Function at 0x4029aa
Capabilities:
Accept command line arguments
Create process on windows
Link many functions at runtime
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
push ebx
push esi
push edi
xor esi, esi
inc esi
push 4
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov al, byte [edi]
xor ebx, ebx
cmp al, 0x22
mov dword [ebp - 0xc], edi
jne 0x4029fb
jmp 0x4029dd
cmp al, 0x22
je 0x4029eb
inc edi
mov al, byte [edi]
cmp al, bl
mov dword [ebp - 0xc], edi
jne 0x4029d9
cmp al, 0x22
jne 0x4029ff
inc edi
mov dword [ebp - 0xc], edi
jmp 0x4029ff
cmp al, 0x20
je 0x402a04
inc edi
mov al, byte [edi]
mov dword [ebp - 0xc], edi
cmp al, bl
jne 0x4029f1
cmp byte [edi], 0x20
jne 0x402a0d
inc edi
cmp byte [edi], 0x20
je 0x402a04
mov dword [ebp - 0xc], edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [edi], 0x2f
mov dword [ebp - 8], eax
jne 0x402a89
mov al, byte [edi + 1]
cmp al, 0x53
je 0x402a27
cmp al, 0x73
jne 0x402a2d
mov dword [0x404218], esi
mov al, byte [edi + 1]
cmp al, 0x4d
je 0x402a38
cmp al, 0x6d
jne 0x402a44
cmp byte [edi + 2], 0x34
jne 0x402a44
mov dword [0x4041c4], esi
mov al, byte [edi + 1]
cmp al, 0x58
je 0x402a4f
cmp al, 0x78
jne 0x402a6a
mov al, byte [edi + 2]
cmp al, 0x3d
je 0x402a5e
cmp al, 0x31
je 0x402a5e
cmp al, 0x32
jne 0x402a6a
mov dword [0x4041a8], esi
mov dword [0x4041c4], esi
mov al, byte [edi + 1]
cmp al, 0x4d
je 0x402a75
cmp al, 0x6d
jne 0x402a89
cmp byte [edi + 2], 0x35
jne 0x402a89
cmp byte [edi + 3], 0x3d
jne 0x402a89
lea eax, [edi + 4]
mov dword [0x4041ac], eax
push 0x100
lea eax, [ebp - 0x3ac]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [edi], bl
mov eax, edi
je 0x402aae
cmp byte [eax], 0x7f
je 0x402aae
inc eax
cmp byte [eax], bl
jne 0x402aa4
cmp byte [eax], bl
je 0x402ae4
mov byte [eax], bl
inc eax
xor edx, edx
jmp 0x402ac9
cmp cl, 0x20
je 0x402acf
movsx ecx, cl
lea edx, [edx + edx*4]
lea edx, [ecx + edx*2 - 0x30]
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x402ab9
add dword [0x40417c], edx
inc eax
push eax
lea eax, [ebp - 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [0x404200], eax
jge 0x402b06
lea eax, [ebp - 0x3ac]
jmp 0x402dcb
call section..text
mov eax, dword [0x40417c]
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push eax
push dword [0x404200]
lea ecx, [ebp - 0x3ac]
mov dword [0x4041e4], ebx
mov dword [0x4041f4], eax
mov dword [0x4041ec], eax
mov dword [0x40429c], ecx
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll__lread]
lea eax, [ebp - 1]
push eax
push dword [0x404200]
call esi
cmp byte [ebp - 1], bl
je 0x402bad
movzx eax, byte [ebp - 1]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [0x404200]
call esi
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [0x404200]
call esi
push ebx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x402ba7
push 2
push ebx
push eax
call edi
cmp dword [ebp - 0x1c], eax
je 0x402b9c
mov byte [ebp - 0x12c], bl
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll__lclose]
jmp 0x402bad
mov byte [ebp - 0x12c], bl
push 4
push 0x404220
push dword [0x404200]
call esi
push 0xc
push 0x4041b0
push dword [0x404200]
call esi
push 8
push 0x40427c
push dword [0x404200]
call esi
push 0x48
push 0x404234
push dword [0x404200]
call esi
push 3
push 0x4041c0
push dword [0x404200]
call esi
test byte [0x404223], 0x40
je 0x402c0b
mov dword [0x4041c4], 1
lea eax, [ebp - 0x52c]
mov dword [0x4041d0], eax
movzx eax, byte [0x4041c2]
push eax
lea eax, [ebp - 0x52c]
push eax
push dword [0x404200]
call esi
mov eax, dword [0x404270]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x4042a0], 0x401ec0
mov dword [0x4042a4], 0x401181
mov dword [0x4041a4], 0x40269d
jle 0x402c91
inc eax
push eax
push 2
call esi
push eax
mov dword [0x404290], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push dword [0x40426c]
mov dword [0x404294], eax
push ebx
push dword [0x404200]
mov dword [0x404298], eax
call fcn.00401ec0
mov dword [0x404298], ebx
jmp 0x402c9b
mov dword [0x4041c4], 1
test byte [0x404221], 0x10
je 0x402cab
mov byte [0x404224], 1
push dword [ebp - 8]
call fcn.0040272e
test eax, eax
pop ecx
je 0x402dd2
push dword [ebp - 8]
call fcn.0040278d
test eax, eax
pop ecx
je 0x402dd2
cmp dword [0x404268], ebx
mov eax, dword [0x4042b0]
mov dword [0x4041e0], eax
mov eax, dword [ebp - 8]
mov dword [0x4041e8], eax
mov dword [0x404284], 0x4041b0
je 0x402d4d
push 1
push ebx
push dword [0x404200]
call edi
push 2
push ebx
push dword [0x404200]
mov dword [ebp - 0x10], eax
call edi
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], eax
push dword [0x404200]
call edi
mov eax, dword [0x404268]
cmp dword [ebp - 8], eax
je 0x402d4d
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x2ac]
push str.File_size_expected_ld__size_returned_ld.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x2ac]
push eax
call fcn.00402606
add esp, 0x14
jmp 0x402dd2
mov eax, dword [0x404234]
inc eax
push eax
push 2
call esi
push eax
mov dword [0x404288], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push dword [0x404238]
mov dword [0x40428c], eax
push ebx
push dword [0x404200]
mov dword [0x404298], eax
call fcn.00401ec0
cmp byte [ebp - 1], bl
mov dword [0x404298], ebx
jne 0x402def
lea eax, [ebp - 0x12c]
push eax
call fcn.00402552
pop ecx
push ebx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, dword [sym.imp.KERNEL32.dll__lclose]
push eax
call esi
push 2
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov edi, eax
cmp edi, ebx
jge 0x402dd9
lea eax, [ebp - 0x12c]
push eax
call fcn.00402606
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
push ebx
push dword [0x40423c]
push edi
push dword [0x404200]
call fcn.00401ec0
push edi
call esi
xor edi, edi
inc edi
cmp byte [0x404208], bl
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x1ac], bl
push eax
je 0x402e30
lea eax, [ebp - 0x2ac]
push str.Could_not_extract_Wise0132.dll_to__s__CRC_does_not_match.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x2ac]
push eax
call fcn.00402606
add esp, 0x10
jmp 0x402ef0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x402e93
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WiseMain
push esi
call edi
push str.UpdateScreen
push esi
mov dword [0x4041a0], eax
call edi
push str.DisplayGraphics
push esi
mov dword [0x4041bc], eax
call edi
push str.DiskPrompt
push esi
mov dword [0x4041c8], eax
call edi
push str.FileWrite
push esi
mov dword [0x4042ac], eax
call edi
push str.HandleFtp
push esi
mov dword [0x4041a4], eax
call edi
xor edi, edi
mov dword [0x4041cc], eax
inc edi
mov eax, dword [0x4041a0]
cmp eax, ebx
jne 0x402ec7
cmp byte [ebp - 1], bl
je 0x402eba
push ebx
push str.Install
push str.Demo_installations_only_run_on_the_computer_they_were_created_on.
push dword [0x4042b0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402ef0
push str.System_DLLs_corrupt_or_missing.
call fcn.00402606
pop ecx
jmp 0x402ef0
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x1ac]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0xc]
push 0x4041e0
call eax
movzx eax, ax
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401083
cmp byte [ebp - 1], bl
jne 0x402f13
push 0x200
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov eax, dword [0x40422c]
cmp eax, ebx
je 0x402f23
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x14], edi
je 0x402f9c
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x240], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402f81
lea eax, [ebp - 0x28]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 2
pop eax
cmp dword [ebp - 0x230], eax
jne 0x402f94
cmp dword [ebp - 0x14], 0x42
jne 0x402f94
xor eax, eax
push ebx
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp byte [ebp - 0x1ac], bl
je 0x402fb3
push 5
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ExitProcess]