Function at 0x401459
Capabilities:
Set file attributes

Disassembly:
test esi, esi
jl 0x40142a
mov eax, esi
mov ecx, dword [0x423e90]
imul eax, eax, 0x1c
add eax, ecx
cmp dword [eax], 1
je 0x40142a
push eax
call int.00401459
cmp eax, 0x7fffffff
je 0x401423
push eax
call fcn.00401390
test eax, eax
jne 0x4013e4
push 1
inc esi
pop eax
jmp 0x4013eb
dec eax
mov ecx, esi
mov esi, eax
sub eax, ecx
cmp dword [esp + 0xc], 0
je 0x4013b1
add dword [0x42364c], eax
push 0
inc edx
add byte [edx], ch
push dword [0x423634]
push 0x7530
push dword [0x42364c]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
push 0x40a
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4013b1
clc
invalid
xor eax, eax
pop esi
ret 8
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x423e68]
push ebx
jbe 0x4013f5
jne 0x401474
push edi
push 7
pop ecx
lea edi, [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
fmul qword [ebx - 0xf741fab]
mov edi, edx
shl esi, 0xa
mov ecx, section..ndata
mov dword [ebp - 4], ebx
shl edi, 0xa
add esi, ecx
add edi, ecx
lea ecx, [ebp - 0x24]
mov dword [0x409b48], ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffffe
cmp ecx, 0x41
ja case.0x4014ae.65
inc ebp
int3
jmp dword [ecx*4 + 0x4028e3]
push ebx
push eax
jmp 0x40186c
inc dword [ebp + 0x2c]
ret 0x3900
push eax
call fcn.00401390
dec eax
push ebx
push eax
call fcn.004013ac
jmp case.0x4014ae.2
push ebx
push eax
call fcn.00404e23
jmp case.0x4014ae.65
push ebx
call fcn.00402a1f
cmp eax, 1
jg 0x401504
push 1
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
imul eax, ecx, 0xff008013
push dword [ebp - 0x34]
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x4014ae.65
cmp dword [ebp - 0x1c], ebx
jne 0x401548
shl eax, 2
push 1
mov ecx, dword [eax + 0x423ee0]
mov dword [eax + 0x23f20], ecx
call fcn.00402a1f
or eax, dword [ebp - 0x24]
mov dword [ecx*4 + 0x403ee0], eax
jmp case.0x4014ae.65
shl eax, 2
mov ecx, dword [eax + 0x423f20]
mov dword [eax + 0x423ee0], ecx
jmp case.0x4014ae.65
mov esp, dword [ebp - 0x1c]
mov ecx, dword [eax*4 + 0x423ee0]
lea esi, [eax*4 + 0x423ee1]
xor eax, eax
cmp ecx, ebx
dec edi
xchg esp, eax
shl byte [ebx], 0x4d
call 0xdcc55a06
mov dword [esi], ecx
jmp case.0x4014ae.2
push dword [edx*4 + 0x423ec0]
push esi
jmp 0x402879
mov ecx, dword [0x423630]
stosd dword es:[edi], eax
xor eax, sym.imp.USER32.dll_ShowWindow
sub ecx, ebx
je 0x4015a6
pop edx
push ecx
call esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x10423644]
cmp ecx, ebx
je case.0x4014ae.65
push eax
push ecx
call esi
jmp case.0x4014ae.65
push 0xfffffffffffffff0
call fcn.00402a3c
push dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4028c9
jmp 0x4026a2
push 0xfffffffffffffff0
call 0x40263c
mov edi, eax
push edi
call fcn.00405637
mov esi, eax
cmp esi, ebx
je 0x4015f2
push 0x5c
push esi
clc
salc
aas
add byte [eax], al
mov esi, eax
push ebx
push edi
lcall 0xe355, 0xbf1e8806
pop eax
hlt
push eax
ret
push ss
adc byte [edx + 0x10], dh
fild word [ebx - 0x2f]
sal dword [edx - 0x43910ec5], cl
cmp al, 0xb1
adc ebx, dword [ebx]
pop es
lahf
scasd eax, dword es:[edi]
mov ebp, 0x2bc2dff9
arpl word [0x5ca27abc], sp
and dword [ecx - 0x5a], ebx
cmp dword ss:[ecx + 0x6d], eax
cmp bl, byte [esi]
lock xor bh, byte ds:[ebp - 0xd]
push eax
wait
add bl, byte [edi]
sub ah, dh
lcall 0xaeb5, 0x3a8bd3c6
iretd
jmp 0x401730
xchg esp, eax
sal dword [eax + 0x2bcee27b], cl
ficomp dword [edi - 0x67]
push eax
push edx
jle 0x4016a8
inc esi
xchg ebx, eax
xchg ecx, eax
cmp byte [edx - 0x50df4456], al
add al, 0x81
mov cl, 0x56
jecxz 0x40173d
mov esp, 0x5f3df418
xchg byte [eax + ebp*4 - 1], bl
imul esp, dword [esi + 0x2f2652ff], 0x5ac6afcf
adc al, 0xf5
dec edi
xchg ebp, eax
aas
adc ebx, ebp
fucomp st(1)
ror esp, cl
push cs
push es
scasd eax, dword es:[edi]
invalid
fucomp st(1)
ror esp, cl
push cs
push es
pop es
int 0xc9
not byte [ebx + 0x66]
pop ecx
jmp dword [ecx]
and dword [ecx + 0x42], edx
push ds
jae 0x401719
mov byte [ecx - 0x3b], bh
mov ecx, 0xadd75b55
lodsd eax, dword [esi]
push cs
in eax, 0xab
cmp dword [ecx + 0x17], 0x3a7fb1da
cdq
or dword [edi], eax
fidiv dword [ecx + 0x9993a7f]
add al, 0x67
adc byte [ecx + 0x2d772dee], cl
mov edx, 0x7493291d
arpl word [edi - 0x5e], di
leave
cmp dword [0x31feb1d4], esi
jecxz 0x4016ec
xor bl, byte [eax + 0x45cd410a]
or al, byte [ecx - 0x33]
inc ebp
rcl bl, 1
invalid
mov eax, 0x8373694b
shr byte [edx], cl
ret
cmc
inc edi
out 0xcd, eax
int 0x3a
stosd dword es:[edi], eax
aam 0xc3
xchg byte [eax], bl
int 0x3a
stosd dword es:[edi], eax
aam 0xc3
xchg byte [eax], bl
xor ebp, ecx
invalid
inc edx
fld qword [eax]
popfd
lcall 0xf5cb, 0x2dc607f2
lds ebp, [edi - 0x27de53e7]
adc byte [ecx], 0xa5
inc edx
lcall 0x2b3, 0x3fab090
mov dl, ch
outsb dx, byte [esi]
dec esi
insd dword es:[edi], dx
salc
fcmovnb st(0), st(3)
out 0xcc, al
int3
cli
cmp ah, byte [0x53a54a9b]
int3
push ebx
pushal
loope 0x401921
ficomp dword [edi + edx*2 - 0x17]
adc byte [edx - 0x54a7e29e], dh
add ebp, ebx
in eax, dx
mov ah, 0x23
and byte [edx], dh
je 0x40199a
adc al, 5
xor dword [edi - 0x2f], ebp
enter 0x15bc, 0xffffffffffffffaa
stosb byte es:[edi], al
stosb byte es:[edi], al
jge 0x40194f
jns 0x4019b0
push eax
jns 0x40199d
loopne 0x4019ac
xchg byte [ebx - 0x75e6cf02], dh
mov bl, 0xb6
div esi
popfd
mov bl, 0xfe
xor byte [ecx], bl
mov dh, byte [ebx - 0x6209084a]
dec edx
xchg esp, eax
bound esp, qword [edx + edi]
pushal
jl 0x40197b
aaa
cmp edi, eax
push es
cmp eax, 0xa1fc8c8b
leave
scasd eax, dword es:[edi]
xor eax, 0x472a1969
sbb dword [edx], ebp
inc edi
add al, 0x2a
xor byte [esi - 0x54], bl
shl byte [edi + 0x7e], 1
hlt
jge 0x401987
mov ebx, 0xe240b92b
add dword [edx], 0xcb35bfcf
in al, dx
in al, dx
xchg edx, eax
sub eax, 0x49d22f63
jle 0x4019e0
mov ecx, 0x281e240
iretd
lcall 0x27b0, 0x172001a5
sahf
push ecx
cmp byte [ebx], dl
loope 0x401a2b
je 0x401a38
out dx, al
push edx
dec ecx
sbb ebp, ebx
dec edi
adc edi, eax
cmc
mov bl, 0x51
mov ebx, 0x515dfec6
pop ebp
push ecx
adc edi, 0x45
pop ss
call [edi]
nop
in eax, 0xa3
stosb byte es:[edi], al
sti
jae 0x4019e6
adc bl, dl
aas
sar dword [edi], cl
or byte [ecx], ah
insb byte es:[edi], dx
dec ebp
cli
push ebx
adc al, byte [esi - 0x35]
imul byte [esi]
sub dword [0x6dfcff92], esi
mul ebx
xchg esp, eax
xchg esp, eax
or dl, bl
xchg edx, eax
wait
pop esp
sub byte [ebp + ebp*2 + 0x1e95ad08], 0xf6
xor ebx, dword [0x295a4ecb]
xchg ebp, eax
push ds
div byte [ebx]
sbb eax, 0x295a4ecb
ja 0x401a40
xor dword [edx + ebx*4], esp
adc byte [ecx + 0x3543afe], dh
invalid
cmp dl, byte [ebx + eax - 0x4c]
xchg esi, eax
pop esi
pop ecx
fild dword [di + 0x475a]
invalid
test dword [edx + 0x47], ebx
dec eax
and ebx, dword [edx + edi]
jmp 0x587e6b82
scasb al, byte es:[edi]
mov ah, 0x9d
int 0x2a
sbb eax, 0xe991aed5
and eax, 0xf5150931
call 0xf731b2b4
pop edi
add al, 0x33
cmp eax, 0xea346709
xchg ecx, eax
jmp 0x9714039
cwde
int1
neg byte [edi + 4]
xor edi, dword [0xea346709]
out dx, al
enter 0xffffffffffff979a, 0x5e
mov ecx, ebx
das
jge 0x401a49
outsb dx, byte [esi]
and al, 0x78
js 0x4019f6
js 0x4019f6
jnp 0x401a49
and al, 0xa7
outsd dx, dword [esi]
push cs
or eax, 0xec09c6a9
pop edx
mov cl, 0xc5
inc eax
and byte [edi], ch
dec esi
salc
pop eax
fnsave dword [esp + ecx*8 + 0x11f85b88]
neg byte [edx + 0x38]
sbb ch, byte [edi - 5]
adc dword gs:[edi + 2], edi
hlt
outsb dx, byte [esi]
and dword [edi], ebp
mov al, byte [0xaf18b058]
adc byte [0xd841022f], al
jbe 0x401aa3
cli
push ebp
mov eax, 0x3392c174
push es
pushal
lahf
inc ebp
stc
inc ebx
mov dh, 7
les ebx, [eax + 0x1372ead5]
daa
mov byte [ecx - 8], cl
and byte [ecx], ah
push ebp
or edx, ecx
salc
push 0x21
ret 0x5db7
invalid
mov dl, byte [esi]
sub eax, 0xed0cee9
push es
lodsb al, byte [esi]
frstor dword [ebx]
nop
retf
adc al, 0x99
sub eax, ecx
pop ecx
xchg esp, eax
dec edi
sbb al, 0xe8
shr dword [eax + 0x7c2eba1b], cl
mov esi, 0xa8d878a
fdivrp st(6)
jmp 0x401b0b
test eax, ecx
loope 0x401c15
imul esp, dword [edi], 0x673f104e
rcl byte [esi]
in eax, dx
adc dword [edx - 0x35291083], esi
cld
xchg esi, eax
outsd dx, dword [esi]
scasd eax, dword es:[edi]
loop 0x401ba6
jge 0x401ba4
salc
retf 0x96fc
xchg esp, eax
lodsb al, byte [esi]
push ss
mov ah, 0x73
add dl, byte [edi]
dec esp
pop dword [ebx]
salc
iretd
lodsd eax, dword [esi]
popal
femms
hlt
push 0x44
call fcn.00402a3c
mov dword [ebp + 8], eax
cmp dword [ebp - 0x28], 0x21
push 1
jne 0x401c71
call fcn.00402a1f
push 2
mov edi, eax
call fcn.00402a1f
mov ecx, dword [ebp - 0x10]
test ecx, 0xfffffffc
je 0x401c61
lea edx, [ebp - 8]
sar ecx, 2
push edx
push ecx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x34]
push eax
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
jmp 0x401ca0
push dword [ebp + 8]
push dword [ebp - 0x34]
push eax
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x401c9d
call fcn.00402a3c
push 0x12
mov edi, eax
call fcn.00402a3c
mov cl, byte [eax]
neg cl
sbb ecx, ecx
and ecx, eax
mov al, byte [edi]
neg al
sbb eax, eax
push ecx
and eax, edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x24], ebx
jl case.0x4014ae.65
push dword [ebp - 8]
jmp 0x401589
push ebx
call fcn.00402a1f
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401a11
mov eax, dword [ebp - 0x20]
jmp case.0x4014ae.2
push 2
call fcn.00402a1f
push eax
push 1
call fcn.00402a1f
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x4024fc
mov eax, dword [0x423ea8]
add eax, edx
push eax
push 0xffffffffffffffeb
push ebx
call fcn.00402a1f
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x4014ae.65
push edx
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x34]
push 0x10
imul eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x1c]
push eax
push ebx
push ebx
call fcn.00402a3c
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push ebx
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
je case.0x4014ae.65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x4014ae.65
push 0x48
push 0x5a
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 2
call fcn.00402a1f
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 3
mov dword [0x40af50], eax
call fcn.00402a1f
mov dword [0x40af60], eax
mov al, byte [ebp - 0x14]
push dword [ebp - 0x20]
mov cl, al
and cl, 1
mov byte [0x40af67], 1
mov byte [0x40af64], cl
mov cl, al
and cl, 2
and al, 4
push 0x40af6c
mov byte [0x40af65], cl
mov byte [0x40af66], al
call fcn.00405aee
push 0x40af50
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x4024fc
push ebx
call fcn.00402a1f
push 1
mov esi, eax
call fcn.00402a1f
cmp dword [ebp - 0x18], ebx
push eax
push esi
jne 0x401dfa
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x4014ae.65
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x4014ae.65
push ebx
call fcn.00402a3c
push 0x31
mov esi, eax
call fcn.00402a3c
push 0x22
mov ebx, eax
call fcn.00402a3c
push 0x15
mov edi, eax
call fcn.00402a3c
push 0xffffffffffffffec
call fcn.00401448
mov al, byte [edi]
push dword [ebp - 0x18]
neg al
sbb eax, eax
push 0x429800
and eax, edi
push eax
mov al, byte [esi]
neg al
sbb eax, eax
push ebx
and eax, esi
push eax
push dword [ebp - 0x34]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jge case.0x4014ae.65
jmp 0x4026a2
push ebx
call fcn.00402a3c
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.00404e23
push esi
call fcn.004052ef
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x4026a2
cmp dword [ebp - 0x1c], ebx
je 0x401ece
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push eax
call esi
cmp eax, 0x102
jne 0x401ea5
push 0xf
call fcn.00405e3f
push 0x64
push dword [ebp + 8]
jmp 0x401e8e
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x20], ebx
jl 0x401ec2
push dword [ebp - 8]
push edi
call fcn.00405a17
jmp 0x401ece
cmp dword [ebp - 8], ebx
je 0x401ece
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4014ae.65
push 2
call fcn.00402a3c
push eax
call fcn.00405ddf
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x401f03
mov ebx, eax
push dword [ebx + 0x14]
push edi
call fcn.00405a17
push dword [ebx + 0x18]
jmp 0x401589
mov byte [esi], bl
mov byte [edi], bl
jmp 0x4026a2
push 0xffffffffffffffee
call fcn.00402a3c
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov byte [esi], bl
cmp eax, ebx
mov dword [ebp - 8], eax
mov byte [edi], bl
mov dword [ebp - 4], 1
je case.0x4014ae.65
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp + 8], eax
je case.0x4014ae.65
push eax
push dword [ebp - 8]
push ebx
push dword [ebp - 0x2c]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401f8f
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x409010
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401f8f
mov eax, dword [ebp - 0x34]
push dword [eax + 8]
push esi
call fcn.00405a17
mov eax, dword [ebp - 0x34]
push dword [eax + 0xc]
push edi
call fcn.00405a17
mov dword [ebp - 4], ebx
push dword [ebp + 8]
jmp 0x401bb3
cmp dword [0x423f18], ebx
mov dword [ebp - 4], 1
jl 0x402060
push 0xfffffffffffffff0
call fcn.00402a3c
push 1
mov esi, eax
call fcn.00402a3c
cmp dword [ebp - 0x14], ebx
mov dword [ebp + 8], eax
je 0x401fcf
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, ebx
jne 0x401fdf
push 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
je 0x402059
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x40202c
cmp dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
je 0x40200e
push dword [ebp - 0x1c]
call fcn.00401448
call esi
test eax, eax
je 0x402036
mov dword [ebp - 4], 1
jmp 0x402036
push section..data
push 0x40af4c
push section..ndata
push 0x400
push dword [ebp - 0x34]
call esi
add esp, 0x14
jmp 0x402036
push dword [ebp + 8]
push 0xfffffffffffffff7
call fcn.00404e23
cmp dword [ebp - 0x18], ebx
jne case.0x4014ae.65
push edi
call fcn.0040351a
test eax, eax
je case.0x4014ae.65
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x4014ae.65
push 0xfffffffffffffff6
jmp 0x4021a8
push 0xffffffffffffffe7
jmp 0x4021a8
push 0xfffffffffffffff0
call fcn.00402a3c
push 0xffffffffffffffdf
mov dword [ebp - 0x30], eax
call fcn.00402a3c
push 2
mov esi, eax
call fcn.00402a3c
push 0xffffffffffffffcd
mov dword [ebp - 0x34], eax
call fcn.00402a3c
push 0x45
mov dword [ebp - 0x2c], eax
call fcn.00402a3c
push esi
mov dword [ebp - 0x44], eax
call fcn.00405610
test eax, eax
jne 0x4020a9
push 0x21
call fcn.00402a3c
lea eax, [ebp + 8]
push eax
push 0x407374
push 1
push ebx
push 0x407384
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x40219f
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x407394
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edi, eax
cmp edi, ebx
jl 0x402192
mov eax, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edi, eax
mov eax, dword [ebp + 8]
push 0x429800
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x14]
test ah, 0xff
je 0x402116
mov esi, dword [ebp + 8]
xor edx, edx
mov dl, ah
mov ecx, dword [esi]
push edx
push esi
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
sar eax, 0x10
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x34]
mov eax, dword [ebp - 0x2c]
cmp byte [eax], bl
je 0x40213e
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
and esi, 0xff
mov edx, dword [ecx]
push esi
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp + 8]
push dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
push dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
cmp edi, ebx
jl 0x402189
mov esi, 0x409348
push 0x400
push esi
push 0xffffffffffffffff
push dword [ebp - 0x30]
mov edi, 0x80004005
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x402189
mov eax, dword [ebp - 8]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp edi, ebx
jge 0x4021b2
mov dword [ebp - 4], 1
push 0xfffffffffffffff0
call fcn.00401448
jmp case.0x4014ae.65
push 0xfffffffffffffff4
jmp 0x4021a8
push ebx
call fcn.00402a3c
push 0x11
mov esi, eax
call fcn.00402a3c
push 0x23
mov edi, eax
call fcn.00402a3c
push esi
mov dword [ebp + 8], eax
call fcn.00405ddf
test eax, eax
jne 0x4021e8
push ebx
push 0xfffffffffffffff9
call fcn.00404e23
jmp 0x4026a2
mov eax, dword [ebp - 0x34]
push esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 2
call fcn.00405ad0
push edi
mov byte [eax + esi + 1], bl
call fcn.00405ad0
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x4a], eax
mov word [ebp - 0x54], cx
call fcn.00404e23
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.0x4014ae.65
jmp 0x4021db
cmp eax, 0xbadf00d
je 0x40225c
push 0x200010
push 0xffffffffffffffe8
push ebx
call fcn.00405aee
push eax
call fcn.0040535f
mov eax, 0x7fffffff
jmp case.0x4014ae.2
inc dword [0x423ef4]
jmp case.0x4014ae.65
xor esi, esi
xor edi, edi
cmp eax, ebx
je 0x40227a
push ebx
call fcn.00402a3c
mov edx, dword [ebp - 0x20]
mov esi, eax
cmp edx, ebx
je 0x402287
push 0x11
call fcn.00402a3c
mov edi, eax
cmp dword [ebp - 0x14], ebx
je 0x402295
push 0x22
call fcn.00402a3c
mov ebx, eax
push 0xffffffffffffffcd
call fcn.00402a3c
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4015ce
push 1
mov dword [ebp + 8], 0x7e4e21
call fcn.00402a3c
push 0x12
mov edi, eax
call fcn.00402a3c
push 0xffffffffffffffdd
mov dword [ebp - 0x30], eax
call fcn.00402a3c
push eax
push 0x3ff
lea eax, [ebp + 8]
push esi
push eax
push dword [ebp - 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
cmp eax, dword [ebp + 8]
jmp 0x40173e
cmp dword [ebp - 0x14], ebx
jne 0x40231b
push 2
call fcn.00402b52
mov esi, eax
cmp esi, ebx
je 0x4026a2
push 0x33
call fcn.00402a3c
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40233a
push 0x22
call fcn.00402a3c
mov ecx, dword [ebp - 0x14]
and ecx, 2
push ecx
push eax
push dword [ebp - 0x20]
call fcn.00402b3d
push eax
call fcn.00402a7c
mov edi, eax
cmp edi, ebx
je case.0x4014ae.65
jmp 0x4026a2
push eax
call fcn.00402b3d
mov esi, dword [ebp - 0x14]
mov edi, eax
mov eax, dword [ebp - 0x10]
push 2
mov dword [ebp - 0x30], eax
call fcn.00402a3c
push 0x11
mov dword [ebp - 0x44], eax
call fcn.00402a3c
lea ecx, [ebp + 8]
push ebx
push ecx
mov ecx, dword [0x423f10]
or ecx, 2
push ebx
push ecx
push ebx
push ebx
push ebx
push eax
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne case.0x4014ae.65
cmp esi, 1
mov edi, 0x40a34c
jne 0x4023ab
push 0x23
call fcn.00402a3c
push edi
call fcn.00405ad0
inc eax
cmp esi, 4
jne 0x4023be
push 3
call fcn.00402a1f
push esi
mov dword [0x40a34c], eax
pop eax
cmp esi, 3
jne 0x4023d2
push 0xc00
push edi
push ebx
push dword [ebp - 0x18]
call fcn.00402eb2
push eax
push edi
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x44]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4023eb
mov dword [ebp - 4], ebx
push dword [ebp + 8]
jmp 0x4024c1
push 0x20019
call fcn.00402b52
push 0x33
mov edi, eax
call fcn.00402a3c
cmp edi, ebx
mov byte [esi], bl
je 0x4026a2
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0x3ff
push ecx
lea ecx, [ebp + 8]
push esi
push ecx
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 1
test eax, eax
pop ecx
jne 0x402464
cmp dword [ebp + 8], 4
je 0x40244f
cmp dword [ebp + 8], ecx
je 0x402441
cmp dword [ebp + 8], 2
jne 0x402464
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov byte [eax + esi], bl
jmp 0x4024c0
push dword [esi]
xor eax, eax
cmp dword [ebp - 0x14], ebx
push esi
sete al
mov dword [ebp - 4], eax
call fcn.00405a17
jmp 0x4024c0
mov byte [esi], bl
mov dword [ebp - 4], ecx
jmp 0x4024c0
push 0x20019
call fcn.00402b52
push 3
mov edi, eax
call fcn.00402a1f
cmp edi, ebx
mov byte [esi], bl
je 0x4026a2
cmp dword [ebp - 0x14], ebx
mov ecx, 0x3ff
mov dword [ebp + 8], ecx
je 0x4024a1
push ecx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x4024ba
push ebx
push ebx
push ebx
lea ecx, [ebp + 8]
push ebx
push ecx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4026a2
mov byte [esi + 0x3ff], bl
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4014ae.65
cmp byte [esi], bl
je case.0x4014ae.65
push esi
call fcn.00405a30
push eax
jmp 0x401ed1
push 0xffffffffffffffed
call fcn.00402a3c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push eax
call fcn.0040578f
cmp eax, 0xffffffff
je 0x4026a0
push eax
jmp 0x401589
cmp dword [ebp - 0x1c], ebx
je 0x402518
push 1
call fcn.00402a1f
push 1
mov byte [0x409f4c], al
pop eax
jmp 0x402525
push 0x11
call fcn.00402a3c
push eax
call fcn.00405ad0
cmp byte [esi], bl
je 0x4026a2
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
push 0x409f4c
push esi
call fcn.00405a30
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4015ce
push 2
mov dword [ebp - 0x2c], ebx
call fcn.00402a1f
cmp eax, 1
mov dword [ebp - 0x34], eax
jl case.0x4014ae.65
mov ecx, 0x3ff
cmp eax, ecx
jle 0x40256c
mov dword [ebp - 0x34], ecx
cmp byte [esi], bl
je 0x402602
push esi
mov byte [ebp + 0xb], bl
call fcn.00405a30
cmp dword [ebp - 0x34], ebx
mov dword [ebp - 8], eax
jle 0x402602
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
push ebx
push eax
lea eax, [ebp - 9]
push 1
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402605
cmp dword [ebp - 0x30], 1
jne 0x402605
cmp dword [ebp - 0x18], ebx
jne 0x4025cc
cmp byte [ebp + 0xb], 0xd
je 0x4025dc
cmp byte [ebp + 0xb], 0xa
je 0x4025dc
mov al, byte [ebp - 9]
mov byte [esi + edi], al
inc esi
cmp al, bl
mov byte [ebp + 0xb], al
je 0x402605
cmp esi, dword [ebp - 0x34]
jl 0x402588
jmp 0x402605
movzx eax, byte [ebp - 9]
push eax
push edi
call fcn.00405a17
jmp 0x4028da
mov al, byte [ebp - 9]
cmp byte [ebp + 0xb], al
je 0x4025f2
cmp al, 0xd
je 0x4025ec
cmp al, 0xa
jne 0x4025f2
mov byte [esi + edi], al
inc esi
jmp 0x402605
push 1
push ebx
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x402605
mov esi, dword [ebp - 0x2c]
mov byte [esi + edi], bl
cmp esi, ebx
jmp 0x4015d0
cmp byte [esi], bl
je case.0x4014ae.65
push dword [ebp - 0x18]
push ebx
push 2
call fcn.00402a1f
push eax
push esi
call fcn.00405a30
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x20], ebx
jl case.0x4014ae.65
jmp 0x402877
cmp byte [esi], bl
je case.0x4014ae.65
push esi
call fcn.00405a30
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x4014ae.65
cmp byte [edi], bl
je 0x401744
lea eax, [ebp - 0x1a4]
push eax
push edi
call fcn.00405a30
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401744
lea eax, [ebp - 0x178]
jmp 0x4026bb
push 2
call fcn.00402a3c
lea ecx, [ebp - 0x1a4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4026ae
mov byte [edi], bl
mov byte [esi], bl
mov dword [ebp - 4], 1
jmp case.0x4014ae.65
push eax
push edi
call fcn.00405a17
lea eax, [ebp - 0x178]
push eax
push esi
jmp 0x4027f7
push 0xfffffffffffffff0
mov dword [ebp - 8], 0xfffffd66
call fcn.00402a3c
mov esi, eax
push esi
mov dword [ebp - 0x44], esi
call fcn.00405610
test eax, eax
jne 0x4026e6
push 0xffffffffffffffed
call fcn.00402a3c
push esi
call fcn.00405770
push 2
push 0x40000000
push esi
call fcn.0040578f
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4027a2
mov eax, dword [0x423e74]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x40
mov dword [ebp - 0x2c], eax
call esi
mov edi, eax
cmp edi, ebx
je 0x402799
push ebx
call fcn.004030d6
push dword [ebp - 0x2c]
push edi
call fcn.004030a4
push dword [ebp - 0x1c]
push 0x40
call esi
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x30], esi
je 0x402771
push dword [ebp - 0x1c]
push esi
push ebx
push dword [ebp - 0x20]
call fcn.00402eb2
cmp byte [esi], bl
je 0x402768
mov ecx, dword [esi]
mov eax, dword [esi + 4]
add esi, 8
push ecx
add eax, edi
push esi
push eax
mov dword [ebp - 0x38], ecx
call fcn.0040574a
add esi, dword [ebp - 0x38]
jmp 0x40274a
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp - 0x2c]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push ebx
push dword [ebp + 8]
push 0xffffffffffffffff
call fcn.00402eb2
mov dword [ebp - 8], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
push 0xfffffffffffffff3
pop esi
jge 0x4027bd
push 0xffffffffffffffef
pop esi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 1
push esi
jmp 0x4021a8
push ebx
call fcn.00402a1f
cmp eax, dword [0x423e8c]
mov dword [ebp + 8], eax
jae 0x4026a2
mov esi, eax
mov eax, dword [ebp - 0x1c]
imul esi, esi, 0x418
add esi, dword [0x423e88]
cmp eax, ebx
jl 0x402804
mov ecx, dword [esi + eax*4]
jne 0x402801
add esi, 0x18
push esi
push edi
call fcn.00405aba
jmp case.0x4014ae.65
push ecx
jmp 0x402878
or ecx, 0xffffffff
sub ecx, eax
mov dword [ebp - 0x1c], ecx
je 0x40281a
push 1
call fcn.00402a1f
mov dword [ebp - 0x20], eax
jmp 0x40282a
push dword [ebp - 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.00405aee
or byte [esi + 9], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [esi + eax*4], ecx
cmp dword [ebp - 0x18], ebx
je case.0x4014ae.65
push dword [ebp + 8]
call fcn.00401193
jmp case.0x4014ae.65
push ebx
call fcn.00402a1f
cmp eax, 0x20
jae 0x4026a2
cmp dword [ebp - 0x18], ebx
je 0x402880
cmp dword [ebp - 0x1c], ebx
je 0x402871
push eax
call fcn.004012b1
push ebx
push ebx
call fcn.00401205
jmp case.0x4014ae.65
push ebx
call fcn.004012fa
push eax
push edi
call fcn.00405a17
jmp case.0x4014ae.65
cmp dword [ebp - 0x1c], ebx
je 0x402897
mov edx, dword [0x423e70]
mov ecx, dword [ebp - 0x20]
mov dword [edx + eax*4 + 0x94], ecx
jmp case.0x4014ae.65
mov ecx, dword [0x423e70]
push dword [ecx + eax*4 + 0x94]
push edi
call fcn.00405aee
jmp case.0x4014ae.65
mov ecx, dword [0x421460]
push ebx
and ecx, eax
push ecx
push 0xb
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x24], ebx
je case.0x4014ae.65
push ebx
push ebx
push dword [ebp - 0x34]
jne 0x402897
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 4]
add dword [0x423ee8], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4