Function at 0x41a100
Capabilities:
Accept command line arguments
Delete file
Get common file path
Link many functions at runtime
Query environment variable
Set current directory
Set global application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xad4
mov eax, dword [0x4ab00c]
xor eax, esp
mov dword [esp + 0xad0], eax
push ebx
push esi
push edi
call fcn.0046cbc0
push 2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [0x4ac9c0], eax
lea eax, [esp + 0x2b8]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x2b8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a155
sub ecx, edx
sar ecx, 1
lea eax, [ecx - 1]
test eax, eax
jle 0x41a180
nop dword [eax + eax]
cmp word [esp + eax*2 + 0x2b8], 0x5c
je 0x41a180
dec eax
test eax, eax
jg 0x41a170
add eax, eax
cmp eax, 0x410
jae 0x41bb47
xor ecx, ecx
mov word [esp + eax + 0x2b8], cx
lea ecx, [esp + 0x2b8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a1a1
sub ecx, edx
lea eax, [esp + 0x2b8]
sar ecx, 1
push ecx
push eax
mov ecx, 0x4ae070
call fcn.00402430
lea eax, [esp + 0x2b8]
push eax
push str._sTBWinPE.ini
push 0x4ad7e8
call fcn.0040a7f0
add esp, 0xc
lea eax, [esp + 0x6c8]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x6c8]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a200
sub ecx, edx
lea eax, [esp + 0x6c8]
sar ecx, 1
push ecx
push eax
mov ecx, 0x4ae058
call fcn.00402430
lea eax, [esp + 0x2b8]
push eax
lea eax, [esp + 0x6cc]
push 0x491fa8
push eax
call fcn.0040a7f0
add esp, 0xc
lea eax, [esp + 0x6c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str.config
mov edx, 0x4ae070
lea ecx, [esp + 0x40]
call fcn.0040a830
mov esi, eax
add esp, 4
cmp esi, 0x4ae088
je 0x41a2a1
mov ecx, 0x4ae088
call fcn.00402210
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [0x4ae088], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4ae098], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [esp + 0x50]
cmp edx, 8
jb 0x41a2dd
mov ecx, dword [esp + 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a2d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb4c
push edx
push ecx
call fcn.0046ba31
add esp, 8
call fcn.004178d0
push str.DISM.log
mov edx, 0x4ae070
lea ecx, [esp + 0x40]
call fcn.0040a830
mov esi, eax
add esp, 4
cmp esi, 0x4ae178
je 0x41a336
mov ecx, 0x4ae178
call fcn.00402210
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [0x4ae178], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4ae188], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [esp + 0x50]
cmp edx, 8
jb 0x41a372
mov ecx, dword [esp + 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a368
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb51
push edx
push ecx
call fcn.0046ba31
add esp, 8
cmp byte [0x4ab9d5], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x41a397
cmp dword [0x4ae18c], 8
mov eax, 0x4ae178
cmovae eax, dword [0x4ae178]
push eax
call esi
lea eax, [esp + 0x2b8]
push eax
push str._sTBWinPE.log
push 0x4ad3d8
call fcn.0040a7f0
add esp, 0xc
cmp byte [0x4ab981], 0
je 0x41a3c1
push 0x4ad3d8
call esi
mov edx, 4
mov ecx, 0x4ad3d8
call fcn.004110e0
mov esi, 1
mov ecx, str.___________________________________________________________________________
push 0
mov edx, esi
call fcn.00411390
add esp, 4
push 0x491ef4
push 0x491ec0
push str._s_v_s
push 0x4ac9d8
call fcn.0040a9b0
push 0
mov edx, esi
mov ecx, 0x4ac9d8
call fcn.00411390
add esp, 0x14
lea eax, [esp + 0x14]
push 0x7b
push eax
call fcn.0046cd70
mov ebx, 0x491dd8
mov edx, esi
mov ecx, ebx
push 0
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
call fcn.00411390
add esp, 0xc
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
lea eax, [esp + 0x14]
push 0x7c
push eax
call fcn.0046cd70
add esp, 8
mov ecx, ebx
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
push 0
push 0
call fcn.004100a0
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
push str.96__100__
push 0x60
push esi
call fcn.004100a0
push str.120__125__
push 0x78
push 2
call fcn.004100a0
push str.144__150__
push 0x90
push 3
call fcn.004100a0
push str.168__175__
push 0xa8
push 4
call fcn.004100a0
push str.192__200__
push 0xc0
push 5
call fcn.004100a0
push str.240__250__
push 0xf0
push 6
call fcn.004100a0
push str.288__300__
push 0x120
push 7
call fcn.004100a0
cmp dword [0x4adec0], 5
jl 0x41bab4
jne 0x41a513
cmp dword [0x4adec4], esi
jl 0x41bab4
push 1
lea eax, [esp + 0x40]
mov ecx, 0x4adec0
push eax
call fcn.004108a0
cmp dword [eax + 0x14], 8
jb 0x41a52c
mov eax, dword [eax]
cmp dword [0x4adf2c], 8
mov ecx, 0x4adf18
push eax
cmovae ecx, dword [0x4adf18]
push ecx
push str.Windows_version:__s___s
push 0x4ac9d8
call fcn.0040a9b0
mov edx, dword [esp + 0x60]
add esp, 0x10
cmp edx, 8
jb 0x41a58f
mov ecx, dword [esp + 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a585
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb56
push edx
push ecx
call fcn.0046ba31
add esp, 8
cmp byte [0x4adf48], 0
jne 0x41a5a6
cmp byte [0x4adf49], 0
mov eax, 0x49865c
je 0x41a5ab
mov eax, str.__x64_
push eax
push 0x500
push 0x4ac9d8
call fcn.00474974
add esp, 0xc
mov edx, esi
mov ecx, 0x4ac9d8
push 0
call fcn.00411390
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 4
mov dword [0x4ac9b0], 0
mov dword [0x4ac990], 0
mov dword [0x4ac98c], 0
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4ac9b0], eax
test eax, eax
je 0x41a632
push str.Wow64DisableWow64FsRedirection
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [0x4ac9b0]
mov dword [0x4ac990], eax
call esi
mov ecx, eax
mov eax, dword [0x4ac9b0]
mov dword [0x4ac98c], ecx
jmp 0x41a638
mov ecx, dword [0x4ac98c]
cmp byte [0x4adf49], 0
je 0x41a6df
cmp dword [0x4ac990], 0
je 0x41a656
test ecx, ecx
jne 0x41a6df
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x14]
push 0x7e
push eax
call fcn.0046cd70
push str.kernel32.dll
mov eax, dword [eax]
test eax, eax
cmovne ebx, eax
push ebx
push 0x4ac9d8
call fcn.0040a9b0
add esp, 0x14
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
mov edx, 1
mov ecx, 0x4ac9d8
push 0
call fcn.00411390
add esp, 4
push 0x10
push 0x491ec0
push 0x4ac9d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xad0]
xor ecx, esp
call fcn.0046b9f0
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4adec0], 6
mov dword [0x4ac9a4], 0
mov dword [0x4ac984], 0
mov dword [0x4ac980], 0
jg 0x41a711
jne 0x41a779
cmp dword [0x4adec4], 1
jl 0x41a779
push str.Advapi32.dll
call edi
mov dword [0x4ac9a4], eax
test eax, eax
je 0x41a75f
push str.RegGetValueW
push eax
call esi
push str.RegLoadAppKeyW
push dword [0x4ac9a4]
mov dword [0x4ac984], eax
call esi
push str.RegCopyTreeW
push dword [0x4ac9a4]
mov dword [0x4ac980], eax
call esi
push str.RegDeleteTreeW
push dword [0x4ac9a4]
call esi
mov eax, dword [0x4ac9a4]
cmp dword [0x4ac984], 0
je 0x41ba85
cmp dword [0x4ac980], 0
je 0x41ba85
cmp dword [0x4adec0], 6
mov dword [0x4ac9b4], 0
mov dword [0x4ac994], 0
jl 0x41a7fe
push str.Comctl32.dll
call edi
mov dword [0x4ac9b4], eax
test eax, eax
je 0x41a7b5
push str.LoadIconWithScaleDown
push eax
call esi
mov dword [0x4ac994], eax
jmp 0x41a7ba
mov eax, dword [0x4ac994]
test eax, eax
jne 0x41a7fe
lea eax, [esp + 0x14]
push 0x81
push eax
call fcn.0046cd70
push str.ComCtrl32.dll
mov ecx, ebx
push 1
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004115c0
add esp, 0x14
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
cmp dword [0x4adec0], 6
mov dword [0x4ac998], 0
mov dword [0x4ac950], 0
jl 0x41a883
push str.Shell32.dll
call edi
mov dword [0x4ac998], eax
test eax, eax
je 0x41a83a
push str.SHCreateItemFromParsingName
push eax
call esi
mov dword [0x4ac950], eax
jmp 0x41a83f
mov eax, dword [0x4ac950]
test eax, eax
jne 0x41a883
lea eax, [esp + 0x14]
push 0x81
push eax
call fcn.0046cd70
push str.Shell32.dll
mov ecx, ebx
push 1
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004115c0
add esp, 0x14
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
cmp dword [0x4adec0], 6
mov dword [0x4ac9ac], 0
mov dword [0x4ac988], 0
jg 0x41a8ab
jne 0x41a913
cmp dword [0x4adec4], 1
jl 0x41a913
push str.user32.dll
call edi
mov dword [0x4ac9ac], eax
test eax, eax
je 0x41a8ca
push str.ChangeWindowMessageFilterEx
push eax
call esi
mov dword [0x4ac988], eax
jmp 0x41a8cf
mov eax, dword [0x4ac988]
test eax, eax
jne 0x41a913
lea eax, [esp + 0x14]
push 0x81
push eax
call fcn.0046cd70
push str.user32.dll
mov ecx, ebx
push 1
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004115c0
add esp, 0x14
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
cmp dword [0x4adec0], 0xa
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4ac99c], 0
mov dword [0x4ac960], 0
mov dword [0x4ac95c], 0
mov dword [0x4ac958], 0
mov dword [0x4ac954], 0
jl 0x41aa57
push str.virtdisk.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4ac99c], eax
test eax, eax
je 0x41aa17
push str.OpenVirtualDisk
push eax
call esi
push str.AttachVirtualDisk
push dword [0x4ac99c]
mov dword [0x4ac960], eax
call esi
push str.GetVirtualDiskPhysicalPath
push dword [0x4ac99c]
mov dword [0x4ac95c], eax
call esi
push str.DetachVirtualDisk
push dword [0x4ac99c]
mov dword [0x4ac958], eax
call esi
xor edx, edx
mov dword [0x4ac954], eax
cmp dword [0x4ac960], edx
mov cl, 1
movzx ecx, cl
cmove ecx, edx
cmp dword [0x4ac95c], edx
movzx ecx, cl
cmove ecx, edx
cmp dword [0x4ac958], edx
movzx ecx, cl
cmove ecx, edx
test eax, eax
je 0x41a9ed
test cl, cl
je 0x41a9ed
cmp dword [0x4ac99c], edx
jne 0x41aa57
jmp 0x41aa17
push dword [0x4ac99c]
mov dword [0x4ac960], edx
mov dword [0x4ac95c], edx
mov dword [0x4ac958], edx
mov dword [0x4ac954], edx
call edi
mov dword [0x4ac99c], 0
lea eax, [esp + 0x14]
push 0x81
push eax
call fcn.0046cd70
push str.virtdisk.dll
mov ecx, ebx
push 1
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004115c0
add esp, 0x14
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
push str.wlanapi.dll
mov dword [0x4ac9a0], 0
mov dword [0x4ac97c], 0
mov dword [0x4ac978], 0
mov dword [0x4ac974], 0
mov dword [0x4ac970], 0
mov dword [0x4ac96c], 0
mov dword [0x4ac968], 0
mov dword [0x4ac964], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4ac9a0], eax
test eax, eax
je 0x41abcd
push str.WlanCloseHandle
push eax
call esi
push str.WlanEnumInterfaces
push dword [0x4ac9a0]
mov dword [0x4ac97c], eax
call esi
push str.WlanFreeMemory
push dword [0x4ac9a0]
mov dword [0x4ac978], eax
call esi
push str.WlanGetProfile
push dword [0x4ac9a0]
mov dword [0x4ac974], eax
call esi
push str.WlanGetProfileList
push dword [0x4ac9a0]
mov dword [0x4ac970], eax
call esi
push str.WlanOpenHandle
push dword [0x4ac9a0]
mov dword [0x4ac96c], eax
call esi
push str.WlanQueryInterface
push dword [0x4ac9a0]
mov dword [0x4ac968], eax
call esi
mov edx, eax
mov al, 1
movzx ecx, al
xor eax, eax
cmp dword [0x4ac97c], eax
mov dword [0x4ac964], edx
cmove ecx, eax
cmp dword [0x4ac978], eax
movzx ecx, cl
cmove ecx, eax
movzx eax, cl
xor ecx, ecx
cmp dword [0x4ac974], ecx
cmove eax, ecx
cmp dword [0x4ac970], ecx
movzx eax, al
cmove eax, ecx
cmp dword [0x4ac96c], ecx
movzx eax, al
cmove eax, ecx
cmp dword [0x4ac968], ecx
movzx eax, al
cmove eax, ecx
test edx, edx
je 0x41ab91
test al, al
jne 0x41abcd
push dword [0x4ac9a0]
mov dword [0x4ac97c], ecx
mov dword [0x4ac978], ecx
mov dword [0x4ac974], ecx
mov dword [0x4ac970], ecx
mov dword [0x4ac96c], ecx
mov dword [0x4ac968], ecx
mov dword [0x4ac964], ecx
call edi
mov dword [0x4ac9a0], 0
push str.riched20.dll
mov dword [0x4ac9a8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
mov dword [0x4ac9a8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0x58
push edi
call esi
push 0x5a
push edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x4a3098]
movsd qword [0x4ab918], xmm0
call esi
push edi
push 0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x4a3098]
movsd qword [0x4ab910], xmm0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x4adec0], 6
mov ecx, 0x1f4
mov eax, 0x1f8
cmovl eax, ecx
push 0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x5c]
push eax
push 0x1f8
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea eax, [esp + 0x1f0]
push eax
mov dword [esp + 0x204], 0x2bc
call edi
movsd xmm0, qword [0x4ab918]
mulsd xmm0, qword [0x4a3040]
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [0x4ac944], eax
push 0x48
push 0x60
cvttsd2si eax, xmm0
push eax
call esi
neg eax
mov dword [esp + 0x1f0], eax
lea eax, [esp + 0x1f0]
push eax
call edi
movsd xmm0, qword [0x4ab918]
mulsd xmm0, qword [0x4a3050]
mov dword [0x4ac948], eax
push 0x48
push 0x60
cvttsd2si eax, xmm0
push eax
call esi
neg eax
mov dword [esp + 0x1f0], eax
lea eax, [esp + 0x1f0]
push eax
call edi
mov dword [0x4ac94c], eax
lea eax, [esp + 0x2b8]
push 0x208
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x2b8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ad14
sub ecx, edx
lea eax, [esp + 0x2b8]
sar ecx, 1
push ecx
push eax
mov ecx, 0x4ae0a0
call fcn.00402430
call fcn.00415c60
cmp dword [0x4adec0], 6
jg 0x41ad57
jne 0x41aed1
cmp dword [0x4adec4], 1
jl 0x41aed1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x47
mov dword [esp + 0x30], eax
call esi
mov edi, eax
push 0x48
mov dword [esp + 0x38], edi
call esi
push 0
push 1
push 1
push eax
push edi
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, eax
mov esi, dword [esp + 0x2c]
mov dword [0x4ac940], ecx
test ecx, ecx
je 0x41ae45
push ecx
push esi
call edi
mov ecx, dword [esp + 0x30]
mov edi, eax
push 0xff0062
push ecx
push dword [esp + 0x3c]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x30]
mov esi, eax
push dword [esp + 0x38]
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.GDI32.dll_Rectangle]
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x30]
add eax, 0xfffffffc
push eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffffc
push eax
push 4
push 4
push dword [esp + 0x3c]
call dword [sym.imp.GDI32.dll_Rectangle]
push esi
mov esi, dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push esi
call edi
push 0
push 1
push 1
push dword [esp + 0x3c]
push dword [esp + 0x44]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x4ac93c], eax
test eax, eax
je 0x41aebc
push eax
push esi
call edi
push 0xff0062
push dword [esp + 0x34]
mov edi, eax
push dword [esp + 0x3c]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x30]
mov esi, eax
push dword [esp + 0x38]
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.GDI32.dll_Rectangle]
push esi
mov esi, dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x38]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x41bbe0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4ac9bc], eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x41b89c
cmp dword [esp + 0x54], 1
jle 0x41b89c
push 0
mov ecx, 0x83
call fcn.004114c0
add esp, 4
lea eax, [esp + 0x14]
push 0x84
push eax
call fcn.0046cd70
add esp, 8
mov esi, ebx
mov eax, dword [eax]
test eax, eax
cmovne esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push esi
push 0x4ac9d8
call fcn.0040a9b0
add esp, 0xc
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
mov esi, 1
mov edx, esi
mov ecx, 0x4ac9d8
push 0
call fcn.00411390
push edi
push dword [esp + 0x5c]
call fcn.00401520
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push esi
sub esp, 0x18
mov ecx, esp
push str.lang
call fcn.00402270
call fcn.004018d0
sub esp, 0x18
mov ecx, esp
push str.lang
call fcn.00402270
call fcn.00401b60
test al, al
je 0x41b0ca
sub esp, 0x18
mov dword [esp + 0x64], 0
xor eax, eax
mov dword [esp + 0x68], 7
mov ecx, esp
mov word [esp + 0x54], ax
push str.lang
call fcn.00402270
lea eax, [esp + 0x2c]
push eax
call fcn.00401f40
push eax
lea ecx, [esp + 0x40]
call fcn.0040a5e0
mov edx, dword [esp + 0x28]
cmp edx, 8
jb 0x41b040
mov ecx, dword [esp + 0x14]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b036
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb5b
push edx
push ecx
call fcn.0046ba31
add esp, 8
cmp dword [esp + 0x50], 8
lea eax, [esp + 0x3c]
cmovae eax, dword [esp + 0x3c]
push eax
call fcn.0046cab0
add esp, 4
lea edx, [esp + 0x3c]
cmp dword [esp + 0x50], 8
cmovae edx, dword [esp + 0x3c]
xor ecx, ecx
test al, al
setne cl
push ecx
push edx
push str._lang:_s___d_
push 0x4ac9d8
call fcn.0040a9b0
push 0
mov edx, esi
mov ecx, 0x4ac9d8
call fcn.00411390
mov edx, dword [esp + 0x64]
add esp, 0x14
cmp edx, 8
jb 0x41b0ca
mov ecx, dword [esp + 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41b0c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb60
push edx
push ecx
call fcn.0046ba31
add esp, 8
push 0
push 1
sub esp, 0x18
mov ecx, esp
push str.bootwim
call fcn.00402270
call fcn.004018d0
push 0
push 1
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00402270
call fcn.004018d0
push 0
push 1
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00402270
call fcn.004018d0
push 0
push 1
sub esp, 0x18
mov ecx, esp
push 0x49896c
call fcn.00402270
call fcn.004018d0
sub esp, 0x18
xor esi, esi
mov ecx, esp
push str.bootwim
call fcn.00402270
call fcn.00401b60
test al, al
mov edi, 1
cmovne esi, edi
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00402270
call fcn.00401b60
test al, al
je 0x41b163
inc esi
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00402270
call fcn.00401b60
test al, al
je 0x41b17c
inc esi
cmp esi, 1
jne 0x41b430
sub esp, 0x18
mov ecx, esp
push str.bootwim
call fcn.00402270
call fcn.00401b60
test al, al
je 0x41b2e3
call fcn.00401830
push 0
push esi
sub esp, 0x18
mov ecx, esp
push str.bootwim
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498970
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498980
call fcn.00402270
call fcn.004018d0
push 0
push esi
sub esp, 0x18
mov ecx, esp
push str.status
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989a0
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989ac
call fcn.00402270
call fcn.004018d0
push 0
push esi
sub esp, 0x18
mov ecx, esp
push 0x4989b8
call fcn.00402270
call fcn.004018d0
push 0
push esi
sub esp, 0x18
mov ecx, esp
push 0x4989c4
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989cc
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989d4
call fcn.00402270
call fcn.004018d0
push 0
push esi
sub esp, 0x18
mov ecx, esp
push 0x4989dc
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989e4
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x49896c
call fcn.00402270
call fcn.004018d0
call fcn.0045c0d0
jmp 0x41b930
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00402270
call fcn.00401b60
test al, al
jne 0x41b317
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00402270
call fcn.00401b60
test al, al
je 0x41b430
call fcn.00401830
push 0
push 0
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989f4
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498a04
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498a14
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498a1c
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498a24
call fcn.00402270
call fcn.004018d0
push 0
push 1
sub esp, 0x18
mov ecx, esp
push 0x4989dc
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x4989e4
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x498a2c
call fcn.00402270
call fcn.004018d0
push 0
push 0
sub esp, 0x18
mov ecx, esp
push 0x49896c
call fcn.00402270
call fcn.004018d0
xor ecx, ecx
call fcn.00428f90
jmp 0x41b930
sub esp, 0x18
mov ecx, esp
push 0x49896c
call fcn.00402270
call fcn.00401b60
test al, al
je 0x41b6cd
lea ecx, [esp + 0x3c]
call fcn.0040d7e0
push str.qc
lea ecx, [esp + 0x40]
call fcn.00468410
lea eax, [esp + 0x14]
push 0x85
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
push 1
lea ecx, [esp + 0x58]
call fcn.0040d9d0
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
push 2
sub esp, 0x18
mov ecx, esp
push 0x25
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x498a34
mov byte [ecx], 0
call fcn.00468850
lea ecx, [esp + 0x58]
call fcn.0040d870
push str.ql
lea ecx, [esp + 0x40]
call fcn.00468410
push 0x4b0
push 0x4b0
push 0x4b0
lea eax, [esp + 0x25c]
push str._fi__dli_d_tx_d
push eax
call fcn.00468ac0
add esp, 0x14
lea eax, [esp + 0x250]
lea ecx, [esp + 0x3c]
push eax
call fcn.00468410
lea eax, [esp + 0x14]
push 0x155
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
sub esp, 0x18
mov ecx, esp
push 8
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str._bootwim
mov byte [ecx], 0
call fcn.00468850
push 1
lea ecx, [esp + 0x70]
call fcn.0040de20
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
lea eax, [esp + 0x14]
push 0x156
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
sub esp, 0x18
mov ecx, esp
push 6
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str._build
mov byte [ecx], 0
call fcn.00468850
push 2
lea ecx, [esp + 0x70]
call fcn.0040de20
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
lea eax, [esp + 0x14]
push 0x86
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
push 1
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
lea ecx, [esp + 0x58]
call fcn.0040d870
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
lea eax, [esp + 0x14]
push 0x87
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
push 1
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
lea ecx, [esp + 0x58]
call fcn.0040d870
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
sub esp, 0x14
lea eax, [esp + 0x54]
mov ecx, esp
push eax
call fcn.00468520
call fcn.0045df30
mov edx, dword [esp + 0x68]
add esp, 0x18
cmp edx, 0x10
jb 0x41b930
mov ecx, dword [esp + 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b6be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb65
push edx
push ecx
call fcn.0046ba31
add esp, 8
jmp 0x41b930
call fcn.00401890
test al, al
jne 0x41b8a1
push 0
mov ecx, 0x88
mov dword [0x4ac9d4], 9
call fcn.004114c0
add esp, 4
lea ecx, [esp + 0x3c]
call fcn.0040d7e0
push str.qc
lea ecx, [esp + 0x40]
call fcn.00468410
lea eax, [esp + 0x14]
push 0x85
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
push 1
lea ecx, [esp + 0x58]
call fcn.0040d9d0
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
push 2
sub esp, 0x18
mov ecx, esp
push 0x25
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x498a34
mov byte [ecx], 0
call fcn.00468850
lea ecx, [esp + 0x58]
call fcn.0040d870
push str.ql
lea ecx, [esp + 0x40]
call fcn.00468410
push 0x4b0
push 0x4b0
push 0x4b0
lea eax, [esp + 0x25c]
push str._fi__dli_d_tx_d
push eax
call fcn.00468ac0
add esp, 0x14
lea eax, [esp + 0x250]
lea ecx, [esp + 0x3c]
push eax
call fcn.00468410
lea eax, [esp + 0x14]
push 0x88
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
push 2
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
lea ecx, [esp + 0x58]
call fcn.0040d870
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
lea eax, [esp + 0x14]
push 0x89
push eax
call fcn.0046cd70
add esp, 8
mov ecx, eax
call fcn.0046cf10
push 1
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004684c0
lea ecx, [esp + 0x58]
call fcn.0040d870
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
sub esp, 0x14
lea eax, [esp + 0x54]
mov ecx, esp
push eax
call fcn.00468520
call fcn.0045df30
mov edx, dword [esp + 0x68]
add esp, 0x18
cmp edx, 0x10
jb 0x41b930
mov ecx, dword [esp + 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b6be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bb6a
jmp 0x41b6be
mov edi, 1
call fcn.0045e5f0
test al, al
je 0x41b8c5
call fcn.00418590
push 0
mov ecx, 0x83
call fcn.004114c0
add esp, 4
call fcn.00428650
jmp 0x41b930
push 0
mov ecx, 0x83
mov dword [0x4ac9d4], 2
call fcn.004114c0
add esp, 4
mov ecx, 0x8a
push 0
call fcn.004114c0
add esp, 4
lea eax, [esp + 0x14]
push 0x8b
push eax
call fcn.0046cd70
add esp, 8
mov ecx, ebx
mov eax, dword [eax]
test eax, eax
push 0x10
push 0x491ec0
cmovne ecx, eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
mov ecx, 0x4af1e4
call fcn.0046b810
test al, al
je 0x41b948
mov ecx, 0x4af1e4
call fcn.0046b7c0
lea eax, [esp + 0x14]
push 0x8c
push eax
call fcn.0046cd70
push dword [0x4ac9d4]
mov eax, dword [eax]
test eax, eax
cmovne ebx, eax
push ebx
push 0x4ac9d8
call fcn.0040a9b0
add esp, 0x14
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
mov edx, edi
mov ecx, 0x4ac9d8
push 0
call fcn.00411390
mov ecx, dword [0x4ac9b8]
add esp, 4
test ecx, ecx
je 0x41b9ab
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x4ac940]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x41b9bd
push eax
call esi
mov eax, dword [0x4ac93c]
test eax, eax
je 0x41b9c9
push eax
call esi
mov eax, dword [0x4ac9a8]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x41b9db
push eax
call ebx
mov eax, dword [0x4ac9b0]
test eax, eax
je 0x41b9e7
push eax
call ebx
mov eax, dword [0x4ac9b4]
test eax, eax
je 0x41b9f3
push eax
call ebx
mov eax, dword [0x4ac9ac]
test eax, eax
je 0x41b9ff
push eax
call ebx
mov eax, dword [0x4ac9a4]
test eax, eax
je 0x41ba0b
push eax
call ebx
mov eax, dword [0x4ac9a0]
test eax, eax
je 0x41ba17
push eax
call ebx
mov eax, dword [0x4ac99c]
test eax, eax
je 0x41ba23
push eax
call ebx
mov eax, dword [0x4ac998]
test eax, eax
je 0x41ba2f
push eax
call ebx
mov eax, dword [0x4ac94c]
test eax, eax
je 0x41ba3b
push eax
call esi
mov eax, dword [0x4ac948]
test eax, eax
je 0x41ba47
push eax
call esi
mov eax, dword [0x4ac944]
test eax, eax
je 0x41ba53
push eax
call esi
mov eax, dword [0x4ac9bc]
test eax, eax
je 0x41ba63
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x4ac9d4]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xad0]
xor ecx, esp
call fcn.0046b9f0
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x41ba92
push eax
call esi
mov eax, dword [0x4ac9b0]
test eax, eax
je 0x41ba9e
push eax
call esi
lea eax, [esp + 0x14]
push 0x7e
push eax
call fcn.0046cd70
push str.Advapi32.dll
jmp 0x41a66e
lea eax, [esp + 0x14]
push 0x7d
push eax
call fcn.0046cd70
mov ecx, ebx
mov edx, esi
push 0
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
call fcn.00411390
add esp, 0xc
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
add esp, 4
lea eax, [esp + 0x14]
push 0x7d
push eax
call fcn.0046cd70
add esp, 8
mov eax, dword [eax]
test eax, eax
push 0x10
push 0x491ec0
cmovne ebx, eax
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x1c]
call fcn.0046bc3a
add esp, 4
push dword [esp + 0x14]
call fcn.0046bc3a
mov ecx, dword [esp + 0xae0]
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046b9f0
mov esp, ebp
pop ebp
ret 0x10
call fcn.0046bb60
call fcn.00471513
call fcn.00471513
call fcn.00471513
call fcn.00471513
call fcn.00471513
call fcn.00471513
call fcn.00471513
int3