Function at 0x417dc7
Capabilities:
Create thread

Disassembly:
push ebp
sub esp, 0x334
lea ebp, [esp - 4]
mov eax, dword [0x45116c]
xor eax, ebp
mov dword [ebp + 0x334], eax
push 0xf8
mov eax, 0x44243c
call fcn.0041efd5
mov ecx, dword [ebp + 0x354]
mov eax, dword [ebp + 0x350]
mov esi, dword [ebp + 0x340]
mov ebx, dword [ebp + 0x344]
mov edi, dword [ebp + 0x348]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x30], eax
mov byte [eax], 0
call fcn.00404f36
mov eax, dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x104]
push ecx
push eax
call fcn.00410be7
test al, al
jne 0x417e49
mov ecx, dword [ebp - 0x10]
push str.Can_not_find_archive_file
call fcn.0040e4ca
jmp 0x418141
lea ecx, [ebp - 0xc4]
call fcn.00417ca3
and dword [ebp - 0x44], 0
push edi
lea eax, [ebp - 0xc4]
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00414eed
mov esi, eax
test esi, esi
je 0x417e82
mov ecx, dword [ebp - 0x10]
push 0x443d30
call fcn.0040e4ca
jmp 0x4184dd
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040509c
push 2
pop ebx
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
call fcn.00411561
push dword [ebp - 0x2c]
call fcn.0040fcf4
test al, al
jne 0x41814b
mov si, word [0x452650]
cmp si, word [0x450e80]
je 0x418101
xor edi, edi
push 0x268
lea eax, [ebp + 4]
push edi
push eax
mov dword [ebp], edi
call fcn.00422070
movzx eax, si
mov ecx, 0x809
add esp, 0xc
cmp eax, ecx
jg 0x417fce
je case.0x417f70.1047
mov ecx, 0x410
cmp eax, ecx
jg 0x417f5b
je 0x417f51
sub eax, 0x401
cmp eax, 0xd
ja case.0x417f70.1047
jmp dword [eax*4 + 0x41851f]
mov eax, 0x2840
jmp 0x4180c4
mov eax, 0x2872
jmp 0x4180c4
mov eax, 0x2836
jmp 0x4180c4
mov eax, 0x2854
jmp 0x4180c4
mov eax, 0x2890
jmp 0x4180c4
mov eax, 0x280e
jmp 0x4180c4
mov eax, 0x2886
jmp 0x4180c4
mov eax, 0x28a4
jmp 0x4180c4
mov ecx, 0x804
cmp eax, ecx
jg 0x417fbd
je 0x417fb3
sub eax, 0x411
cmp eax, 0xe
ja case.0x417f70.1047
jmp dword [eax*4 + 0x418557]
mov eax, 0x2926
jmp 0x4180c4
mov eax, 0x28d6
jmp 0x4180c4
mov eax, 0x28fe
jmp 0x4180c4
mov eax, 0x293a
jmp 0x4180c4
mov eax, 0x28b8
jmp 0x4180c4
mov eax, 0x28ae
jmp 0x4180c4
mov eax, 0x502c
jmp 0x4180c4
cmp eax, 0x807
je case.0x417f04.1031
mov eax, 0x285e
jmp 0x4180c4
mov ecx, 0x1809
cmp eax, ecx
jg 0x418066
je case.0x417f70.1047
mov ecx, 0xc07
cmp eax, ecx
jg 0x41803c
je case.0x417f04.1031
sub eax, 0x80a
je case.0x417f04.1034
sub eax, ebx
je case.0x417f04.1036
sub eax, 7
je case.0x417f70.1043
dec eax
je case.0x417f70.1044
sub eax, ebx
je case.0x417f70.1046
sub eax, 0x3ee
jne case.0x417f70.1047
mov eax, 0x282c
jmp 0x4180c4
mov eax, 0x28e0
jmp 0x4180c4
mov eax, 0x28cc
jmp 0x4180c4
mov eax, 0x28c2
jmp 0x4180c4
mov eax, 0x284a
jmp 0x4180c4
sub eax, 0xc09
je case.0x417f70.1047
dec eax
je case.0x417f04.1034
sub eax, 0x3fa
je case.0x417f04.1028
sub eax, 5
je case.0x417f70.1047
sub eax, 3
jne case.0x417f70.1047
mov eax, 0x287c
jmp 0x4180c4
mov ecx, 0x300a
cmp eax, ecx
jg 0x418098
je case.0x417f04.1034
cmp eax, 0x1c09
je case.0x417f70.1047
cmp eax, 0x200a
je case.0x417f04.1034
cmp eax, 0x240a
je case.0x417f04.1034
cmp eax, 0x280a
je case.0x417f04.1034
cmp eax, 0x2c0a
jmp 0x4180b9
cmp eax, 0x340a
je case.0x417f04.1034
cmp eax, 0x380a
je case.0x417f04.1034
cmp eax, 0x3c0a
je case.0x417f04.1034
cmp eax, 0x400a
je case.0x417f04.1034
cmp eax, 0x500a
jne case.0x417f70.1047
mov eax, 0x2868
push 0x32
lea ecx, [ebp]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.0040e4ca
push 0x443bf8
lea ecx, [ebp - 0x1c]
call fcn.0040b91e
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.00415030
jmp 0x418120
lea eax, [ebp - 0x2c]
push eax
push 0x285e
lea eax, [ebp - 0x1c]
push eax
call fcn.00415102
mov ecx, dword [ebp - 0x10]
push eax
mov byte [ebp - 4], 4
call fcn.0040b954
push dword [ebp - 0x1c]
call fcn.0040c525
pop ecx
push dword [ebp - 0x2c]
call fcn.0040c525
pop ecx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0
call fcn.00417d91
mov esi, 0x80004005
jmp 0x4184ec
push pe_nt_image_headers32
call fcn.0040c4fa
pop ecx
mov dword [ebp - 0x20], eax
xor edi, edi
cmp eax, edi
mov byte [ebp - 4], 5
je 0x41816c
mov ecx, eax
call fcn.00417b40
jmp 0x41816e
xor eax, eax
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
mov dword [ebp - 0x48], eax
call fcn.0040355f
push 0x443e8c
lea ecx, [ebp - 0x1c]
call fcn.0040b91e
cmp dword [ebp - 0xc0], edi
mov byte [ebp - 4], 6
lea eax, [ebp - 0xc0]
jne 0x4181a2
lea eax, [ebp - 0xc4]
mov eax, dword [eax]
push edi
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x48]
push eax
call fcn.004172eb
push dword [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0040c525
cmp byte [ebp + 0x34c], 0
pop ecx
je 0x4184a8
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0xc4]
push eax
push 0x417a23
push edi
push edi
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [ebp - 0x20], eax
jne 0x41820f
push 0x449828
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x425d0
call fcn.0041eb30
lea ecx, [ebp - 0x1c]
call fcn.00404f36
mov si, word [0x452650]
cmp si, word [0x450e80]
mov byte [ebp - 4], 8
je 0x41845b
push 0xc4
lea eax, [ebp + 0x270]
push edi
push eax
mov dword [ebp + 0x26c], edi
call fcn.00422070
movzx eax, si
mov ecx, 0x809
add esp, 0xc
cmp eax, ecx
jg 0x418343
je case.0x4182e5.1047
mov ecx, 0x410
cmp eax, ecx
jg 0x4182d0
je 0x4182c6
sub eax, 0x401
cmp eax, 0xd
ja case.0x4182e5.1047
jmp dword [eax*4 + 0x418593]
mov eax, 0x2841
jmp 0x418439
mov eax, 0x2873
jmp 0x418439
mov eax, 0x2837
jmp 0x418439
mov eax, 0x2855
jmp 0x418439
mov eax, 0x2891
jmp 0x418439
mov eax, 0x280f
jmp 0x418439
mov eax, 0x2887
jmp 0x418439
mov eax, 0x28a5
jmp 0x418439
mov ecx, 0x804
cmp eax, ecx
jg 0x418332
je 0x418328
sub eax, 0x411
cmp eax, 0xe
ja case.0x4182e5.1047
jmp dword [eax*4 + 0x4185cb]
mov eax, 0x2927
jmp 0x418439
mov eax, 0x28d7
jmp 0x418439
mov eax, 0x28ff
jmp 0x418439
mov eax, 0x293b
jmp 0x418439
mov eax, 0x28b9
jmp 0x418439
mov eax, 0x28af
jmp 0x418439
mov eax, 0x502d
jmp 0x418439
cmp eax, 0x807
je case.0x418279.1031
mov eax, 0x285f
jmp 0x418439
mov ecx, 0x1809
cmp eax, ecx
jg 0x4183db
je case.0x4182e5.1047
mov ecx, 0xc07
cmp eax, ecx
jg 0x4183b1
je case.0x418279.1031
sub eax, 0x80a
je case.0x418279.1034
sub eax, ebx
je case.0x418279.1036
sub eax, 7
je case.0x4182e5.1043
dec eax
je case.0x4182e5.1044
sub eax, ebx
je case.0x4182e5.1046
sub eax, 0x3ee
jne case.0x4182e5.1047
mov eax, 0x282d
jmp 0x418439
mov eax, 0x28e1
jmp 0x418439
mov eax, 0x28cd
jmp 0x418439
mov eax, 0x28c3
jmp 0x418439
mov eax, 0x284b
jmp 0x418439
sub eax, 0xc09
je case.0x4182e5.1047
dec eax
je case.0x418279.1034
sub eax, 0x3fa
je case.0x418279.1028
sub eax, 5
je case.0x4182e5.1047
sub eax, 3
jne case.0x4182e5.1047
mov eax, 0x287d
jmp 0x418439
mov ecx, 0x300a
cmp eax, ecx
jg 0x41840d
je case.0x418279.1034
cmp eax, 0x1c09
je case.0x4182e5.1047
cmp eax, 0x200a
je case.0x418279.1034
cmp eax, 0x240a
je case.0x418279.1034
cmp eax, 0x280a
je case.0x418279.1034
cmp eax, 0x2c0a
jmp 0x41842e
cmp eax, 0x340a
je case.0x418279.1034
cmp eax, 0x380a
je case.0x418279.1034
cmp eax, 0x3c0a
je case.0x418279.1034
cmp eax, 0x400a
je case.0x418279.1034
cmp eax, 0x500a
jne case.0x4182e5.1047
mov eax, 0x2869
push 0x64
lea ecx, [ebp + 0x26c]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040e4ca
jmp 0x418483
push 0x285f
lea eax, [ebp - 0x3c]
push eax
call fcn.00411c73
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.0040b954
push dword [ebp - 0x3c]
mov byte [ebp - 4], 8
call fcn.0040c525
pop ecx
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
push eax
call fcn.00417a81
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x40]
call fcn.0040c525
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00407bb6
jmp 0x4184b5
lea ecx, [ebp - 0xc4]
call fcn.004179d2
mov esi, eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
add eax, 0xdc
push eax
call fcn.0040b954
mov eax, dword [ebp - 0x48]
mov al, byte [eax + 0xd8]
mov ecx, dword [ebp - 0x30]
push dword [ebp - 0x2c]
mov byte [ecx], al
call fcn.0040c525
pop ecx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0
call fcn.00417d91
push dword [ebp - 0xd4]
call fcn.0040c525
mov eax, esi
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x334]
xor ecx, ebp
call fcn.0041eb21
add ebp, 0x338
leave
ret 0x18