp 0x4041ab
mov dword [esp], edx
call fcn.004016ab
lea ebx, [eax - 1]
push edx
mov dword [esp + 4], ebx
mov dword [esp], str.Call:__d
call fcn.0040a271
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.004041b5
push ebx
push ebx
jmp 0x4041ab
xor ebx, ebx
xor edi, edi
mov dword [esp], ebx
call fcn.00401458
push esi
mov dword [esp + 4], eax
mov dword [esp], str.DetailPrint:__s
call fcn.0040a271
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call fcn.00407cde
jmp 0x403c34
xor eax, eax
call fcn.004014aa
mov dword [esp], str.Sleep__d_
mov dword [esp + 4], eax
mov ebx, eax
call fcn.0040a271
test ebx, ebx
mov eax, 1
cmovle ebx, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403fab
mov dword [esp], str.BringToFront
call fcn.0040a271
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403fab
cmp dword [ebp - 0x278], 0
jg 0x4018d2
jne 0x4018a2
mov eax, dword [edx*4 + 0x413020]
mov dword [edx*4 + 0x413060], eax
mov eax, 1
call fcn.004014aa
mov edx, dword [ebp - 0x280]
mov dword [edx*4 + 0x413020], eax
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], str.SetFlag:__d_d
call fcn.0040a271
jmp case.0x40175d.67
mov eax, dword [edx*4 + 0x413060]
mov dword [edx*4 + 0x413020], eax
jmp case.0x40175d.67
mov ecx, dword [ebp - 0x278]
xor eax, eax
mov edx, dword [ecx*4 + 0x413020]
test edx, edx
sete al
and edx, dword [ebp - 0x274]
mov eax, dword [ebp + eax*4 - 0x280]
mov dword [ecx*4 + 0x413020], edx
jmp 0x4041ab
mov eax, dword [eax*4 + 0x413020]
jmp 0x402b51
mov edx, dword [0x435288]
test edx, edx
je 0x401937
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push ecx
mov eax, dword [0x435290]
test eax, eax
je case.0x40175d.67
mov edx, dword [ebp - 0x280]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x402946
mov dword [esp], 0xfffffff0
call fcn.00401458
push edi
mov ebx, eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 4], ebx
mov dword [esp], str.SetFileAttributes:___s_:_08X
mov dword [esp + 8], eax
call fcn.0040a271
mov eax, dword [ebp - 0x27c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edx
test eax, eax
push edx
jne case.0x40175d.67
mov dword [esp], str.SetFileAttributes_failed.
call fcn.0040a271
jmp 0x401d0c
mov dword [esp], 0xfffffff0
call fcn.00401458
push ebx
mov ebx, eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 4], ebx
mov dword [esp], str.CreateDirectory:___s____d_
mov dword [esp + 8], eax
call fcn.0040a271
mov dword [esp], ebx
call fcn.004096e2
push esi
xor esi, esi
test eax, eax
je 0x401a9e
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call fcn.00409645
push ecx
mov edi, eax
push ecx
movzx eax, word [eax]
mov word [edi], 0
mov dword [ebp - 0x29c], eax
test eax, eax
jne 0x401a2b
cmp dword [ebp - 0x278], 0
je 0x401a2b
call fcn.0040a490
test eax, eax
je 0x401a2b
mov dword [esp], ebx
call fcn.0040948e
jmp 0x401a33
mov dword [esp], ebx
call fcn.004094ee
test eax, eax
push edx
je 0x401a76
cmp eax, 0xb7
je 0x401a55
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.CreateDirectory:_cant_create___s___err_d_
call fcn.0040a271
jmp 0x401a73
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ecx
test al, 0x10
jne 0x401a86
mov dword [esp + 4], ebx
mov dword [esp], str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.0040a271
inc esi
jmp 0x401a86
mov dword [esp + 4], ebx
mov dword [esp], str.CreateDirectory:___s__created
call fcn.0040a271
mov ecx, dword [ebp - 0x29c]
lea eax, [edi + 2]
cmp dword [ebp - 0x29c], 0
mov word [edi], cx
jmp 0x4019e3
cmp dword [ebp - 0x27c], 0
je 0x401afe
mov dword [esp], 0xffffffe6
call fcn.004016cf
push eax
mov eax, dword [0x410ad4]
mov dword [esp + 4], ebx
add eax, 0x2c000
mov dword [esp], eax
call fcn.00409d52
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edx
test eax, eax
jne 0x4041a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc esi
mov dword [esp + 4], ebx
mov dword [esp], str.SetCurrentDirectory__s__failed___d_
mov dword [esp + 8], eax
call fcn.0040a271
jmp 0x4041a3
mov dword [esp], 0xfffffff5
jmp 0x403e83
xor ebx, ebx
mov dword [esp], ebx
call fcn.00401458
push esi
mov ebx, eax
mov dword [esp], eax
call fcn.0040a2cc
push edi
test eax, eax
je 0x401b43
mov eax, dword [ebp - 0x27c]
mov dword [esp + 4], ebx
mov dword [esp], str.IfFileExists:_file___s__exists__jumping__d
mov dword [esp + 8], eax
call fcn.0040a271
jmp 0x402690
mov eax, dword [ebp - 0x278]
mov dword [esp + 4], ebx
mov dword [esp], str.IfFileExists:_file___s__does_not_exist__jumping__d
mov dword [esp + 8], eax
call fcn.0040a271
jmp 0x40269b
mov dword [esp], 0xffffffd0
call fcn.00401458
push ecx
mov esi, eax
mov dword [esp], 0xffffffdf
call fcn.00401458
push ebx
mov edi, eax
mov dword [esp], 0x13
call fcn.00401458
push edx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], str.Rename:__s
call fcn.0040a271
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ecx
test eax, eax
push ecx
je 0x401bbe
mov dword [esp], 0xffffffe3
jmp 0x403090
cmp dword [ebp - 0x278], 0
je 0x401bff
mov dword [esp], esi
call fcn.0040a2cc
push edx
test eax, eax
je 0x401bff
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0040aa0e
push esi
push esi
mov dword [esp], 0xffffffe4
call fcn.004016cf
push edi
mov dword [esp + 4], ebx
mov dword [esp], str.Rename_on_reboot:__s
jmp 0x403ef8
mov dword [esp + 4], ebx
mov dword [esp], str.Rename_failed:__s
jmp 0x402df1
xor ecx, ecx
mov dword [esp], ecx
call fcn.00401458
push ebx
mov ebx, eax
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 4], 0x1000
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
sub esp, 0x10
test eax, eax
je 0x401c82
mov eax, dword [ebp - 0x268]
cmp ebx, eax
jae 0x401c58
cmp word [eax], 0
jne 0x401c5c
xor esi, esi
jmp 0x401c92
mov dword [esp], ebx
call fcn.0040a2cc
push edx
test eax, eax
je 0x401c82
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call fcn.00409d52
push eax
push eax
jmp 0x401c58
mov eax, dword [ebp - 0x29c]
mov esi, 1
mov word [eax], 0
cmp dword [ebp - 0x278], 0
jne 0x4041a3
mov dword [esp + 8], 0x1000
mov eax, dword [ebp - 0x29c]
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub esp, 0xc
jmp 0x4041a3
mov dword [esp], 0xffffffff
xor esi, esi
call fcn.00401458
lea edx, [ebp - 0x268]
push ebx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], esi
xor esi, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x1000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
sub esp, 0x18
test eax, eax
jne 0x4041a3
mov word [edi], 0
mov esi, 1
jmp 0x4041a3
mov dword [esp], 0xffffffef
call fcn.00401458
push edx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004098e9
push ecx
push ecx
jmp 0x40390b
mov dword [esp], 0x31
call fcn.00401458
push ebx
mov ebx, eax
mov eax, dword [ebp - 0x280]
mov dword [esp + 0xc], ebx
mov dword [esp], str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
mov esi, eax
sar eax, 3
and esi, 7
mov dword [esp + 4], esi
and eax, 2
mov dword [esp + 8], eax
call fcn.0040a271
mov dword [esp], ebx
call fcn.004096b0
push edi
test eax, eax
je 0x401d8d
mov dword [esp + 4], ebx
mov dword [esp], 0x413100
call fcn.00409d52
jmp 0x401dbe
mov dword [esp], 0x413100
mov eax, dword [0x410ad4]
add eax, 0x2c000
mov dword [esp + 4], eax
call fcn.00409d52
push edx
push edx
mov dword [esp], eax
call fcn.00409d86
push ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatW
push ecx
push ecx
mov dword [esp], 0x413100
call fcn.00409e91
cmp esi, 2
push edi
jle 0x401e19
mov dword [esp], 0x413100
call fcn.0040a2cc
push edx
test eax, eax
je 0x401e25
add eax, 0x14
sub esi, 3
mov dword [esp], eax
lea edx, [ebp - 0x274]
or esi, 0x80000000
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push edi
test esi, eax
push edi
je 0x401e25
xor edi, edi
mov dword [esp], 0x413100
call fcn.004097fc
push esi
jmp 0x401e31
test esi, esi
je 0x401e08
dec esi
mov edi, 2
jne 0x401e31
mov edi, 1
mov eax, 1
jmp 0x401e36
mov eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x413100
call fcn.00409895
sub esp, 0xc
cmp eax, 0xffffffff
mov esi, eax
jne 0x401f7b
test edi, edi
je 0x401e98
mov dword [esp + 4], ebx
mov dword [esp], 0xffffffe2
call fcn.00407cde
cmp edi, 2
sete dl
movzx esi, dl
push ecx
push ecx
mov dword [esp + 8], edi
mov dword [esp + 4], 0x413100
mov dword [esp], str.File:_skipped:___s___overwriteflag_d_
call fcn.0040a271
jmp 0x4041a3
mov dword [esp + 4], 0x413100
mov dword [esp], str.File:_error_creating___s_
call fcn.0040a271
mov eax, dword [0x410ad4]
mov dword [esp], 0x417100
mov dword [esp + 4], eax
call fcn.00409d52
push eax
push eax
mov eax, dword [0x410ad4]
mov dword [esp + 4], 0x413100
mov dword [esp], eax
call fcn.00409d52
push eax
push eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], 0x415100
mov dword [esp + 4], eax
call fcn.0040a4b7
push eax
push eax
mov eax, dword [0x410ad4]
mov dword [esp + 4], 0x417100
mov dword [esp], eax
call fcn.00409d52
push eax
push eax
mov eax, dword [ebp - 0x280]
mov dword [esp], 0x415100
sar eax, 3
mov dword [esp + 4], eax
call fcn.004095d9
push edx
cmp eax, 4
push edx
je 0x401f45
cmp eax, 5
jne 0x401f56
mov dword [esp], str.File:_error__user_cancel
call fcn.0040a271
inc dword [0x413028]
jmp 0x4041a9
mov dword [esp], str.File:_error__user_retry
call fcn.0040a271
jmp 0x401e08
mov dword [esp], str.File:_error__user_abort
call fcn.0040a271
mov dword [esp + 4], 0x413100
mov dword [esp], 0xfffffffa
call fcn.00407cde
jmp 0x40207e
mov dword [esp + 4], ebx
xor edi, edi
mov dword [esp], 0xffffffea
call fcn.00407cde
push ecx
push ecx
inc dword [0x413054]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x278]
mov dword [esp], eax
call fcn.0040466d
dec dword [0x413054]
sub esp, 0x10
mov edi, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x413100
mov dword [esp], str.File:_wrote__d_to___s_
call fcn.0040a271
mov eax, dword [ebp - 0x274]
and eax, dword [ebp - 0x270]
inc eax
je 0x402001
mov dword [esp], esi
lea eax, [ebp - 0x274]
xor edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
push eax
jns case.0x40175d.67
cmp edi, 0xfffffffe
jne 0x402040
mov dword [esp + 4], 0xffffffe9
mov dword [esp], 0x413100
call fcn.0040a4b7
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x413100
call sub.KERNEL32.dll_lstrcatW
jmp 0x402054
mov dword [esp + 4], 0xffffffee
mov dword [esp], 0x413100
call fcn.0040a4b7
push edi
push edi
mov dword [esp + 4], 0x413100
mov dword [esp], 0x40f5cc
call fcn.0040a271
mov dword [esp + 4], 0x200010
mov dword [esp], 0x413100
call fcn.004095d9
push esi
push esi
jmp 0x4017c9
xor ecx, ecx
mov dword [esp], ecx
call fcn.00401458
push ebx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], str.Delete:___s_
jmp 0x402124
mov dword [esp], 0x31
call fcn.00401458
push edi
mov ebx, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x280]
mov dword [esp], str.MessageBox:__d___s_
mov dword [esp + 4], eax
call fcn.0040a271
mov eax, dword [ebp - 0x280]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004095d9
push edx
test eax, eax
push edx
je 0x401d0c
cmp dword [ebp - 0x278], eax
je 0x4022d2
cmp dword [ebp - 0x270], eax
jne case.0x40175d.67
mov eax, dword [ebp - 0x26c]
jmp 0x4041ab
mov dword [esp], 0xfffffff0
call fcn.00401458
push esi
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], str.RMDir:___s_
call fcn.0040a271
mov eax, dword [ebp - 0x27c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040aa53
jmp 0x403c34
mov dword [esp], 1
call fcn.00401458
push ebx
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenW
jmp 0x402906
mov eax, 2
call fcn.004014aa
mov dword [ebp - 0x2a0], edx
mov esi, eax
mov eax, 3
call fcn.004014aa
mov dword [esp], 1
mov ebx, eax
call fcn.00401458
push edx
mov dword [esp], eax
mov dword [ebp - 0x29c], eax
call sub.KERNEL32.dll_lstrlenW
push ecx
mov ecx, dword [ebp - 0x2a0]
mov word [edi], 0
test ecx, ecx
cmove esi, eax
test esi, esi
je case.0x40175d.67
test ebx, ebx
mov edx, dword [ebp - 0x29c]
jns 0x4021be
add ebx, eax
js case.0x40175d.67
mov dword [esp], edi
cmp ebx, eax
cmovg ebx, eax
add ebx, ebx
add edx, ebx
mov dword [esp + 4], edx
call fcn.00409d52
test esi, esi
push ebx
push ebx
jns 0x4021e6
mov dword [esp], edi
call sub.KERNEL32.dll_lstrlenW
push ecx
add esi, eax
js 0x4021f4
cmp esi, 0xfff
jg case.0x40175d.67
jmp 0x4021f6
xor esi, esi
mov word [edi + esi*2], 0
jmp case.0x40175d.67
mov dword [esp], 0x20
call fcn.00401458
push edi
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401458
push edx
cmp dword [ebp - 0x270], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x402235
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x40223b
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push esi
test eax, eax
push esi
jne 0x4022d2
jmp 0x40269b
mov dword [esp], 1
call fcn.00401458
push ebx
mov ebx, eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
test eax, eax
jne 0x402281
mov word [edi], 0
mov esi, 1
jmp 0x4022a3
cmp dword [ebp - 0x278], 0
jne 0x40228e
xor esi, esi
jmp 0x4022a3
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push ecx
test eax, eax
push ecx
je 0x402275
jmp 0x40228a
mov word [edi + 0x1ffe], 0
jmp 0x4041a3
xor eax, eax
mov esi, dword [ebp - 0x26c]
call fcn.004014aa
mov ebx, eax
mov eax, 1
call fcn.004014aa
test esi, esi
jne 0x4022ee
cmp ebx, eax
jge 0x4022dd
mov eax, dword [ebp - 0x274]
jmp 0x4041ab
jle 0x40269b
mov eax, dword [ebp - 0x270]
jmp 0x4041ab
cmp ebx, eax
jb 0x4022d2
cmp eax, ebx
jae 0x40269b
jmp 0x4022e3
mov eax, 1
call fcn.004014aa
mov dword [ebp - 0x29c], eax
mov eax, 2
call fcn.004014aa
mov esi, dword [ebp - 0x274]
cmp esi, 0xd
mov ebx, eax
mov ecx, eax
ja case.default.0x402329
jmp dword [esi*4 + 0x40fdb4]
mov ebx, dword [ebp - 0x29c]
add ebx, eax
jmp 0x4023fe
mov ebx, dword [ebp - 0x29c]
sub ebx, eax
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
imul ebx, eax
jmp 0x4023fc
test eax, eax
mov esi, 1
je 0x4023fe
mov eax, dword [ebp - 0x29c]
cdq
idiv ebx
mov ebx, eax
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
or ebx, eax
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
and ebx, eax
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
xor ebx, eax
jmp 0x4023fc
cmp dword [ebp - 0x29c], 0
sete bl
jmp 0x4023bd
mov eax, dword [ebp - 0x29c]
or eax, ebx
setne bl
jmp 0x4023bd
cmp dword [ebp - 0x29c], 0
setne bl
test eax, eax
setne al
and bl, al
movzx ebx, bl
jmp 0x4023fc
test eax, eax
mov esi, 1
je 0x4023fe
mov eax, dword [ebp - 0x29c]
cdq
idiv ebx
mov ebx, edx
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
shl ebx, cl
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
sar ebx, cl
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
shr ebx, cl
jmp 0x4023fc
mov ebx, dword [ebp - 0x29c]
xor esi, esi
mov dword [esp + 4], ebx
jmp 0x40266c
mov dword [esp], 1
call fcn.00401458
push edx
mov ebx, eax
mov eax, 2
call fcn.004014aa
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_wsprintfW]
jmp case.0x40175d.67
mov edx, dword [ebp - 0x278]
mov ebx, dword [0x41d100]
test edx, edx
je 0x4024b4
test ebx, ebx
je 0x40245f
lea eax, [edx - 2]
cmp eax, 0xffffffff
mov ebx, dword [ebx]
je 0x40245b
dec eax
test ebx, ebx
jne 0x40244d
jmp 0x40245f
test ebx, ebx
jne 0x402474
mov dword [esp + 4], edx
mov dword [esp], str.Exch:_stack____d_elements
call fcn.0040a271
jmp 0x403186
mov dword [esp], 0x413100
add ebx, 4
mov dword [esp + 4], ebx
call fcn.00409d52
push eax
push eax
mov eax, dword [0x41d100]
mov dword [esp], ebx
add eax, 4
mov dword [esp + 4], eax
call fcn.00409d52
push eax
push eax
mov dword [esp + 4], 0x413100
mov eax, dword [0x41d100]
add eax, 4
jmp 0x403f43
test eax, eax
je 0x4024ee
test ebx, ebx
jne 0x4024c8
mov dword [esp], str.Pop:_stack_empty
jmp 0x4019a3
mov dword [esp], edi
lea eax, [ebx + 4]
mov dword [esp + 4], eax
call fcn.00409d52
push eax
push eax
mov eax, dword [ebx]
mov dword [0x41d100], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403fab
mov dword [esp + 4], 0x2004
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov ebx, eax
push esi
mov eax, dword [ebp - 0x280]
mov dword [esp + 4], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.0040a4b7
push edi
push edi
mov eax, dword [0x41d100]
mov dword [ebx], eax
mov dword [0x41d100], ebx
jmp case.0x40175d.67
mov eax, 3
call fcn.004014aa
mov ebx, eax
mov eax, 4
call fcn.004014aa
test byte [ebp - 0x26c], 1
mov esi, eax
je 0x402560
mov dword [esp], 0x33
call fcn.00401458
push ebx
mov ebx, eax
test byte [ebp - 0x26c], 2
je 0x402578
mov dword [esp], 0x44
call fcn.00401458
push ecx
mov esi, eax
cmp dword [ebp - 0x284], 0x21
jne 0x4025ff
mov eax, 1
call fcn.004014aa
mov dword [ebp - 0x29c], eax
mov eax, 2
call fcn.004014aa
mov ecx, dword [ebp - 0x26c]
sar ecx, 2
je 0x4025e2
mov dword [esp + 0xc], esi
lea edx, [ebp - 0x268]
mov dword [esp + 0x18], edx
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
sub esp, 0x1c
test eax, eax
sete dl
movzx esi, dl
jmp 0x402655
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40264a
mov dword [esp], 1
call fcn.00401458
push edx
mov dword [ebp - 0x29c], eax
mov dword [esp], 0x12
call fcn.00401458
push ecx
xor ecx, ecx
mov edx, dword [ebp - 0x29c]
cmp word [eax], 0
cmove eax, ecx
cmp word [edx], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
cmove edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x268], eax
sub esp, 0x10
xor esi, esi
cmp dword [ebp - 0x280], 0
js 0x4041a3
mov eax, dword [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00409c82
push edi
push edi
jmp 0x4041a3
xor eax, eax
call fcn.004014aa
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
push esi
test eax, eax
je 0x40269b
mov eax, dword [ebp - 0x27c]
jmp 0x4041ab
mov eax, dword [ebp - 0x278]
jmp 0x4041ab
mov eax, 2
call fcn.004014aa
mov ebx, eax
mov eax, 1
call fcn.004014aa
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
jmp 0x402b51
add eax, dword [0x41d168]
mov ebx, eax
xor eax, eax
call fcn.004014aa
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x40419b
test byte [ebp - 0x273], 1
je 0x40270e
mov eax, 2
call fcn.004014aa
jmp 0x402729
mov eax, dword [ebp - 0x278]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ecx
push ecx
mov ebx, eax
mov eax, dword [ebp - 0x274]
mov ecx, eax
mov edx, eax
shr edx, 0x1e
and ecx, 3
mov dword [ebp - 0x29c], ecx
mov ecx, eax
mov esi, edx
and ecx, 4
and esi, 1
mov dword [ebp - 0x2a4], ecx
mov ecx, eax
shr ecx, 0x1f
bt eax, 0x10
mov dword [ebp - 0x2a8], ecx
jae 0x402771
mov dword [esp], 0x11
call fcn.00401458
push edx
jmp 0x402778
movzx eax, word [ebp - 0x27c]
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push eax
push eax
imul esi, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x260]
mov edx, esi
xor esi, esi
and ecx, 0xfef0
cmp dword [ebp - 0x2a4], 0
je 0x4027c6
mov esi, dword [0x431248]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_LoadImageW]
sub esp, 0x18
mov esi, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 4], 0x172
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
je 0x40282d
cmp dword [ebp - 0x29c], 0
jne 0x40282d
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push eax
cmp dword [ebp - 0x280], 0
js case.0x40175d.67
mov dword [esp + 4], esi
jmp 0x402b55
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push ebx
mov ebx, eax
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push esi
mov esi, eax
mov eax, 2
call fcn.004014aa
mov dword [esp + 8], 0x48
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esp, 0xc
neg eax
mov dword [0x4130a0], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push eax
push eax
mov eax, 3
call fcn.004014aa
mov byte [0x4130b7], 1
mov dword [0x4130b0], eax
mov al, byte [ebp - 0x270]
mov dl, al
and dl, 1
mov byte [0x4130b4], dl
mov dl, al
and al, 4
mov byte [0x4130b6], al
mov eax, dword [ebp - 0x27c]
and dl, 2
mov byte [0x4130b5], dl
mov dword [esp], 0x4130bc
mov dword [esp + 4], eax
call fcn.0040a4b7
push eax
push eax
mov dword [esp], 0x4130a0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push ecx
jmp 0x402b51
xor eax, eax
call fcn.004014aa
mov ebx, eax
mov eax, 1
call fcn.004014aa
cmp dword [ebp - 0x278], 0
mov esi, eax
je 0x402936
mov dword [esp], str.HideWindow
call fcn.0040a271
cmp dword [ebp - 0x274], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
jne 0x402951
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403c34
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x403c34
xor eax, eax
mov dword [esp], eax
call fcn.00401458
push edx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401458
push ecx
mov edi, eax
mov dword [esp], 0x22
call fcn.00401458
push esi
mov esi, eax
mov dword [esp], 0x15
call fcn.00401458
push eax
mov dword [esp], 0xffffffec
call fcn.004016cf
push eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x24c], eax
xor eax, eax
cmp word [ebx], 0
mov edx, eax
mov dword [ebp - 0x258], edi
cmovne edx, ebx
mov dword [ebp - 0x25c], edx
cmp word [esi], 0
cmovne eax, esi
mov dword [ebp - 0x254], eax
mov eax, dword [0x410ad4]
add eax, 0x2c000
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x268]
mov dword [esp], eax
call fcn.0040958a
push edx
test eax, eax
jne 0x402a33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
mov dword [esp + 0x10], eax
call fcn.0040a271
jmp 0x401d0c
test byte [ebp - 0x264], 0x40
je 0x402a5b
mov eax, dword [ebp - 0x230]
mov dword [esp], eax
call fcn.0040adcf
push eax
mov eax, dword [ebp - 0x230]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.0040a271
jmp case.0x40175d.67
xor eax, eax
mov dword [esp], eax
call fcn.00401458
push edx
mov edi, eax
mov dword [esp + 4], eax
mov dword [esp], str.Exec:_command__s_
call fcn.0040a271
mov dword [esp + 4], edi
mov dword [esp], 0xffffffeb
call fcn.00407cde
push ecx
push ecx
mov dword [esp], edi
call fcn.0040951a
push ebx
test eax, eax
mov ebx, eax
mov dword [esp + 4], edi
je 0x402b0f
mov dword [esp], str.Exec:_success____s__
call fcn.0040a271
cmp dword [ebp - 0x278], 0
je 0x402af5
mov dword [esp], ebx
call fcn.0040adcf
push edi
cmp dword [ebp - 0x27c], 0
js 0x402af9
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409c82
push esi
push esi
xor esi, esi
jmp 0x402b01
test eax, eax
setne dl
movzx esi, dl
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4040d5
mov dword [esp], str.Exec:_failed_createprocess____s__
jmp 0x402df1
mov dword [esp], 2
call fcn.00401458
push edx
mov dword [esp], eax
call fcn.0040a2cc
test eax, eax
mov ebx, eax
push ecx
je 0x402b62
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409c82
push eax
push eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00409c82
jmp 0x403c34
mov word [edi], 0
jmp 0x4040db
mov dword [esp], 0xffffffee
call fcn.00401458
push ecx
mov dword [ebp - 0x2a0], eax
mov dword [esp], 0xb
call fcn.0040a444
lea edx, [ebp - 0x28c]
push ebx
mov dword [esp + 4], edx
mov ecx, dword [ebp - 0x2a0]
mov dword [esp], ecx
call eax
push esi
push esi
mov esi, eax
mov eax, dword [ebp - 0x29c]
test esi, esi
mov word [edi], 0
mov word [eax], 0
je 0x401d0c
mov dword [esp + 4], esi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov ebx, eax
push edx
push edx
je 0x401d0c
mov dword [esp], 0xc
call fcn.0040a444
push edx
mov dword [ebp - 0x2a4], eax
mov dword [esp], 0xd
call fcn.0040a444
push ecx
mov dword [ebp - 0x2a8], eax
mov dword [esp + 8], esi
xor esi, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
mov eax, dword [ebp - 0x2a4]
call eax
mov edx, dword [ebp - 0x2a8]
sub esp, 0x10
test eax, eax
jne 0x402c33
mov esi, 1
jmp 0x402c9f
mov dword [esp + 4], 0x40f804
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x288]
mov dword [esp + 8], eax
mov dword [esp], ebx
call edx
sub esp, 0x10
test eax, eax
je 0x402c2c
mov edx, dword [ebp - 0x274]
xor esi, esi
mov eax, dword [ebp - 0x288]
mov eax, dword [eax + edx*4 + 8]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00409c82
push eax
push eax
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x288]
mov eax, dword [eax + edx*4 + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409c82
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4040d5
cmp dword [section..bss], 0
js 0x402dfb
mov dword [esp], 0xfffffff0
call fcn.00401458
push esi
mov esi, eax
mov dword [esp], 1
call fcn.00401458
push edi
mov edi, eax
cmp dword [ebp - 0x270], 0
jne 0x402d06
mov dword [esp + 8], 8
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x402d16
jmp 0x402dd9
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
mov ebx, eax
push ecx
je 0x402ce1
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040ad87
push edx
test eax, eax
push edx
je 0x402d82
mov esi, dword [ebp - 0x278]
test esi, esi
je 0x402d53
mov dword [ebp - 0x29c], eax
mov dword [esp], esi
call fcn.004016cf
push esi
mov eax, dword [ebp - 0x29c]
call eax
test eax, eax
setne dl
movzx esi, dl
jmp 0x402dad
mov dword [esp + 0x10], section..data
mov ecx, dword [0x410ad4]
mov dword [esp + 0xc], 0x41d100
mov dword [esp + 4], 0x1000
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x2a0]
mov dword [esp], ecx
call eax
jmp 0x402dad
mov dword [esp + 4], edi
mov dword [esp], 0xfffffff7
call fcn.00407cde
push ecx
push ecx
mov dword [esp + 8], esi
mov esi, 1
mov dword [esp + 4], edi
mov dword [esp], 0x40f808
call fcn.0040a271
cmp dword [ebp - 0x274], 0
jne 0x4041a3
mov dword [esp], ebx
call fcn.0040549a
push edx
test eax, eax
je 0x4041a3
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4040d5
mov dword [esp], 0xfffffff6
call fcn.004016cf
push edi
mov dword [esp + 4], esi
mov dword [esp], str.Error_registering_DLL:_Could_not_load__s
call fcn.0040a271
jmp 0x401d0c
mov dword [esp], 0xffffffe7
call fcn.004016cf
push ebx
mov dword [esp], str.Error_registering_DLL:_Could_not_initialize_OLE
jmp 0x4019a3
mov dword [esp], 0xfffffff0
call fcn.00401458
push edx
mov dword [ebp - 0x2a0], eax
mov dword [esp], 0xffffffdf
call fcn.00401458
push ecx
mov ebx, eax
mov dword [esp], 2
call fcn.00401458
push esi
mov dword [ebp - 0x2a4], eax
mov dword [esp], 0xffffffcd
call fcn.00401458
push edi
mov esi, eax
mov dword [esp], 0x45
call fcn.00401458
push edx
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x29c], eax
and eax, 0xfff
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x29c]
sar eax, 0xc
and eax, 7
mov edi, eax
mov eax, dword [ebp - 0x29c]
shr eax, 0x10
mov dword [ebp - 0x2ac], eax
mov dword [esp], ebx
call fcn.004096b0
push ecx
test eax, eax
jne 0x402eb9
mov dword [esp], 0x21
call fcn.00401458
push eax
mov eax, dword [ebp - 0x2ac]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x2a8]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2a4]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], str.CreateShortcut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
mov dword [esp + 4], eax
call fcn.0040a271
lea eax, [ebp - 0x288]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x412cb4
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x412c94
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
js 0x403077
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x268]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x412ca4
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x288]
mov edx, dword [eax]
jns 0x402f6b
mov dword [esp], eax
call dword [edx + 8]
push ecx
jmp 0x403077
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x50]
push edx
mov ebx, eax
push edx
bt dword [ebp - 0x29c], 0xf
jb 0x402fa1
mov edx, dword [ebp - 0x288]
mov eax, dword [0x410ad4]
mov ecx, dword [edx]
mov dword [esp], edx
add eax, 0x2c000
mov dword [esp + 4], eax
call dword [ecx + 0x24]
push eax
push eax
test edi, edi
je 0x402fb9
mov eax, dword [ebp - 0x288]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x3c]
push eax
push eax
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2ac]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x34]
push eax
push eax
cmp word [esi], 0
je 0x402ff8
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
push eax
push eax
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x1c]
test ebx, ebx
push eax
push eax
js 0x403055
mov eax, dword [ebp - 0x268]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov ecx, dword [ebp - 0x2a0]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x268]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0x288]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
test ebx, ebx
push edi
jns 0x403089
mov dword [esp], 0xfffffff0
call fcn.004016cf
push ecx
jmp 0x401d0c
mov dword [esp], 0xfffffff4
call fcn.004016cf
jmp 0x403fab
xor eax, eax
mov dword [esp], eax
call fcn.00401458
push edx
mov ebx, eax
mov dword [esp], 0x11
call fcn.00401458
push ecx
mov esi, eax
mov dword [esp], 0x23
call fcn.00401458
push edi
mov edi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str.CopyFiles___s_____s_
call fcn.0040a271
mov dword [esp], ebx
call fcn.0040a2cc
push edx
test eax, eax
je 0x403165
mov dword [ebp - 0x264], 2
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x268], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push edx
mov word [ebx + eax*2 + 2], 0
mov dword [esp], esi
call sub.KERNEL32.dll_lstrlenW
push ecx
mov word [esi + eax*2 + 2], 0
mov dword [ebp - 0x260], ebx
mov eax, dword [ebp - 0x278]
xor ebx, ebx
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x24e], edi
mov word [ebp - 0x258], ax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00407cde
lea eax, [ebp - 0x268]
push esi
push esi
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
mov esi, eax
push edi
je 0x4041a3
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0xfffffff9
call fcn.00407cde
push ebx
push ebx
jmp 0x401d0c
cmp edx, 0xbadf00d
je 0x4031aa
mov dword [esp + 4], 0xffffffe8
xor eax, eax
mov dword [esp], eax
call fcn.0040a4b7
push edx
push edx
mov dword [esp + 4], 0x200010
mov dword [esp], eax
jmp 0x402079
inc dword [0x413034]
jmp case.0x40175d.67
mov dword [esp + 4], str._RM_
xor ebx, ebx
mov dword [esp], 0x415100
call fcn.00409d52
push esi
push esi
mov dword [esp + 4], 0x415100
mov dword [esp], 0x417100
call fcn.00409d52
push edi
push edi
cmp dword [ebp - 0x280], 0
je 0x4031f9
xor ecx, ecx
mov dword [esp], ecx
call fcn.00401458
push ebx
mov ebx, eax
xor esi, esi
cmp dword [ebp - 0x27c], 0
je 0x403213
mov dword [esp], 0x11
call fcn.00401458
push edx
mov esi, eax
xor edi, edi
cmp dword [ebp - 0x270], 0
je 0x40322d
mov dword [esp], 0x22
call fcn.00401458
push edi
mov edi, eax
mov dword [esp], 0xffffffcd
call fcn.00401458
push ecx
mov dword [esp + 0x10], eax
mov dword [ebp - 0x29c], eax
mov dword [esp + 0xc], 0x417100
mov dword [esp + 8], 0x415100
mov dword [esp + 4], 0x413100
mov dword [esp], str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.0040a271
mov eax, dword [ebp - 0x29c]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
sub esp, 0x10
jmp 0x40390b
mov dword [ebp - 0x268], 0xa
mov dword [esp], 1
call fcn.00401458
push edx
mov esi, eax
mov dword [esp], 0x12
call fcn.00401458
push ecx
mov ebx, eax
mov dword [esp], 0xffffffdd
call fcn.00401458
push edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x268]
mov dword [esp], esi
xor esi, esi
mov dword [esp + 0x10], 0xfff
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub esp, 0x18
cmp word [edi], 0xa
jmp 0x401d01
mov dword [esp], eax
mov edi, eax
call fcn.0040a058
cmp dword [ebp - 0x270], 0
mov esi, eax
jne 0x403376
mov dword [esp], 2
call fcn.004014dd
push edi
test eax, eax
mov edi, eax
je 0x401d0c
mov dword [esp], 0x33
call fcn.00401458
push ecx
mov dword [esp + 4], eax
mov dword [ebp - 0x29c], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebx
push ebx
mov ebx, eax
mov edx, dword [ebp - 0x29c]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x417100
mov dword [esp], str.DeleteRegValue:___s_s____s_
mov dword [esp + 0xc], edx
call fcn.0040a271
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
jmp 0x403405
mov dword [esp], 0x22
call fcn.00401458
push edx
mov ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], str.DeleteRegKey:___s_s_
call fcn.0040a271
mov edx, dword [ebp - 0x270]
sar edx, 1
mov dword [ebp - 0x268], edx
cmp word [ebx], 0
je 0x401d0c
or edx, 0x100020
test edi, edi
mov dword [ebp - 0x268], edx
js 0x4033ce
mov eax, dword [0x413024]
add eax, edi
lea edi, [eax - 0x7fffffff]
mov dword [esp], edi
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
call fcn.00409aaa
push esi
test eax, eax
push esi
je 0x401d0c
mov edx, dword [ebp - 0x268]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00401541
sub esp, 0xc
mov ebx, eax
test ebx, ebx
setne dl
jmp 0x403b7e
mov dword [ebp - 0x2a0], edx
mov edi, dword [ebp - 0x270]
mov esi, dword [ebp - 0x26c]
mov dword [esp], 2
call fcn.00401458
push ecx
mov dword [ebp - 0x29c], eax
mov dword [esp], 0x11
call fcn.00401458
push ebx
mov ebx, eax
mov edx, dword [ebp - 0x2a0]
mov dword [esp], edx
mov dword [ebp - 0x2a4], edx
call fcn.0040a058
mov edx, dword [ebp - 0x2a4]
test edx, edx
mov dword [ebp - 0x2a0], eax
js 0x403473
add edx, dword [0x413024]
sub edx, 0x7fffffff
mov dword [esp + 8], 0x100022
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.00409b74
sub esp, 0x10
test eax, eax
jne 0x403675
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x2a4], eax
test eax, eax
je 0x403675
cmp edi, 1
jne 0x403515
mov dword [esp], 0x23
call fcn.00401458
push eax
mov dword [esp], 0x417100
call sub.KERNEL32.dll_lstrlenW
cmp esi, 1
push edx
mov edi, eax
mov dword [esp + 0x10], 0x417100
mov eax, dword [ebp - 0x29c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], eax
jne 0x40350c
mov dword [esp], str.WriteRegStr:___s_s____s___s_
call fcn.0040a271
lea eax, [edi + 1]
add eax, eax
jmp 0x403606
mov dword [esp], str.WriteRegExpandStr:___s_s____s___s_
jmp 0x4034fd
cmp edi, 4
jne 0x40355b
mov eax, 3
call fcn.004014aa
mov dword [0x417100], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], str.WriteRegDWORD:___s_s____s__0x_08x_
mov dword [esp + 4], eax
call fcn.0040a271
mov eax, 4
jmp 0x403606
xor eax, eax
cmp edi, 3
jne 0x403606
test esi, esi
mov edi, str.WriteRegNone
je 0x40357f
cmp esi, 7
mov edi, str.WriteRegMultiStr
mov eax, str.WriteRegBin
cmovne edi, eax
mov dword [esp + 0xc], 0x6000
xor eax, eax
mov dword [esp + 8], 0x417100
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x274]
mov dword [esp], eax
call fcn.0040466d
lea edx, [ebp - 0x268]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [ebp - 0x2a8], eax
mov dword [esp], edx
mov dword [esp + 8], 0x417100
mov dword [esp + 4], pe_nt_image_headers32
call fcn.0040a18e
lea edx, [ebp - 0x268]
mov dword [esp + 0x14], edx
mov eax, dword [ebp - 0x29c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], edi
mov dword [esp], str._s:___s_s____s___s_
mov dword [esp + 8], eax
call fcn.0040a271
mov eax, dword [ebp - 0x2a8]
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x417100
mov eax, dword [ebp - 0x29c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
mov esi, eax
je 0x403667
mov eax, dword [ebp - 0x29c]
mov esi, 1
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], str.WriteReg:_error_writing_into___s_s____s_
mov dword [esp + 4], eax
call fcn.0040a271
mov eax, dword [ebp - 0x2a4]
mov dword [esp], eax
jmp 0x403750
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x2a0]
mov dword [esp], str.WriteReg:_error_creating_key___s_s_
mov dword [esp + 4], eax
call fcn.0040a271
jmp 0x401d0c
mov dword [esp], 0x20019
call fcn.004014dd
push edx
mov ebx, eax
mov dword [esp], 0x33
call fcn.00401458
test ebx, ebx
push ecx
mov word [edi], 0
je 0x401d0c
mov dword [ebp - 0x288], 0x2000
lea edx, [ebp - 0x288]
xor esi, esi
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x268]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40370e
mov eax, dword [ebp - 0x268]
cmp eax, 4
je 0x40371f
cmp eax, 1
je 0x40371a
cmp eax, 2
je 0x40373e
mov word [edi], 0
mov esi, 1
jmp 0x40374d
cmp eax, 4
jne 0x40373e
mov eax, dword [edi]
cmp dword [ebp - 0x270], 0
mov dword [esp], edi
mov dword [esp + 4], eax
sete dl
movzx esi, dl
call fcn.00409c82
push ecx
push ecx
jmp 0x40374d
mov esi, dword [ebp - 0x270]
mov word [edi + 0x1ffe], 0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4040d5
mov dword [esp], 0x20019
call fcn.004014dd
push edx
mov ebx, eax
mov eax, 3
call fcn.004014aa
test ebx, ebx
mov word [edi], 0
je 0x401d0c
cmp dword [ebp - 0x270], 0
mov dword [ebp - 0x268], 0xfff
je 0x4037b4
mov dword [esp + 0xc], 0xfff
xor esi, esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
sub esp, 0x10
jmp 0x403744
mov dword [esp + 8], edi
lea edx, [ebp - 0x268]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
setne dl
movzx esi, dl
jmp 0x403744
mov dword [esp], edi
call fcn.00409ca7
push ebx
test eax, eax
je case.0x40175d.67
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403fab
mov dword [esp], 0xffffffed
call fcn.00401458
push ecx
mov edx, dword [ebp - 0x278]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x27c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00409895
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402b51
jmp 0x401d07
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x29c], eax
test eax, eax
je 0x403876
mov eax, 1
call fcn.004014aa
cmp ebx, 0x38
setne dl
movzx esi, dl
inc esi
mov word [0x415100], ax
jmp 0x4038cf
cmp ebx, 0x38
jne 0x4038b6
mov dword [esp], 0x21
call fcn.00401458
push esi
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x415100
mov dword [esp], 0x417100
call fcn.00409dcd
mov dword [esp], 0x415100
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
mov esi, eax
jmp 0x4038cf
mov dword [esp], 0x11
call fcn.00401458
push edx
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenW
lea esi, [eax + eax]
push ecx
cmp word [edi], 0
je 0x401d0c
mov dword [esp], edi
call fcn.00409ca7
push edi
mov edi, eax
xor eax, eax
cmp ebx, 0x38
sete al
or eax, dword [ebp - 0x29c]
je 0x403912
mov dword [esp + 8], esi
mov dword [esp + 4], 0x415100
mov dword [esp], edi
call fcn.00409997
sub esp, 0xc
test eax, eax
jmp 0x403b7b
cmp dword [ebp - 0x274], 0
je 0x4038f4
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.004099db
push ebx
test eax, eax
push ebx
jns 0x4038f4
jmp 0x401d0c
mov eax, 2
call fcn.004014aa
test eax, eax
jle case.0x40175d.67
cmp word [edi], 0
je 0x4040db
mov dword [esp], edi
mov edx, 0xfff
cmp eax, edx
mov esi, edx
cmovle esi, eax
xor ebx, ebx
call fcn.00409ca7
xor ecx, ecx
push edx
mov edi, eax
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x2a0], 2
cmp dword [ebp - 0x284], 0x39
mov edx, dword [ebp - 0x274]
jne 0x403a7a
mov dword [esp], edi
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], eax
mov eax, 2
sub eax, edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x288]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403b6b
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x403b6b
mov dword [ebp - 0x2a0], eax
movzx eax, byte [ebp - 0x288]
cmp dword [ebp - 0x274], 0
mov word [ebp - 0x28c], ax
jne 0x403abf
mov dword [esp + 0x14], 1
lea eax, [ebp - 0x28c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x268]
mov dword [esp + 4], 8
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x288]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
jne 0x403abf
dec dword [ebp - 0x268]
mov word [ebp - 0x28c], 0xfffd
je 0x403abf
dec dword [ebp - 0x2a0]
xor ecx, ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0x2a0]
mov dword [esp], edi
neg eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x4039f4
or edx, ebx
je 0x403aa4
mov dword [esp + 8], 2
lea eax, [ebp - 0x28c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00409953
sub esp, 0xc
test eax, eax
jne 0x403abf
jmp 0x403b6b
mov dword [esp], edi
xor eax, eax
mov dword [esp + 4], eax
call fcn.004099db
push edx
test eax, eax
push edx
jns 0x403a7e
xor ebx, ebx
jmp 0x403b6b
cmp dword [ebp - 0x274], 0
movzx eax, word [ebp - 0x28c]
je 0x403ae8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409c82
push ebx
push ebx
jmp 0x4041a9
cmp dword [ebp - 0x2a4], 0xd
je 0x403afa
cmp dword [ebp - 0x2a4], 0xa
jne 0x403b4c
cmp dword [ebp - 0x2a4], eax
je 0x403b0c
cmp eax, 0xd
je 0x403b34
cmp eax, 0xa
je 0x403b34
mov dword [esp + 0xc], 1
xor ecx, ecx
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0x2a0]
mov dword [esp], edi
neg eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x403b6b
mov ecx, dword [ebp - 0x29c]
add ebx, ebx
mov word [ecx + ebx], ax
mov word [ecx + ebx + 2], 0
jmp case.0x40175d.67
mov ecx, dword [ebp - 0x29c]
inc ebx
test eax, eax
mov word [ecx + ebx*2 - 2], ax
je 0x403b6b
cmp ebx, esi
je 0x403b6d
mov dword [ebp - 0x2a4], eax
jmp 0x403979
mov esi, ebx
mov eax, dword [ebp - 0x29c]
test esi, esi
mov word [eax + esi*2], 0
sete dl
movzx esi, dl
jmp 0x4041a3
cmp word [edi], 0
je case.0x40175d.67
mov eax, 2
mov esi, dword [ebp - 0x274]
call fcn.004014aa
mov dword [esp], edi
mov ebx, eax
call fcn.00409ca7
xor edx, edx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp dword [ebp - 0x27c], 0
js case.0x40175d.67
jmp 0x404139
mov dword [esp], edi
call fcn.00409ca7
push ebx
test eax, eax
je case.0x40175d.67
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x403fab
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409ca7
push ecx
test eax, eax
je 0x401d07
mov dword [esp], eax
lea edx, [ebp - 0x268]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push edx
test eax, eax
push edx
je 0x401d07
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00409d52
push edi
push edi
xor esi, esi
jmp 0x4041a3
mov dword [esp], 2
call fcn.00401458
lea edx, [ebp - 0x268]
push ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push esi
cmp eax, 0xffffffff
push esi
jne 0x403c74
mov eax, dword [ebp - 0x29c]
mov word [eax], 0
jmp 0x401d07
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409c82
push ecx
push ecx
jmp 0x403c22
mov dword [esp], 0xfffffff0
call fcn.00401458
push edi
mov ebx, eax
mov dword [esp], eax
call fcn.004096b0
push edx
test eax, eax
jne 0x403cb3
mov dword [esp], 0xffffffed
call fcn.00401458
push esi
mov dword [esp], ebx
call fcn.004097fc
push ecx
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call fcn.00409895
mov dword [ebp - 0x29c], eax
sub esp, 0xc
inc eax
jne 0x403cfd
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xfffffd66
mov dword [esp], str.created_uninstaller:__d____s_
call fcn.0040a271
jmp 0x403e6c
cmp dword [ebp - 0x278], 0
mov edx, dword [ebp - 0x27c]
je 0x403e1c
mov dword [ebp - 0x2a4], edx
mov eax, dword [0x41d128]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2a0], eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call edi
push edx
test eax, eax
push edx
mov esi, eax
mov edx, dword [ebp - 0x2a4]
je 0x403e1c
xor eax, eax
mov dword [esp], eax
call fcn.0040446f
push edx
mov eax, dword [ebp - 0x2a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00404447
push ecx
push ecx
mov eax, dword [ebp - 0x278]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call edi
push edi
test eax, eax
push edi
mov edi, eax
je 0x403df0
mov eax, dword [ebp - 0x278]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call fcn.0040466d
mov eax, edi
sub esp, 0x10
cmp byte [eax], 0
je 0x403de6
mov ecx, dword [eax]
lea edx, [eax + 8]
mov dword [esp + 8], ecx
mov dword [ebp - 0x2a8], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x2a4], edx
mov ecx, dword [eax + 4]
add ecx, esi
mov dword [esp], ecx
call fcn.004097df
mov edx, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x2a8]
lea eax, [edx + ecx]
sub esp, 0xc
jmp 0x403da7
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409997
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or edx, 0xffffffff
push eax
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
xor esi, esi
mov eax, dword [ebp - 0x29c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040466d
mov edi, eax
mov eax, dword [ebp - 0x29c]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], str.created_uninstaller:__d____s_
call fcn.0040a271
test edi, edi
mov eax, 0xfffffff3
jns 0x403e80
mov dword [esp], ebx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0xffffffef
push ecx
mov dword [esp], eax
call fcn.004016cf
jmp 0x4040d5
test edx, edx
je 0x403ee0
mov dword [esp + 4], eax
mov dword [esp], str.settings_logging_to__d
call fcn.0040a271
mov eax, dword [ebp - 0x27c]
mov dword [0x446360], eax
mov dword [esp + 4], eax
mov dword [esp], str.logging_set_to__d
call fcn.0040a271
cmp dword [ebp - 0x27c], 0
je 0x403ecf
call fcn.00406785
jmp case.0x40175d.67
mov dword [esp], 1
call fcn.00409f6a
jmp 0x403fab
mov dword [esp], 1
call fcn.00401458
push edx
mov dword [esp + 4], eax
mov dword [esp], 0x40f5cc
call fcn.0040a271
jmp case.0x40175d.67
xor eax, eax
call fcn.004014aa
cmp eax, dword [0x41d14c]
mov edi, eax
jae 0x401d0c
imul ebx, eax, 0x2018
mov eax, dword [ebp - 0x278]
add ebx, dword [0x41d148]
test eax, eax
js 0x403f4b
mov eax, dword [ebx + eax*4]
jne 0x404139
add ebx, 0x18
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
jmp 0x403c2f
not eax
mov dword [ebp - 0x278], eax
test eax, eax
je 0x403f69
mov eax, 1
call fcn.004014aa
mov dword [ebp - 0x27c], eax
jmp 0x403f87
mov eax, dword [ebp - 0x270]
mov dword [esp + 4], eax
lea eax, [ebx + 0x18]
mov dword [esp], eax
call fcn.0040a4b7
push eax
push eax
or dword [ebx + 8], 0x100
mov edx, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x278]
mov dword [ebx + eax*4], edx
cmp dword [ebp - 0x274], 0
je case.0x40175d.67
mov dword [esp], edi
call fcn.00401258
push esi
jmp case.0x40175d.67
xor eax, eax
call fcn.004014aa
cmp eax, 0x1f
ja 0x401d0c
cmp dword [ebp - 0x274], 0
mov ecx, dword [ebp - 0x278]
je 0x404000
test ecx, ecx
je 0x403ff0
mov dword [esp], eax
xor ebx, ebx
call fcn.0040137c
push ecx
mov dword [esp + 4], ebx
mov dword [esp], ebx
call fcn.004012c9
jmp 0x403c34
xor eax, eax
mov dword [esp], eax
call fcn.004013d5
push edx
jmp 0x404139
mov edx, dword [0x41d130]
lea eax, [eax + 0x24]
test ecx, ecx
je 0x40401c
mov ecx, dword [ebp - 0x27c]
mov dword [edx + eax*4 + 4], ecx
jmp case.0x40175d.67
mov eax, dword [edx + eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.0040a4b7
jmp 0x403c34
mov esi, dword [ebp - 0x274]
test esi, esi
je 0x40404d
dec esi
je 0x4040eb
jmp case.0x40175d.67
mov dword [esp], 5
call fcn.0040a444
push ecx
mov ebx, eax
mov dword [esp], 0x22
call fcn.00401458
test ebx, ebx
push edi
je 0x4040db
lea edi, [ebp - 0x268]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ole32.dll_IIDFromString]
push edx
test eax, eax
push edx
js 0x4040db
lea eax, [ebp - 0x288]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x274]
mov dword [esp], edi
mov dword [esp + 4], eax
call ebx
sub esp, 0x10
test eax, eax
js 0x4040db
mov eax, dword [ebp - 0x288]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00409d52
push eax
push eax
mov eax, dword [ebp - 0x288]
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
jmp 0x4041a3
mov eax, dword [ebp - 0x29c]
mov word [eax], 0
jmp 0x401d0c
mov eax, 2
xor esi, esi
call fcn.004014aa
mov ebx, eax
mov eax, 4
call fcn.004014aa
mov dword [ebp - 0x268], esi
movzx edx, al
shr eax, 0x18
test ebx, ebx
jne 0x404118
mov ebx, 0x413020
mov dword [esp + 8], edx
add ebx, eax
mov dword [esp + 4], ebx
lea eax, [ebp - 0x268]
mov dword [esp], eax
call fcn.004097df
mov eax, dword [ebp - 0x268]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
jmp 0x402b58
xor ecx, ecx
mov dword [esp + 0xc], ecx
and edx, dword [0x4352a0]
mov dword [esp + 4], 0xb
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
cmp dword [ebp - 0x280], 0
je case.0x40175d.67
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
jmp case.0x40175d.67
add dword [0x413028], esi
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4