Function at 0x4014cf
Capabilities:
Copy file
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x298
mov eax, dword [esp + 0x2ac]
mov ecx, dword [0x40a008]
mov ecx, dword [ecx]
mov dword [esp + 4], ecx
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0xc]
lea eax, [esp + 0x14]
movups xmmword [eax - 4], xmm0
movups xmmword [eax + 8], xmm1
mov esi, dword [eax - 4]
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
mov dword [0x42c138], eax
lea eax, [esi - 2]
mov dword [esp], 0
cmp eax, 0x44
ja case.0x40153c.67
mov ecx, dword [0x40ae14]
mov ecx, dword [ecx]
mov edx, ebp
shl edx, 0xe
add edx, ecx
mov edi, ebx
shl edi, 0xe
add edi, ecx
mov dword [esp], 0
jmp dword [eax*4 + 0x40a010]
mov dword [esp + 8], edx
mov ecx, 3
call fcn.00403795
mov ebx, eax
mov ecx, 4
call fcn.00403795
mov ebp, eax
mov eax, dword [esp + 0x28]
test al, 1
je 0x40157f
mov eax, dword [0x42c138]
push dword [eax + 0xc]
push 0x4240f8
call fcn.00407b7f
mov ebx, eax
mov eax, dword [esp + 0x28]
test al, 2
je 0x401597
mov eax, dword [0x42c138]
push dword [eax + 0x10]
push 0x4280f8
call fcn.00407b7f
mov ebp, eax
cmp dword [esp + 0x10], 0x21
jne 0x401795
xor ecx, ecx
inc ecx
call fcn.00403795
mov esi, eax
mov ecx, 2
call fcn.00403795
mov ecx, dword [esp + 0x28]
cmp ecx, 4
jae 0x402c3e
push ebp
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x48], eax
xor edi, edi
jmp 0x402c5c
mov ebp, dword [esp + 0x1c]
cmp esi, 0x38
sete byte [esp]
test ebp, ebp
mov dword [esp + 8], edx
je 0x402c07
xor ecx, ecx
inc ecx
call fcn.00403795
xor ecx, ecx
cmp esi, 0x38
mov word [0x41c0f8], ax
setne cl
inc ecx
jmp 0x402d73
mov ecx, 2
mov esi, edx
call fcn.00403795
mov dword [esp], 0
test eax, eax
jle case.0x40153c.67
mov ecx, esi
mov edx, 0x1fff
cmp eax, edx
cmovl edx, eax
mov dword [esp + 4], edx
cmp word [esi], 0
je 0x402d28
mov ebp, 2
push ecx
call fcn.00407fd5
mov dword [esp], eax
xor esi, esi
mov ebx, edi
xor edi, edi
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x10], 0x39
jne 0x40171f
mov eax, 2
sub eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x4c]
push ecx
push eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403470
mov ebp, dword [esp + 0x48]
test ebp, ebp
je 0x403470
movzx eax, byte [esp + 0x34]
mov word [esp + 0xc], ax
cmp dword [esp + 0x20], 0
jne 0x40338e
mov dword [esp + 0x30], esi
mov dword [esp + 8], edi
push 1
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x40]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401711
xor edi, edi
inc edi
sub edi, ebp
mov word [esp + 0xc], 0xfffd
dec dword [esp + 0x48]
je 0x401711
dec ebp
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
lea eax, [esp + 0x40]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc edi
test eax, eax
je 0x4016d4
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
jmp 0x401752
mov eax, dword [esp + 0x20]
or eax, edi
jne 0x40173a
push 0
push dword [esp + 4]
call fcn.004078e6
test eax, eax
js 0x403723
push 2
lea eax, [esp + 0x10]
push eax
push dword [esp + 8]
call fcn.00407882
test eax, eax
je 0x403470
cmp dword [esp + 0x20], 0
jne 0x40338e
cmp si, 0xd
je 0x403316
movzx eax, si
cmp eax, 0xa
je 0x403316
movzx esi, word [esp + 0xc]
mov word [ebx + edi*2], si
inc edi
test si, si
je 0x403470
cmp edi, dword [esp + 4]
jl 0x401658
jmp 0x403470
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x4180f8
call fcn.00407b7f
mov esi, eax
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x41c0f8
call fcn.00407b7f
xor ecx, ecx
cmp word [esi], 0
cmove esi, ecx
cmp word [eax], 0
mov edi, 0
cmove eax, ecx
push eax
push esi
push ebp
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x48], eax
jmp 0x402c5c
mov ebx, edi
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x40316f
mov dword [esp], 0
test eax, eax
jne case.0x40153c.67
push 5
call fcn.00406f78
mov esi, eax
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x4200f8
call fcn.00407b7f
test esi, esi
je 0x403273
lea edi, [esp + 0x48]
push edi
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x403273
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x28]
push edi
call esi
test eax, eax
js 0x403273
push dword [esp + 0xc]
push ebx
call fcn.0040746d
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x403564
push 0x20019
mov esi, edx
call fcn.004037b2
mov edi, eax
mov eax, dword [0x42c138]
push dword [eax + 0xc]
push 0x4240f8
call fcn.00407b7f
mov word [esi], 0
test edi, edi
je 0x4034ef
mov ebx, esi
lea ecx, [esp + 0x48]
mov dword [ecx], 0x4000
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x403296
mov word [ebx], 0
xor ebp, ebp
inc ebp
jmp 0x403541
mov esi, edx
push 0xffffffffffffffed
call fcn.00403755
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call fcn.004077e2
cmp eax, 0xffffffff
jne 0x401ec3
jmp 0x4029af
mov dword [esp + 0x2c], edi
push ebp
push 0x4180f8
call fcn.00407b7f
mov edi, eax
push eax
push str.Exec:_command__s_
call fcn.004074c0
add esp, 8
push edi
push 0xffffffffffffffeb
call fcn.00406b09
push edi
call fcn.00406fb1
test eax, eax
je 0x402dd3
mov esi, eax
push edi
push str.Exec:_success____s__
call fcn.004074c0
add esp, 8
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x40348e
push esi
call fcn.0040841a
cmp dword [esp + 0x18], 0
js 0x403487
push eax
push dword [esp + 0x30]
call fcn.00407fbc
jmp 0x40348e
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp], eax
push dword [esp + 0x1c]
push 0x4180f8
call fcn.00407b7f
mov dword [esp + 4], eax
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x41c0f8
call fcn.00407b7f
mov ebx, eax
push ebp
call fcn.0040816b
add esp, 4
mov edi, eax
push ebx
push ebp
call fcn.00403859
test eax, eax
je 0x402dde
mov ebp, eax
mov dword [esp + 8], edi
cmp esi, 4
mov dword [esp + 0x2c], ebx
je 0x40342d
cmp esi, 3
je 0x4033be
xor ebx, ebx
cmp esi, 1
mov edi, dword [esp + 4]
mov esi, dword [esp + 8]
jne 0x4035ea
mov eax, dword [0x42c138]
mov esi, 0x4200f8
push dword [eax + 0xc]
push esi
call fcn.00407b7f
push esi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [eax*2 + 2]
cmp dword [esp], 1
jne 0x4035ca
push 0x4200f8
mov edi, dword [esp + 8]
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegStr:___s_s____s___s_
jmp 0x4035e2
push ebp
push 0x4180f8
mov ebx, ecx
call fcn.00407b7f
mov dword [esp], eax
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x4240f8
call fcn.00407b7f
mov edi, eax
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x4200f8
call fcn.00407b7f
mov ebp, eax
mov eax, dword [0x42c138]
mov esi, 0x41c0f8
push dword [eax + 0x14]
push esi
call fcn.00407b7f
push esi
mov esi, dword [esp + 4]
push 0xffffffffffffffec
call fcn.00406b09
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x48]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 4]
mov dword [eax + 8], edx
mov dword [eax + 0x1c], ecx
xor ecx, ecx
cmp word [esi], 0
mov edx, esi
cmove edx, ecx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edi
cmp word [ebp], 0
mov edx, ebp
cmove edx, ecx
mov dword [eax + 0x14], edx
add ebx, 0x58000
mov dword [eax + 0x18], ebx
push eax
call fcn.0040701a
test eax, eax
je 0x402df2
test byte [esp + 0x4c], 0x40
je 0x401ae3
push dword [esp + 0x80]
call fcn.0040841a
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push edi
push esi
push str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.004074c0
add esp, 0x10
jmp 0x403564
mov ebp, dword [esp + 4]
push ebp
mov ebx, edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov ecx, 2
call fcn.00403795
mov esi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x48
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x42c140], eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 3
call fcn.00403795
mov dword [0x42c150], eax
mov al, byte [esp + 0x24]
mov ecx, eax
and cl, 1
mov byte [0x42c154], cl
mov ecx, eax
and cl, 2
mov byte [0x42c155], cl
and al, 4
mov byte [0x42c156], al
mov byte [0x42c157], 1
push dword [esp + 0x18]
push 0x42c15c
call fcn.00407b7f
push 0x42c140
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
jmp 0x4031ab
push ebp
push 0x4180f8
call fcn.00407b7f
mov edi, eax
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x41c0f8
call fcn.00407b7f
mov ebx, eax
mov eax, dword [0x42c138]
push dword [eax + 0xc]
push 0x4200f8
call fcn.00407b7f
mov esi, eax
push ebx
push edi
push str.CopyFiles___s_____s_
call fcn.004074c0
add esp, 0xc
push edi
call fcn.0040752e
test eax, eax
je 0x401c31
mov dword [esp], esi
lea esi, [esp + 0x48]
mov eax, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], 2
push edi
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
push ebx
call sub.KERNEL32.dll_lstrlenW
xor ebp, ebp
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov ecx, dword [esp]
mov dword [esi + 0x1a], ecx
movzx eax, word [esp + 0x1c]
mov word [esi + 0x10], ax
push ecx
push 0
call fcn.00406b09
push esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x401c3d
push 0
push 0xfffffffffffffff9
call fcn.00406b09
xor ebp, ebp
inc ebp
mov dword [esp], ebp
jmp case.0x40153c.67
mov ebx, edi
xor ecx, ecx
call fcn.00403795
mov esi, eax
mov eax, dword [0x40a00c]
cmp dword [eax + 0xc], esi
jbe 0x4034ef
mov eax, dword [eax + 8]
imul ecx, esi, 0x4018
lea edi, [eax + ecx]
mov edx, dword [esp + 0x1c]
test edx, edx
js 0x40333f
je 0x40354a
push dword [edi + edx*4]
jmp 0x4031ab
mov dword [esp], ecx
push ebx
push 0x4240f8
call fcn.00407b7f
mov edi, eax
mov eax, dword [esp + 0x14]
mov ebp, eax
and ebp, 7
shr eax, 3
and eax, 2
push edi
push eax
push ebp
push str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
call fcn.004074c0
add esp, 0x10
push edi
call fcn.004075b8
test eax, eax
mov dword [esp + 4], edi
je 0x402e0e
push edi
push 0x4180f8
call fcn.0040746d
jmp 0x402e2e
xor ecx, ecx
inc ecx
mov edi, edx
call fcn.00403795
mov esi, eax
mov ecx, 2
call fcn.00403795
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x40355d
push 0xfffffffffffffff0
call fcn.00403755
mov esi, eax
push eax
push str.RMDir:___s_
jmp 0x401f03
push dword [ebx*4 + 0x4180b8]
push edx
jmp 0x40355f
push ebx
push 0x4180f8
mov esi, edx
call fcn.00407b7f
mov edi, eax
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
test eax, eax
je 0x401d52
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x401d5a
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, esi
test eax, eax
jne 0x401d5a
mov word [ecx], 0
xor ebx, ebx
inc ebx
mov dword [esp], ebx
mov word [ecx + 0x3ffe], 0
jmp case.0x40153c.67
mov ecx, 2
mov dword [esp + 8], edx
call fcn.00403795
mov edi, eax
mov esi, edx
mov ecx, 3
call fcn.00403795
mov ebx, eax
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x4180f8
call fcn.00407b7f
mov ebp, eax
push eax
call sub.KERNEL32.dll_lstrlenW
mov edx, dword [esp + 8]
mov word [edx], 0
test esi, esi
cmove edi, eax
mov dword [esp], 0
test edi, edi
je case.0x40153c.67
mov ecx, ebx
sar ecx, 0x1f
and ecx, eax
add ecx, ebx
mov dword [esp], 0
js case.0x40153c.67
cmp ecx, eax
cmovl eax, ecx
lea eax, [ebp + eax*2]
push eax
push edx
mov esi, edx
call fcn.0040746d
test edi, edi
jns 0x401df4
push esi
call sub.KERNEL32.dll_lstrlenW
add edi, eax
mov dword [esp], 0
cmp edi, 0x1fff
mov eax, dword [esp + 8]
jg case.0x40153c.67
xor ecx, ecx
test edi, edi
mov dword [esp], 0
cmovle edi, ecx
mov word [eax + edi*2], 0
jmp case.0x40153c.67
mov ebx, edi
mov edi, edx
push dword [esp + 0x1c]
push 0x4180f8
call fcn.00407b7f
push eax
call fcn.0040752e
test eax, eax
je 0x402f32
mov esi, eax
push dword [eax + 0x14]
push ebx
call fcn.00407fbc
push dword [esi + 0x18]
jmp 0x40355e
push ebp
push 0x4180f8
call fcn.00407b7f
mov esi, eax
push eax
call fcn.0040752e
test eax, eax
je 0x402f3f
push dword [esp + 0x18]
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.004074c0
add esp, 0xc
jmp 0x4028e3
push ebx
push 0x4180f8
mov edi, edx
call fcn.00407b7f
mov esi, eax
mov ecx, 2
call fcn.00403795
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x402faf
push ebx
push 0x4180f8
mov esi, edx
call fcn.00407b7f
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
push esi
jmp 0x40355f
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x4180b8]
xor edx, edx
test ecx, ecx
sete dl
mov esi, dword [esp + edx*4 + 0x14]
and ecx, dword [esp + 0x20]
mov dword [eax*4 + 0x4180b8], ecx
jmp 0x403576
push ebp
push 0x4180f8
call fcn.00407b7f
mov esi, eax
push eax
push str.Delete:___s_
call fcn.004074c0
add esp, 8
push dword [esp + 0x18]
push esi
call fcn.0040713f
jmp 0x403564
push 0xffffffffffffffee
mov dword [esp + 0xc], edx
call fcn.00403755
mov esi, eax
push 0xb
call fcn.00406f78
lea ecx, [esp + 0x48]
push ecx
push esi
call eax
mov ebp, eax
xor eax, eax
mov ecx, dword [esp + 8]
mov word [ecx], ax
mov dword [esp + 0x2c], edi
mov word [edi], ax
xor ebx, ebx
inc ebx
test ebp, ebp
je 0x4030c9
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4030c9
mov edi, eax
push 0xc
call fcn.00406f78
mov ebx, eax
push 0xd
call fcn.00406f78
mov dword [esp], eax
push edi
push ebp
push 0
push esi
call ebx
xor ebx, ebx
inc ebx
test eax, eax
je 0x401fcb
lea eax, [esp + 0x34]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x40a90c
push edi
call dword [esp + 0x10]
test eax, eax
je 0x401fcb
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 8]
push dword [esp + 0xc]
call fcn.00407fbc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 0xc]
push dword [esp + 0x30]
call fcn.00407fbc
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4030c9
mov eax, dword [0x40ae10]
inc dword [eax]
mov esi, 0x7fffffff
cmp dword [esp + 4], 0
je 0x403576
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x403576
mov esi, dword [0x42c13c]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402f53
test esi, esi
je 0x402d32
lea ecx, [eax - 1]
mov esi, dword [esi]
add ecx, 0xffffffff
jae 0x402023
test esi, esi
jne 0x402018
test esi, esi
je 0x402d32
add esi, 4
mov edi, 0x4180f8
push esi
push edi
call fcn.0040746d
mov eax, dword [0x42c13c]
add eax, 4
push eax
push esi
call fcn.0040746d
mov eax, dword [0x42c13c]
add eax, 4
push edi
push eax
jmp 0x402b8b
mov dword [esp], 0
xor ecx, ecx
call fcn.00403795
mov esi, eax
push eax
push str.Sleep__d_
call fcn.004074c0
add esp, 8
xor eax, eax
inc eax
cmp esi, 2
cmovge eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40153c.67
cmp dword [esp + 0x1c], 0
jle 0x402f80
mov eax, dword [ebp*4 + 0x42c0fc]
mov dword [ebp*4 + 0x4180b8], eax
jmp 0x403564
push ebp
push 0x4200f8
call fcn.00407b7f
mov esi, eax
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x4240f8
call fcn.00407b7f
cmp dword [esp + 0x24], 0
je 0x402fb7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x402fbf
cmp ebp, 0xbadf00d
jne 0x402d40
inc dword [0x4180cc]
jmp 0x403564
push ebp
push 0x40a15c
call fcn.004074c0
add esp, 8
mov esi, dword [esp + 0x14]
jmp 0x403576
xor ecx, ecx
call fcn.00403795
mov edi, eax
xor ecx, ecx
inc ecx
call fcn.00403795
mov esi, eax
cmp dword [esp + 0x1c], 0
je 0x402135
push str.HideWindow
call fcn.004074c0
add esp, 4
cmp dword [esp + 0x20], 0
je 0x402fd0
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x403564
push ebx
call fcn.0040816b
add esp, 4
mov edi, eax
cmp dword [esp + 0x24], 0
je 0x402fdd
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x4200f8
call fcn.00407b7f
mov esi, eax
push eax
push edi
push str.DeleteRegKey:___s_s_
call fcn.004074c0
add esp, 0xc
mov eax, dword [esp + 0x24]
sar eax, 1
push eax
push esi
push ebx
call fcn.00403801
mov ebp, eax
jmp 0x403027
push ebp
push 0x4180f8
call fcn.00407b7f
push eax
push str.Aborting:___s_
call fcn.004074c0
add esp, 8
push 0
push dword [esp + 0x18]
call fcn.00406b09
jmp 0x402d54
push str.BringToFront
call fcn.004074c0
add esp, 4
push dword [esp + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403564
mov eax, dword [0x40ae1c]
mov eax, dword [eax]
test eax, eax
je 0x4021f3
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x40ae18]
mov eax, dword [eax]
mov dword [esp], 0
test eax, eax
je case.0x40153c.67
push dword [esp + 0x14]
push eax
jmp 0x402fd2
mov esi, 0x41c0f8
push str._RM_
push esi
call fcn.0040746d
push esi
push 0x4200f8
call fcn.0040746d
xor ebx, ebx
cmp dword [esp + 0x14], 0
mov edi, 0
je 0x40224f
mov eax, dword [0x42c138]
push dword [eax]
push 0x4180f8
call fcn.00407b7f
mov edi, eax
cmp dword [esp + 0x18], 0
je 0x40226a
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x41c0f8
call fcn.00407b7f
mov ebx, eax
cmp dword [esp + 0x24], 0
je 0x403033
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x4200f8
call fcn.00407b7f
mov ebp, eax
jmp 0x403035
push 0xffffffffffffffd0
call fcn.00403755
mov edi, eax
push 0xffffffffffffffdf
call fcn.00403755
mov ebp, eax
mov eax, dword [0x42c138]
push dword [eax + 0xc]
push 0x41c0f8
call fcn.00407b7f
mov ebx, eax
push eax
push str.Rename:__s
call fcn.004074c0
add esp, 8
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x403074
push 0x41c0f8
push 0xffffffffffffffe3
jmp 0x402391
push ebp
push 0x4180f8
call fcn.00407b7f
mov esi, eax
lea eax, [esp + 0x48]
push eax
push edi
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
mov eax, edi
je 0x4030ab
mov edi, eax
mov eax, dword [esp + 0x48]
xor ebx, ebx
cmp eax, esi
jbe 0x4030b5
cmp word [eax], 0
je 0x4030b5
push esi
call fcn.0040752e
test eax, eax
je 0x40362b
add eax, 0x2c
push eax
push dword [esp + 0x4c]
call fcn.0040746d
jmp 0x4030b5
test ebp, ebp
jns 0x402354
not ebp
shl ebp, 0xe
add ecx, ebp
push ecx
call fcn.00407fd5
mov ebp, eax
dec ebp
push ebp
push str.Call:__d
call fcn.004074c0
add esp, 8
push 0
push ebp
call fcn.004013ec
mov esi, eax
jmp 0x403576
push ebp
push 0x4180f8
call fcn.00407b7f
push eax
push str.DetailPrint:__s
call fcn.004074c0
add esp, 8
push 0
push dword [esp + 0x18]
call fcn.00406b09
jmp 0x403564
mov eax, dword [0x40a00c]
add ebx, dword [eax + 0x28]
mov dword [esp], 0
xor ecx, ecx
call fcn.00403795
push ebx
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40153c.67
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403755
mov edi, eax
push dword [esp + 0x18]
push eax
push str.CreateDirectory:___s____d_
call fcn.004074c0
add esp, 0xc
push edi
call fcn.004075e9
xor esi, esi
test eax, eax
je 0x40247a
push 0x5c
push eax
call fcn.00407585
mov ebx, eax
movzx ebp, word [eax]
mov word [eax], 0
test bp, bp
jne 0x40241d
cmp dword [esp + 0x1c], 0
je 0x40241d
call fcn.00406f5e
test eax, eax
je 0x40241d
push edi
call fcn.00406eec
jmp 0x402423
push edi
call fcn.00406f40
test eax, eax
je 0x402449
cmp eax, 0xb7
jne 0x402459
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x402469
push edi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.004074c0
add esp, 8
jmp 0x402468
push edi
push str.CreateDirectory:___s__created
call fcn.004074c0
add esp, 8
jmp 0x402469
push eax
push edi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.004074c0
add esp, 0xc
inc esi
mov eax, ebx
add eax, 2
mov word [ebx], bp
test bp, bp
jne 0x4023ee
cmp dword [esp + 0x18], 0
je 0x4030d1
push 0x41c0f8
push 0xffffffffffffffe6
call fcn.00406b09
mov eax, dword [esp]
add eax, 0x58000
push edi
push eax
call fcn.0040746d
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4030dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.SetCurrentDirectory__s__failed___d_
call fcn.004074c0
add esp, 0xc
inc esi
jmp 0x4030dd
push 0xfffffffffffffff0
call fcn.00403755
mov esi, eax
push dword [esp + 0x18]
push eax
push str.SetFileAttributes:___s_:_08X
call fcn.004074c0
add esp, 0xc
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [esp], 0
test eax, eax
jne case.0x40153c.67
push str.SetFileAttributes_failed.
jmp 0x4030f6
push 0xffffffffffffffef
mov esi, edx
call fcn.00403755
push eax
push esi
call fcn.00407814
jmp 0x403065
push 0xffffffffffffffff
mov esi, edx
call fcn.00403755
lea ecx, [esp + 0x48]
xor edi, edi
push ecx
push esi
push 0x2000
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x402c71
mov word [esi], 0
xor edi, edi
inc edi
jmp 0x402c71
cmp dword [0x42c134], 0
js 0x4030e5
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403755
mov esi, eax
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x4180f8
call fcn.00407b7f
mov ebp, eax
cmp dword [esp + 0x24], 0
je 0x402593
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x4025a8
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test eax, eax
je 0x4034d5
push ebp
push edi
call fcn.004083d4
test eax, eax
je 0x40339f
mov ebx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403585
push 0x41c0f8
push eax
call fcn.00406b09
call ebx
xor ebx, ebx
test eax, eax
setne bl
jmp 0x4035a3
cmp word [edx], 0
mov dword [esp], 0
je case.0x40153c.67
push edx
call fcn.00407fd5
mov esi, eax
mov ecx, 2
call fcn.00403795
push dword [esp + 0x20]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x18], 0
mov dword [esp], 0
jns 0x40355d
jmp case.0x40153c.67
push 0xfffffffffffffff0
call fcn.00403755
mov edi, eax
push eax
call fcn.004075b8
test eax, eax
jne 0x402640
push 0xffffffffffffffed
call fcn.00403755
push edi
call fcn.00407117
push 2
push 0x40000000
push edi
call fcn.004077e2
cmp eax, 0xffffffff
je 0x403103
mov ebx, eax
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0
je 0x40270f
mov eax, dword [0x40ae08]
mov eax, dword [eax]
mov dword [esp], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x40270f
mov ebp, eax
push 0
call fcn.00403e3b
push dword [esp]
push ebp
call fcn.00403e25
push dword [esp + 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test eax, eax
mov eax, dword [esp]
je 0x4026fd
mov dword [esp + 8], ebx
push dword [esp + 0x1c]
push esi
push 0
push dword [esp + 0x24]
call fcn.00403e52
mov dword [esp + 4], esi
cmp byte [esi], 0
je 0x4026ec
mov esi, dword [esp + 4]
mov ebx, dword [esi]
lea eax, [esi + 8]
mov ecx, dword [esi + 4]
add ecx, ebp
push ebx
push eax
push ecx
call fcn.004077be
add esi, ebx
add esi, 8
cmp byte [esi], 0
jne 0x4026d0
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 8]
mov eax, dword [esp]
push eax
push ebp
push ebx
call fcn.004078b4
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
dec esi
mov ebp, ebx
xor ebx, ebx
push ebx
push ebx
push ebp
push esi
call fcn.00403e52
mov esi, eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push esi
push str.created_uninstaller:__d____s_
call fcn.004074c0
add esp, 0xc
mov eax, 0xfffffff3
test esi, esi
jns 0x403125
jmp 0x403116
test ebp, ebp
je 0x403133
push ebx
push str.settings_logging_to__d
call fcn.004074c0
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [0x40ae20]
mov dword [ecx], eax
push eax
push str.logging_set_to__d
call fcn.004074c0
add esp, 8
cmp dword [esp + 0x18], 0
je 0x4032b8
call fcn.004048e8
jmp 0x403564
push ebx
push 0x4240f8
call fcn.00407b7f
mov esi, eax
push eax
push dword [esp + 0x18]
push str.MessageBox:__d___s_
call fcn.004074c0
add esp, 0xc
push dword [esp + 0x14]
push esi
call fcn.00407054
test eax, eax
je 0x4034ef
cmp eax, dword [esp + 0x1c]
je 0x403159
mov dword [esp], 0
cmp eax, dword [esp + 0x24]
jne case.0x40153c.67
mov esi, dword [esp + 0x28]
jmp 0x403576
xor ecx, ecx
call fcn.00403795
cmp eax, 0x1f
ja 0x4034ef
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x1c]
je 0x40335f
test ecx, ecx
je 0x403556
push eax
call fcn.00401304
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
call fcn.00401248
jmp case.0x40153c.67
mov ebx, edx
xor esi, esi
inc esi
mov ecx, esi
call fcn.00403795
mov edi, eax
mov ecx, 2
call fcn.00403795
mov ecx, eax
xor ebp, ebp
mov eax, dword [esp + 0x20]
cmp eax, 0xd
ja case.default.0x40284c
jmp dword [eax*4 + 0x40a124]
add edi, ecx
jmp case.default.0x40284c
mov edi, dword [esp + 0x28]
xor ecx, ecx
call fcn.00403795
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.00403795
test edi, edi
je 0x403151
cmp esi, eax
jb 0x403159
jbe 0x402fc7
jmp 0x403385
push edx
call fcn.00407fd5
mov dword [esp], 0
test eax, eax
je case.0x40153c.67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403564
mov dword [esp + 8], edx
test byte [esp + 0x21], 1
jne 0x402c79
push dword [esp + 0x1c]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402c83
xor ecx, ecx
call fcn.00403795
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402fc7
mov esi, dword [esp + 0x18]
jmp 0x403576
mov eax, dword [0x40ae2c]
and ebp, dword [eax]
push 0
push ebp
push 0xb
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x14], 0
mov dword [esp], 0
je case.0x40153c.67
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x40153c.67
lea eax, [esp + 0x48]
mov dword [eax], 0xa
push ebx
push 0x4180f8
mov ebp, edx
call fcn.00407b7f
mov edi, eax
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x41c0f8
call fcn.00407b7f
mov esi, eax
push 0xffffffffffffffdd
call fcn.00403755
push eax
push 0x1fff
push ebp
lea eax, [esp + 0x54]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp word [ebp], 0xa
jne 0x4034f2
mov word [ebp], 0
jmp 0x4034ef
mov esi, edx
push edi
call fcn.00407fd5
test eax, eax
je 0x4029af
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402b85
mov word [esi], 0
jmp 0x4034ef
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403755
mov dword [esp + 4], eax
push 0xffffffffffffffdf
call fcn.00403755
mov esi, eax
mov eax, dword [0x42c138]
push dword [eax + 8]
push 0x4180f8
call fcn.00407b7f
mov dword [esp + 8], eax
push 0xffffffffffffffcd
call fcn.00403755
mov dword [esp + 0x2c], eax
mov eax, dword [0x42c138]
push dword [eax + 0x14]
push 0x4280f8
call fcn.00407b7f
mov dword [esp + 0x44], eax
mov ebp, dword [esp + 0x24]
mov ebx, ebp
and ebx, 0xfff
mov edi, ebp
shr edi, 0xc
and edi, 7
mov dword [esp + 0x38], ebp
shr ebp, 0x10
mov dword [esp + 0x30], esi
push esi
call fcn.004075b8
test eax, eax
jne 0x402a42
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x4200f8
call fcn.00407b7f
mov dword [esp + 0x3c], ebp
push ebp
push edi
mov dword [esp + 0x48], ebx
push ebx
push dword [esp + 0x38]
push dword [esp + 0x18]
mov ebx, dword [esp + 0x44]
push ebx
push dword [esp + 0x1c]
push str.CreateShortcut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
call fcn.004074c0
add esp, 0x20
lea eax, [esp + 0x48]
mov ecx, dword [0x40ae04]
mov edx, dword [0x40adfc]
push eax
push ecx
push 1
push 0
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
xor esi, esi
inc esi
mov ebp, 0xfffffff0
test eax, eax
js 0x4034c2
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push dword [0x40ae00]
push eax
call dword [ecx]
mov edx, dword [esp + 0x48]
mov ecx, dword [edx]
test eax, eax
js 0x4032c4
push ebx
push edx
call dword [ecx + 0x50]
mov dword [esp + 0x30], eax
cmp word [esp + 0x38], 0
js 0x402adf
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
mov edx, dword [esp]
add edx, 0x58000
push edx
push eax
call dword [ecx + 0x24]
test edi, edi
mov esi, dword [esp + 4]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x40]
je 0x402afa
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push dword [esp + 0x3c]
push eax
call dword [ecx + 0x34]
mov edx, dword [esp + 0x2c]
cmp word [edx], 0
je 0x402b1e
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ebp
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push dword [esp + 0x44]
push eax
call dword [ecx + 0x1c]
cmp dword [esp + 0x30], 0
js 0x40349d
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x18]
mov ebx, eax
shr ebx, 0x1f
jmp 0x40349f
mov esi, edx
push dword [esp + 0x1c]
push 0x4180f8
call fcn.00407b7f
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403162
push eax
push edi
call fcn.00407fbc
lea eax, [esp + 0x74]
push eax
push esi
call fcn.0040746d
jmp 0x403564
push 0x20019
mov esi, edx
call fcn.004037b2
mov edi, eax
mov ecx, 3
call fcn.00403795
mov word [esi], 0
test edi, edi
je 0x4034ef
mov edx, esi
mov dword [esp + 0x48], 0x1fff
cmp dword [esp + 0x24], 0
je 0x4032cd
push 0x1fff
push edx
push eax
push edi
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ebx, ebx
jmp 0x4032fa
push edx
call fcn.00407fd5
mov dword [esp], 0
test eax, eax
je case.0x40153c.67
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x403564
cmp esi, 0x38
jne 0x402d5e
mov esi, 0x4200f8
push ebx
push esi
call fcn.00407b7f
mov edi, 0x41c0f8
push 0x2000
push edi
push esi
call fcn.0040807c
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
jmp 0x402d73
sar ecx, 2
lea edx, [esp + 0x48]
push edx
push ecx
push 0
push ebp
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ecx, ecx
test eax, eax
sete cl
mov edi, ecx
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 8]
js 0x402c71
push dword [esp + 0x48]
push ebx
call fcn.00407fbc
mov dword [esp], edi
jmp case.0x40153c.67
mov ecx, 2
call fcn.00403795
mov edi, eax
mov ebp, dword [esp + 0x20]
mov ebx, ebp
and ebx, 3
bt ebp, 0x10
jb 0x402c9b
movzx eax, word [esp + 0x18]
jmp 0x402cad
mov eax, dword [0x42c138]
push dword [eax + 4]
push 0x41c0f8
call fcn.00407b7f
mov dword [esp], eax
lea esi, [esp + 0x48]
push esi
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, ebp
shl eax, 0x1d
sar eax, 0x1f
mov ecx, dword [0x40ae0c]
and eax, dword [ecx]
mov ecx, ebp
sar ecx, 0x1f
and ecx, dword [esi + 8]
add ebp, ebp
sar ebp, 0x1f
and ebp, dword [esi + 0xc]
mov edx, 0xfef0
and edx, dword [esp + 0x20]
push edx
push ebp
push ecx
push ebx
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
push eax
push ebx
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
jne 0x402d13
test eax, eax
je 0x402d13
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x14], 0
js 0x403564
push esi
push dword [esp + 0xc]
jmp 0x40355f
mov word [edi], 0
jmp 0x4034ef
push eax
push str.Exch:_stack____d_elements
call fcn.004074c0
add esp, 8
push 0xffffffffffffffe8
push 0
call fcn.00407b7f
push 0x200010
push eax
call fcn.00407054
mov esi, 0x7fffffff
jmp 0x403576
push ebx
push 0x41c0f8
call fcn.00407b7f
push eax
call sub.KERNEL32.dll_lstrlenW
mov ecx, eax
add ecx, eax
xor edx, edx
inc edx
mov eax, dword [esp + 8]
cmp word [eax], 0
je 0x402dcb
mov esi, ecx
xor ebx, ebx
mov cl, byte [esp]
mov bl, cl
push eax
call fcn.00407fd5
mov edi, eax
or ebp, ebx
jne 0x402dab
cmp dword [esp + 0x20], 0
je 0x402dab
push edi
push edi
call fcn.004078e6
test eax, eax
js 0x4034ef
push esi
push 0x41c0f8
push edi
call fcn.004078b4
mov dword [esp], 0
test eax, eax
jne case.0x40153c.67
jmp 0x4034ef
mov dword [esp], edx
jmp case.0x40153c.67
push edi
push str.Exec:_failed_createprocess____s__
jmp 0x4034e7
push ebx
push edi
push str.WriteReg:_error_creating_key___s_s_
call fcn.004074c0
add esp, 0xc
jmp 0x4034ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push edi
push esi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.004074c0
add esp, 0x14
jmp 0x4034ef
mov eax, dword [esp]
add eax, 0x58000
push eax
push 0x4180f8
call fcn.0040746d
push eax
call fcn.00407556
push edi
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x4180f8
call fcn.0040765e
mov edi, 0x41c0f8
mov esi, 0x4200f8
cmp ebp, 3
jb 0x402e7d
push 0x4180f8
call fcn.0040752e
test eax, eax
je 0x402e66
add eax, 0x14
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x402e68
xor eax, eax
add ebp, 0x7ffffffd
or ebp, 0x80000000
xor ecx, ecx
test eax, ebp
sete cl
mov ebp, ecx
test ebp, ebp
jne 0x402e8b
push 0x4180f8
call fcn.00407117
xor eax, eax
cmp ebp, 1
setne al
inc eax
push eax
push 0x40000000
push 0x4180f8
call fcn.004077e2
cmp eax, 0xffffffff
jne 0x4031b1
test ebp, ebp
jne 0x403245
mov ebp, 0x4180f8
push ebp
push str.File:_error_creating___s_
call fcn.004074c0
add esp, 8
mov ebx, dword [esp]
push ebx
push esi
call fcn.0040746d
push ebp
push ebx
call fcn.0040746d
push dword [esp + 0x28]
push edi
call fcn.00407b7f
push esi
push ebx
call fcn.0040746d
mov eax, dword [esp + 0x14]
sar eax, 3
push eax
push edi
call fcn.00407054
cmp eax, 4
jne 0x402f11
push str.File:_error__user_retry
call fcn.004074c0
add esp, 4
xor ebp, ebp
jmp 0x402e42
cmp eax, 5
jne 0x40327d
push str.File:_error__user_cancel
call fcn.004074c0
add esp, 4
inc dword [0x4180c0]
jmp 0x403574
xor eax, eax
mov word [edi], ax
mov word [ebx], ax
jmp 0x4034ef
push dword [esp + 0x1c]
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.004074c0
add esp, 0xc
jmp 0x402fc7
test ebx, ebx
je 0x4034f7
test esi, esi
je 0x4035c0
lea eax, [esi + 4]
push eax
push edx
call fcn.0040746d
mov eax, dword [esi]
mov dword [0x42c13c], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403564
jne 0x402f90
mov eax, dword [ebp*4 + 0x4180b8]
mov dword [ebp*4 + 0x42c0fc], eax
xor ecx, ecx
inc ecx
call fcn.00403795
mov ecx, dword [esp + 0x14]
mov dword [ecx*4 + 0x4180b8], eax
push eax
push ecx
push str.SetFlag:__d_d
call fcn.004074c0
add esp, 0xc
jmp 0x403564
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403159
mov esi, dword [esp + 0x1c]
jmp 0x403576
push esi
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403564
push 2
call fcn.004037b2
test eax, eax
je 0x4034ef
mov ebx, eax
mov eax, dword [0x42c138]
push dword [eax + 0xc]
push 0x4240f8
call fcn.00407b7f
mov esi, eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, eax
push esi
push 0x4200f8
push edi
push str.DeleteRegValue:___s_s____s_
call fcn.004074c0
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebp, ebp
setne al
jmp 0x4034f2
xor ebp, ebp
push 0xffffffffffffffcd
call fcn.00403755
mov esi, eax
push eax
push 0x4200f8
push 0x41c0f8
push 0x4180f8
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.004074c0
add esp, 0x14
push esi
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp], ecx
jmp case.0x40153c.67
cmp dword [esp + 0x1c], 0
je 0x40330b
push edi
call fcn.0040752e
test eax, eax
je 0x40330b
push ebp
push edi
call fcn.004074ff
push 0x41c0f8
push 0xffffffffffffffe4
call fcn.00406b09
push ebx
push str.Rename_on_reboot:__s
jmp 0x403144
mov edi, eax
mov word [eax], 0
xor ebx, ebx
inc ebx
cmp dword [esp + 0x1c], 0
jne 0x4030c9
push 0x2000
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [esp], ebx
jmp case.0x40153c.67
push 0x41c0f8
push 0xfffffffffffffff5
call fcn.00406b09
mov dword [esp], esi
jmp case.0x40153c.67
push 0x41c0f8
push 0xffffffffffffffe7
call fcn.00406b09
push str.Error_registering_DLL:_Could_not_initialize_OLE
call fcn.004074c0
add esp, 4
jmp 0x4034ef
push edi
push 0xfffffd66
push str.created_uninstaller:__d____s_
call fcn.004074c0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
mov eax, 0xffffffef
mov dword [esp], ebx
push 0x41c0f8
push eax
jmp 0x4034cb
push ebx
push 0x4180f8
call fcn.00407b7f
push eax
push 0x40a6d4
call fcn.004074c0
add esp, 8
jmp 0x403564
cmp esi, eax
jge 0x40337f
mov esi, dword [esp + 0x20]
jmp 0x403576
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x4034ef
mov ecx, 2
call fcn.00403795
mov esi, eax
mov ecx, 4
call fcn.00403795
lea edi, [esp + 0x48]
mov dword [edi], 0
movzx ecx, al
shr eax, 0x18
test esi, esi
mov edx, 0x4180b8
cmovne edx, esi
add edx, eax
push ecx
push edx
push edi
call fcn.004077be
push dword [edi]
push ebx
jmp 0x40355f
mov ebx, eax
push dword [esp + 4]
push 0xffffffffffffffea
call fcn.00406b09
inc dword [0x4180ec]
xor eax, eax
push eax
push eax
push ebx
push dword [esp + 0x28]
call fcn.00403e52
mov ebp, eax
dec dword [0x4180ec]
push 0x4180f8
push eax
push str.File:_wrote__d_to___s_
call fcn.004074c0
add esp, 0xc
cmp dword [esp + 0x20], 0xffffffff
jne 0x4031fb
cmp dword [esp + 0x24], 0xffffffff
je 0x40320a
lea eax, [esp + 0x20]
push eax
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
test ebp, ebp
jns case.0x40153c.67
cmp ebp, 0xfffffffe
jne 0x4036f9
mov esi, 0x4180f8
push 0xffffffffffffffe9
push esi
call fcn.00407b7f
push dword [esp + 4]
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x403705
push dword [esp + 4]
push 0xffffffffffffffe2
call fcn.00406b09
xor eax, eax
cmp ebp, 2
sete al
mov dword [esp], eax
push ebp
push 0x4180f8
push str.File:_skipped:___s___overwriteflag_d_
call fcn.004074c0
add esp, 0xc
jmp case.0x40153c.67
mov word [ebx], 0
jmp 0x4034ef
push str.File:_error__user_abort
call fcn.004074c0
add esp, 4
push 0x4180f8
push 0xfffffffffffffffa
jmp 0x4021ba
mov eax, dword [esp + 0xc]
lea ecx, [eax - 1]
cmp ecx, 2
jae 0x403522
mov ebp, dword [esp + 0x24]
mov word [esi + 0x3ffe], 0
jmp 0x403541
push 1
call fcn.00408097
jmp 0x403564
push edx
call dword [ecx + 8]
jmp 0x4034c2
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea ecx, [esp + 0x68]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
mov word [esi + 0x3ffe], 0
jmp 0x403544
push ebx
push str.Rename_failed:__s
jmp 0x4034e7
movzx eax, word [esp + 0xc]
cmp si, ax
je 0x40345f
movzx ecx, ax
cmp ecx, 0xa
je 0x403335
cmp ecx, 0xd
jne 0x40345f
mov word [ebx + edi*2], ax
inc edi
jmp 0x403470
cmp edx, 0xffffffff
not edx
mov dword [esp + 0x1c], edx
je 0x403635
xor ecx, ecx
inc ecx
call fcn.00403795
mov dword [esp + 0x18], eax
jmp 0x40364d
test ecx, ecx
je 0x40366a
mov ecx, dword [esp + 0x18]
mov edx, dword [0x40a004]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x94], ecx
jmp 0x403564
jle 0x402fc7
mov esi, dword [esp + 0x24]
jmp 0x403576
movzx eax, word [esp + 0xc]
push eax
push ebx
call fcn.00407fbc
jmp 0x403574
push ebp
push 0xfffffffffffffff7
call fcn.00406b09
push esi
push ebp
push 0x40a910
call fcn.004074c0
add esp, 0xc
xor ebx, ebx
inc ebx
jmp 0x4035a3
mov edx, dword [esp]
cmp edx, 7
mov eax, str.WriteRegMultiStr
mov ecx, str.WriteRegBin
cmove ecx, eax
test edx, edx
mov esi, str.WriteRegNone
cmovne esi, ecx
mov edi, 0x4200f8
push 0xc000
push edi
push 0
push dword [esp + 0x2c]
call fcn.00403e52
mov ebx, eax
lea eax, [esp + 0x48]
push ebx
push edi
push 0x80
push eax
mov edi, eax
call fcn.004082a6
add esp, 0x10
push edi
mov edi, dword [esp + 8]
push edi
push dword [esp + 0x34]
mov eax, dword [esp + 0x14]
push eax
push esi
mov esi, eax
push str._s:___s_s____s___s_
call fcn.004074c0
add esp, 0x18
jmp 0x4035ea
mov ecx, 3
call fcn.00403795
mov dword [0x4200f8], eax
push eax
mov edi, dword [esp + 8]
push edi
push ebx
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegDWORD:___s_s____s__0x_08x_
call fcn.004074c0
add esp, 0x14
mov ebx, 4
jmp 0x4035ea
neg ebp
push 1
push 0
push ebp
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [ebx + edi*2], 0
mov dword [esp], 0
test edi, edi
jne case.0x40153c.67
jmp 0x4034ef
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40153c.67
mov bl, 1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movzx esi, bl
xor bl, 1
movzx ebp, bl
shl ebp, 2
or ebp, 0xfffffff0
mov dword [esp], esi
push 0x41c0f8
push ebp
call fcn.00406b09
jmp case.0x40153c.67
push 0x41c0f8
push 0xfffffffffffffff6
call fcn.00406b09
push esi
push str.Error_registering_DLL:_Could_not_load__s
call fcn.004074c0
add esp, 8
xor eax, eax
inc eax
mov dword [esp], eax
jmp case.0x40153c.67
push 0x4004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
add eax, 4
push dword [esp + 0x14]
push eax
call fcn.00407b7f
mov eax, dword [0x42c13c]
mov dword [esi], eax
mov dword [0x42c13c], esi
jmp 0x403564
cmp eax, 4
mov ebx, esi
jne 0x4018b9
xor eax, eax
cmp dword [esp + 0x24], 0
sete al
mov ebp, eax
push dword [ebx]
push ebx
call fcn.00407fbc
mov dword [esp], ebp
push edi
jmp 0x403620
add eax, ecx
add eax, 0x18
push eax
push ebx
jmp 0x402b8b
push 0
call fcn.00401351
push eax
push edi
call fcn.00407fbc
mov dword [esp], 0
mov eax, dword [esp]
add dword [0x4180c0], eax
xor esi, esi
mov eax, esi
add esp, 0x298
pop esi
pop edi
pop ebx
pop ebp
ret 4
push section..data
push 0x42c13c
push dword [esp + 8]
push 0x2000
push dword [esp + 0x14]
call ebx
add esp, 0x14
xor ebx, ebx
cmp dword [esp + 0x20], 0
mov dword [esp], ebx
jne case.0x40153c.67
push edi
call fcn.0040487f
test eax, eax
je case.0x40153c.67
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x40153c.67
push str.Pop:_stack_empty
jmp 0x4030f6
push 0x4200f8
mov edi, dword [esp + 8]
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegExpandStr:___s_s____s___s_
call fcn.004074c0
add esp, 0x14
push ebx
push 0x4200f8
push dword [esp + 8]
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40361a
push edi
push dword [esp + 0x30]
push esi
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.004074c0
add esp, 0x10
xor ebx, ebx
inc ebx
jmp 0x40361c
xor ebx, ebx
mov dword [esp], ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40153c.67
mov word [edi], 0
jmp 0x4030b2
lea ebx, [eax + ecx]
add ebx, 0x18
push dword [esp + 0x24]
push ebx
call fcn.00407b7f
or byte [ebx - 0xf], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [edi + ecx*4], eax
cmp dword [esp + 0x20], 0
je 0x403564
push esi
call fcn.004011dc
jmp 0x403564
mov ecx, dword [0x40a004]
mov ecx, dword [ecx]
push dword [ecx + eax*4 + 0x94]
push edi
call fcn.00407b7f
jmp 0x403564
shl edi, cl
jmp case.default.0x40284c
or edi, ecx
jmp case.default.0x40284c
sar edi, cl
jmp case.default.0x40284c
test edi, edi
setne al
test ecx, ecx
setne cl
and cl, al
movzx edi, cl
jmp case.default.0x40284c
imul edi, ecx
jmp case.default.0x40284c
test ecx, ecx
je 0x4036e6
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
jmp 0x4036e2
xor eax, eax
test edi, edi
sete al
jmp 0x4036e2
sub edi, ecx
jmp case.default.0x40284c
and edi, ecx
jmp case.default.0x40284c
shr edi, cl
jmp case.default.0x40284c
xor edi, ecx
jmp case.default.0x40284c
test ecx, ecx
je 0x4036e6
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
mov edi, edx
jmp case.default.0x40284c
xor eax, eax
or edi, ecx
setne al
mov edi, eax
jmp case.default.0x40284c
xor edi, edi
mov ebp, esi
mov dword [esp], ebp
push edi
push ebx
call fcn.00407fbc
jmp case.0x40153c.67
push 0xffffffffffffffee
push 0x4180f8
call fcn.00407b7f
mov esi, 0x4180f8
push esi
push 0x40a6d4
call fcn.004074c0
add esp, 8
push 0x200010
push esi
jmp 0x402d4f
xor edi, edi
jmp 0x403470