Function at 0x4020e4
Capabilities:
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, section..ndata
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 8]
mov dword [ebp + 8], edx
lea ecx, [eax + 4]
shl edx, 0xa
add edx, esi
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], edx
lea edx, [eax + 0x10]
mov dword [ebp - 0x30], edx
push edi
mov edx, dword [edx]
mov edi, dword [ecx]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], edi
shl edx, 0xa
add edx, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x2c], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x10], edx
mov edx, dword [eax]
mov dword [ebp - 8], edx
mov edx, dword [0x426f38]
mov dword [0x40aaac], ecx
mov ecx, dword [ebp - 8]
shl edi, 0xa
shl ebx, 0xa
add ecx, 0xfffffffe
add edi, esi
add ebx, esi
cmp ecx, 0x41
mov dword [ebp - 0x20], edx
ja case.0x402164.65
jmp dword [ecx*4 + 0x4038a5]
mov eax, dword [ebp - 0x18]
jmp 0x40389e
push 0
push dword [ebp - 0x18]
call fcn.00405e07
jmp 0x403174
inc dword [0x4266a4]
cmp dword [0x426ee4], 0
je 0x403174
push 0
jmp 0x40316e
mov eax, dword [ebp - 0x18]
test eax, eax
jge 0x4021af
inc eax
shl eax, 0xa
sub esi, eax
push esi
call fcn.0040685d
dec eax
push 0
push eax
call fcn.00402041
jmp 0x40389e
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4021e5
test al, 8
je 0x4021cf
mov eax, dword [0x409038]
jmp 0x4021db
mov ecx, dword [0x409270]
mov dword [0x409038], ecx
mov dword [0x409270], eax
jmp case.0x402164.65
push 0
push dword [ebp - 0x18]
jmp 0x403021
push 0
call fcn.00403a60
cmp eax, 1
jg 0x4021fe
xor eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x402164.65
push dword [0x426ee4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x402164.65
push 1
call fcn.00403a60
mov ecx, dword [ebp - 0x18]
mov dword [ecx*4 + 0x426f40], eax
jmp case.0x402164.65
mov ecx, dword [ebp + 8]
xor edx, edx
lea esi, [ecx*4 + 0x426f40]
mov ecx, dword [esi]
test ecx, ecx
sete dl
and ecx, dword [ebp - 0x24]
mov eax, dword [eax + edx*4 + 4]
mov dword [esi], ecx
jmp 0x40389e
mov eax, dword [ebp - 0xc]
push dword [eax*4 + 0x426f40]
push edi
jmp 0x4037b4
mov eax, dword [0x4266a8]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x402277
push dword [ebp - 0xc]
push eax
call esi
mov eax, dword [0x4266b8]
test eax, eax
je case.0x402164.65
push dword [ebp - 0x18]
push eax
call esi
jmp case.0x402164.65
push 0xfffffffffffffff0
call fcn.00403a7d
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne case.0x402164.65
jmp 0x403623
push 0xfffffffffffffff0
call fcn.00403a7d
mov edi, eax
cmp byte [edi], 0
je 0x40230a
push edi
call fcn.00406484
mov esi, eax
test esi, esi
je case.0x402164.65
jmp 0x4022da
test al, al
je 0x4022e0
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x5c
jne 0x4022cd
mov bl, byte [esi]
and byte [esi], 0
push edi
call fcn.00406bb0
test eax, eax
jne 0x4022fb
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jmp 0x4022fe
test byte [eax], 0x10
jne 0x402303
inc dword [ebp - 4]
mov byte [esi], bl
inc esi
test bl, bl
jne 0x4022da
cmp dword [ebp - 0xc], 0
push edi
je 0x40232f
push 0xffffffffffffffe6
call fcn.00405e07
push edi
push 0x42c800
call sub.KERNEL32.dll_lstrcpyA
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp case.0x402164.65
push 0xfffffffffffffff5
jmp 0x403021
push 0
call fcn.00403a7d
push eax
call fcn.00406bb0
jmp 0x402a9a
push 0xfffffffffffffff0
call fcn.00403a7d
push 0xffffffffffffffdf
mov dword [ebp - 0x10], eax
call fcn.00403a7d
push dword [ebp - 0x10]
mov esi, 0x40beb0
mov ebx, eax
push esi
call sub.KERNEL32.dll_lstrcpyA
push ebx
call sub.KERNEL32.dll_lstrlenA
push dword [ebp - 0x10]
mov edi, eax
call sub.KERNEL32.dll_lstrlenA
add edi, eax
cmp edi, 0x3fd
jge 0x402395
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4090bc
push esi
call edi
push ebx
push esi
call edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4023ab
push esi
push 0xffffffffffffffe3
jmp 0x403021
cmp dword [ebp + 8], 0
je 0x403623
push dword [ebp - 0x10]
call fcn.00406bb0
test eax, eax
je 0x403623
inc dword [0x426f50]
push ebx
push dword [ebp - 0x10]
call fcn.00406636
push esi
push 0xffffffffffffffe4
jmp 0x403021
xor esi, esi
inc esi
push esi
call fcn.00403a7d
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x402420
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jbe 0x402426
cmp byte [eax], 0
je 0x402426
push ebx
call fcn.00406bb0
test eax, eax
je 0x402420
add eax, 0x2c
push eax
push dword [ebp - 0x20]
call sub.KERNEL32.dll_lstrcpyA
jmp 0x402426
and byte [edi], 0
mov dword [ebp - 4], esi
cmp dword [ebp + 8], 0
jne case.0x402164.65
push 0x400
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp case.0x402164.65
push 0xffffffffffffffff
call fcn.00403a7d
lea ecx, [ebp + 8]
push ecx
push edi
push 0x400
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne case.0x402164.65
and byte [edi], 0
mov dword [ebp - 4], 1
jmp case.0x402164.65
push 0xffffffffffffffef
call fcn.00403a7d
push eax
push edi
call fcn.004065ea
jmp 0x4022a0
push 0x31
call fcn.00403a7d
mov edi, eax
mov eax, dword [ebp - 0x18]
and eax, 7
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], eax
call fcn.0040645e
push edi
mov edi, 0x40b2b0
test eax, eax
je 0x4024b5
push edi
call sub.KERNEL32.dll_lstrcpyA
jmp 0x4024cd
push 0x42c800
push edi
call sub.KERNEL32.dll_lstrcpyA
push eax
call fcn.00406405
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.00406b0f
mov ebx, 0x40bab0
cmp dword [ebp - 0x1c], 3
jl 0x40250e
push edi
call fcn.00406bb0
xor ecx, ecx
test eax, eax
je 0x4024f9
push dword [ebp - 0x30]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffffd
or eax, 0x80000000
and eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x402525
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
cmp dword [ebp - 0x1c], 1
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.004065bb
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x4025ba
cmp dword [ebp - 0x1c], 0
jne 0x402590
push esi
push ebx
call sub.KERNEL32.dll_lstrcpyA
push edi
push esi
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 0x10]
push 0x40b6b0
call fcn.004068f4
push ebx
push esi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [ebp - 0x18]
sar eax, 3
push eax
push 0x40b6b0
call fcn.0040636f
sub eax, 4
je 0x4024d8
dec eax
je 0x4025af
push edi
push 0xfffffffffffffffa
jmp 0x402178
push dword [ebp - 0x14]
push 0xffffffffffffffe2
call fcn.00405e07
cmp dword [ebp - 0x1c], 2
jne case.0x402164.65
inc dword [0x426f48]
jmp case.0x402164.65
inc dword [0x426f48]
jmp 0x40389c
push dword [ebp - 0x14]
push 0xffffffffffffffea
call fcn.00405e07
xor esi, esi
inc dword [0x409270]
push esi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00403dd9
dec dword [0x409270]
cmp dword [ebp - 0x24], 0xffffffff
mov ebx, eax
jne 0x4025ed
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4025fd
push dword [ebp - 0x30]
push esi
push dword [ebp - 0x30]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
jge case.0x402164.65
cmp ebx, 0xfffffffe
jne 0x402627
push 0xffffffffffffffe9
push edi
call fcn.004068f4
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40262f
push 0xffffffffffffffee
push edi
call fcn.004068f4
push 0x10
push edi
call fcn.0040636f
jmp 0x403174
push 0x10
call fcn.00403a7d
mov esi, eax
mov edi, 0x40b2b0
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
push edi
call fcn.00406431
lea eax, [ebp - 0x190]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je case.0x402164.65
test byte [ebp - 0x190], 0x10
jne 0x4026db
lea eax, [ebp - 0x164]
push eax
push edi
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x190]
add esp, 0x10
test al, 1
je 0x4026a5
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4026ba
push esi
push 0xfffffffffffffff2
call fcn.00405e07
jmp 0x4026db
cmp dword [ebp - 0xc], 0
je 0x4026d8
inc dword [0x426f50]
push esi
push 0xfffffffffffffff1
call fcn.00405e07
push 0
push esi
call fcn.00406636
jmp 0x4026db
inc dword [ebp - 4]
lea eax, [ebp - 0x190]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402670
push ebx
jmp 0x4035be
push 0x31
call fcn.00403a7d
push dword [ebp - 0x18]
push eax
call fcn.0040636f
test eax, eax
je 0x403623
cmp eax, dword [ebp + 8]
je 0x40287b
cmp eax, dword [ebp - 0x2c]
jne case.0x402164.65
mov eax, dword [ebp - 0x10]
jmp 0x40389e
push 0
call fcn.00403a7d
mov esi, eax
push esi
call sub.KERNEL32.dll_lstrlenA
add eax, esi
push eax
push esi
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
jne 0x402749
push esi
call fcn.00406431
push dword [ebp - 0xc]
push esi
call fcn.0040639a
push esi
call fcn.00406bb0
test eax, eax
je 0x402766
cmp dword [ebp - 0xc], 2
jne 0x403623
push esi
push 0xffffffffffffffe5
jmp 0x403021
push 1
call fcn.00403a7d
push eax
call sub.KERNEL32.dll_lstrlenA
jmp 0x402bf6
push 2
call fcn.00403a60
push 3
mov ebx, eax
call fcn.00403a60
push 1
mov esi, eax
call fcn.00403a7d
and byte [edi], 0
cmp dword [ebp + 8], 0
mov dword [ebp - 8], eax
je 0x4027ad
test ebx, ebx
je case.0x402164.65
push eax
call sub.KERNEL32.dll_lstrlenA
test esi, esi
jge 0x4027bf
add esi, eax
js case.0x402164.65
cmp esi, eax
jle 0x4027c5
mov esi, eax
mov eax, dword [ebp - 8]
add eax, esi
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
test ebx, ebx
je case.0x402164.65
jge 0x4027e7
push edi
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
jns 0x4027e7
xor ebx, ebx
cmp ebx, 0x400
jge case.0x402164.65
and byte [ebx + edi], 0
jmp case.0x402164.65
push 0x20
call fcn.00403a7d
push 0x31
mov esi, eax
call fcn.00403a7d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40287b
mov eax, dword [ebp + 8]
jmp 0x40389e
xor esi, esi
inc esi
push esi
call fcn.00403a7d
cmp dword [ebp + 8], 0
push 0x400
push edi
push eax
je 0x402847
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40284d
and byte [edi], al
mov dword [ebp - 4], esi
jmp 0x40284d
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
and byte [edi + 0x3ff], 0
jmp case.0x402164.65
push 0
call fcn.00403a60
push 1
mov esi, eax
call fcn.00403a60
cmp dword [ebp - 0x10], 0
jne 0x402877
cmp esi, eax
jl 0x40287b
jle 0x402818
jmp 0x402885
cmp esi, eax
jae 0x402883
mov eax, dword [ebp - 0x24]
jmp 0x40389e
jbe 0x402818
mov eax, dword [ebp - 0x2c]
jmp 0x40389e
xor ebx, ebx
inc ebx
push ebx
call fcn.00403a60
push 2
mov esi, eax
call fcn.00403a60
mov ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xa
ja case.default.0x4028a9
jmp dword [eax*4 + 0x4039ad]
add esi, ecx
jmp case.default.0x4028a9
sub esi, ecx
jmp case.default.0x4028a9
imul ecx, esi
mov esi, ecx
jmp case.default.0x4028a9
test ecx, ecx
je 0x402900
mov eax, esi
cdq
idiv ecx
mov esi, eax
jmp case.default.0x4028a9
or esi, ecx
jmp case.default.0x4028a9
and esi, ecx
jmp case.default.0x4028a9
xor esi, ecx
jmp case.default.0x4028a9
xor eax, eax
test esi, esi
sete al
jmp 0x4028c8
test esi, esi
jne 0x4028ef
jmp 0x4028eb
test esi, esi
je 0x402903
test ecx, ecx
je 0x402903
mov esi, ebx
jmp case.default.0x4028a9
test ecx, ecx
je 0x402900
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp case.default.0x4028a9
mov dword [ebp - 4], ebx
xor esi, esi
push esi
jmp 0x40225c
push 1
call fcn.00403a7d
push 2
mov esi, eax
call fcn.00403a60
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x402164.65
mov eax, dword [ebp + 8]
mov esi, dword [0x40c6b0]
test eax, eax
je 0x40297d
dec eax
test esi, esi
je 0x4030c0
mov esi, dword [esi]
test eax, eax
jne 0x402939
test esi, esi
je 0x4030c0
add esi, 4
mov edi, 0x40b2b0
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [0x40c6b0]
add eax, 4
push eax
push esi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [0x40c6b0]
push edi
add eax, 4
push eax
jmp 0x4035f6
cmp dword [ebp - 0xc], 0
je 0x4029a8
test esi, esi
je 0x403623
lea eax, [esi + 4]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [esi]
push esi
mov dword [0x40c6b0], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x402164.65
push 0x404
call fcn.0040638b
push dword [ebp - 0x18]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.004068f4
mov eax, dword [0x40c6b0]
mov dword [esi], eax
mov dword [0x40c6b0], esi
jmp case.0x402164.65
push 0x33
call fcn.00403a7d
push 0x44
mov dword [ebp + 8], eax
call fcn.00403a7d
test byte [ebp - 0x10], 1
mov ebx, eax
jne 0x4029f6
push dword [ebp + 8]
call fcn.0040685d
mov dword [ebp + 8], eax
test byte [ebp - 0x10], 2
jne 0x402a04
push ebx
call fcn.0040685d
mov ebx, eax
cmp dword [ebp - 8], 0x21
push 1
jne 0x402a4d
call fcn.00403a60
push 2
mov esi, eax
call fcn.00403a60
mov ecx, dword [ebp - 0x10]
sar ecx, 2
je 0x402a3f
lea edx, [ebp - 0x14]
push edx
push ecx
push 0
push ebx
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
jmp 0x402a7a
push ebx
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x402a77
call fcn.00403a7d
push 0x12
mov esi, eax
call fcn.00403a7d
mov cl, byte [eax]
neg cl
sbb ecx, ecx
and ecx, eax
mov al, byte [esi]
neg al
sbb eax, eax
push ecx
and eax, esi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
jl case.0x402164.65
push dword [ebp - 0x14]
jmp 0x40225c
push 0
call fcn.00403a60
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402818
mov eax, dword [ebp - 0xc]
jmp 0x40389e
push 2
call fcn.00403a60
push eax
push 1
call fcn.00403a60
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402bf6
mov eax, dword [0x426f28]
mov ecx, dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
lea esi, [eax + ecx]
test byte [esi + 0x18], 2
je 0x402ae2
push dword [esi]
call edi
mov dword [esi], eax
test byte [esi + 0x18], 8
je 0x402af0
push dword [esi + 8]
call edi
mov dword [esi + 8], eax
test byte [esi + 0x18], 0x10
je 0x402b03
lea eax, [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [esi + 0x10], eax
and dword [esi + 0x18], 0xffffffe5
push esi
push 0xffffffffffffffeb
push 0
call fcn.00403a60
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x402164.65
push dword [ebp - 0xc]
push dword [0x426ee4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x38]
push 0x10
imul eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp + 8]
xor esi, esi
push eax
push esi
push esi
call fcn.00403a7d
push eax
push esi
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push esi
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, esi
je case.0x402164.65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x402164.65
push 0x48
push 0x5a
push dword [0x426ee4]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 2
call fcn.00403a60
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 3
mov dword [0x40aa70], eax
call fcn.00403a60
mov dword [0x40aa80], eax
mov al, byte [ebp - 0x2c]
push dword [ebp - 0xc]
mov cl, al
and cl, 1
mov byte [0x40aa87], 1
mov byte [0x40aa84], cl
mov cl, al
and cl, 2
and al, 4
push 0x40aa8c
mov byte [0x40aa85], cl
mov byte [0x40aa86], al
call fcn.004068f4
push 0x40aa70
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
jmp 0x40225c
push 1
call fcn.00403a60
push eax
push 0
call fcn.00403a60
cmp dword [ebp - 0x24], 0
push eax
jne 0x402c1d
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x402164.65
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x402164.65
push 0
call fcn.00403a7d
push 0x11
mov edi, eax
call fcn.00403a7d
push 0x22
mov dword [ebp + 8], eax
call fcn.00403a7d
push dword [ebp + 8]
mov esi, 0x40beb0
mov ebx, eax
push edi
push str._s__s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
push 0xffffffffffffffec
call fcn.00405e07
mov al, byte [ebx]
push dword [ebp - 0x24]
neg al
sbb eax, eax
push 0x42c800
and eax, ebx
push eax
mov al, byte [edi]
push dword [ebp + 8]
neg al
sbb eax, eax
and eax, edi
push eax
push dword [0x426ee4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jge case.0x402164.65
jmp 0x403623
push 0
call fcn.00403a7d
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.00405e07
push 0x42c800
push esi
call fcn.00406305
test eax, eax
mov dword [ebp - 0x10], eax
je 0x403623
cmp dword [ebp - 0xc], 0
je 0x402d38
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push eax
call edi
mov ebx, 0x102
cmp eax, ebx
jne 0x402d0b
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x402cee
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0xf
push 0xf
lea eax, [ebp - 0x50]
push 0
push eax
call esi
test eax, eax
jne 0x402ce4
push 0x64
push dword [ebp - 0x10]
call edi
cmp eax, ebx
je 0x402cee
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp + 8], 0
jl 0x402d2b
push dword [ebp - 8]
push dword [ebp - 0x1c]
call fcn.00406844
jmp 0x402d38
cmp dword [ebp - 8], 0
je 0x402d38
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x402164.65
push 0
call fcn.00403a7d
push eax
call fcn.00406bb0
mov esi, eax
test esi, esi
je 0x402d6d
push dword [esi + 0x14]
push dword [ebp - 0x1c]
call fcn.00406844
push dword [esi + 0x18]
push ebx
jmp 0x4037b4
and byte [ebx], 0
mov eax, dword [ebp - 0x1c]
and byte [eax], 0
jmp 0x403623
lea eax, [ebp - 0x44]
push 0xfffffffffffffff0
mov dword [ebp + 8], eax
call fcn.00403a7d
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
and byte [ebx], 0
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 1
and byte [eax], 0
test esi, esi
je case.0x402164.65
push esi
call fcn.0040638b
test eax, eax
mov dword [ebp - 8], eax
je case.0x402164.65
push eax
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402e04
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push 0x4090a8
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402e04
mov eax, dword [ebp + 8]
push dword [eax + 8]
push ebx
call fcn.00406844
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [ebp - 0x1c]
call fcn.00406844
and dword [ebp - 4], 0
push dword [ebp - 8]
jmp 0x40299d
xor edi, edi
push CreateFontIndirectA
inc edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [0x426f60], 0
jl 0x402ec4
push 0xfffffffffffffff0
call fcn.00403a7d
push edi
mov ebx, eax
call fcn.00403a7d
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x402e58
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x402ebf
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x402ea4
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x402e8c
push ebx
push dword [ebp + 8]
call fcn.00405e07
call edi
test eax, eax
je 0x402eae
mov dword [ebp - 4], 1
jmp 0x402eae
push 0x40c6b0
push esi
push 0x400
push dword [0x426ee4]
call edi
add esp, 0x10
jmp 0x402eae
push dword [ebp - 8]
push 0xfffffffffffffff7
call fcn.00405e07
cmp dword [ebp - 0x24], 0
jne 0x402ed0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402ed0
push ebx
push 0xfffffffffffffff6
jmp 0x402ecb
push 0x40b6b0
push 0xffffffffffffffe7
call fcn.00405e07
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp case.0x402164.65
push 0xffffffffffffffe0
call fcn.00403a7d
push 0xffffffffffffffef
mov dword [ebp - 0x14], eax
call fcn.00403a7d
push 2
mov esi, eax
call fcn.00403a7d
push 0xffffffffffffffcd
mov dword [ebp - 0x30], eax
call fcn.00403a7d
push 0x45
mov dword [ebp - 8], eax
call fcn.00403a7d
push esi
mov dword [ebp - 0x10], eax
call fcn.0040645e
test eax, eax
jne 0x402f1f
push 0x11
call fcn.00403a7d
lea eax, [ebp + 8]
push eax
push 0x4073a4
push 1
push 0
push 0x4073b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x403015
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x20]
push edx
push 0x4073c4
mov ecx, dword [eax]
push eax
call dword [ecx]
mov ebx, eax
test ebx, ebx
jl 0x403008
mov eax, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
mov eax, dword [ebp + 8]
push 0x42c800
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edi, dword [ebp - 0x2c]
mov esi, 0xff
mov eax, edi
sar eax, 8
and eax, esi
je 0x402f8f
mov ecx, dword [ebp + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov eax, dword [ebp + 8]
mov edx, edi
sar edx, 0x10
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
cmp byte [eax], 0
je 0x402fb5
mov eax, dword [ebp + 8]
and edi, esi
push edi
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
xor eax, eax
cmp ebx, eax
jl 0x402fff
mov esi, 0x40aab0
push 0x400
push esi
push 0xffffffffffffffff
push dword [ebp - 0x14]
mov word [0x40aab0], ax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
jge 0x40302b
push dword [ebp - 0x14]
mov dword [ebp - 4], 1
push 0xfffffffffffffff0
call fcn.00405e07
jmp case.0x402164.65
push dword [ebp - 0x14]
push 0xfffffffffffffff4
jmp 0x403021
push 0
call fcn.00403a7d
push 0x11
mov edi, eax
call fcn.00403a7d
mov esi, eax
mov eax, dword [0x426ee4]
push edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 2
call sub.KERNEL32.dll_lstrlenA
and byte [eax + edi + 1], 0
push esi
call sub.KERNEL32.dll_lstrlenA
and byte [eax + esi + 1], 0
mov ebx, 0x40bab0
push 0xfffffffffffffff8
push ebx
call fcn.004068f4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ax, word [ebp + 8]
push ebx
push 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x36], ebx
mov word [ebp - 0x40], ax
call fcn.00405e07
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.0x402164.65
push 0
push 0xfffffffffffffff9
call fcn.00405e07
jmp 0x403623
cmp dword [ebp - 0x18], 0xbadf00d
je 0x4030d1
push 0x10
push 0xffffffffffffffe8
push 0
call fcn.004068f4
push eax
jmp 0x402632
inc dword [0x426f48]
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x40315a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenProcessToken
push ebx
call esi
push str.LookupPrivilegeValueA
push ebx
mov dword [ebp + 8], eax
call esi
push str.AdjustTokenPrivileges
push ebx
mov dword [ebp - 8], eax
call esi
cmp dword [ebp + 8], edi
mov esi, eax
je 0x40315a
cmp dword [ebp - 8], edi
je 0x40315a
cmp esi, edi
je 0x40315a
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp + 8]
test eax, eax
je 0x40315a
lea eax, [ebp - 0x40]
push eax
push str.SeShutdownPrivilege
push edi
call dword [ebp - 8]
push edi
push edi
lea eax, [ebp - 0x44]
push edi
push eax
push edi
push dword [ebp - 0x20]
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x38], 2
call esi
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x40317e
inc dword [0x4266a4]
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 0x7fffffff
jmp 0x40389e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x402164.65
xor edi, edi
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0x18], edi
je 0x40319d
push ebx
call fcn.00403a7d
mov esi, eax
cmp dword [ebp - 0xc], 0
je 0x4031ac
push 0x11
call fcn.00403a7d
mov ebx, eax
cmp dword [ebp - 0x2c], 0
je 0x4031bb
push 0x22
call fcn.00403a7d
mov edi, eax
push 0xffffffffffffffcd
call fcn.00403a7d
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4022a0
push 1
call fcn.00403a7d
push 0x12
mov esi, eax
call fcn.00403a7d
push 0xffffffffffffffdd
mov ebx, eax
call fcn.00403a7d
push eax
push 0x3ff
push edi
push 0x40903c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x40903c]
cmp eax, dword [edi]
jmp 0x402460
push 0x31
call fcn.00403a7d
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 1
test ecx, ecx
jne 0x40324c
lea ecx, [ebp + 8]
push ecx
push 2
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.0x402164.65
push 2
call fcn.00403a7d
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4032c6
and ecx, 2
push ecx
push eax
push dword [ebp - 0x18]
call fcn.004039d9
test eax, eax
jne case.0x402164.65
and dword [ebp - 4], eax
jmp case.0x402164.65
push 0x12
call fcn.00403a7d
push 0x31
mov edi, eax
call fcn.00403a7d
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
push ecx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x402164.65
mov ebx, dword [ebp - 0x2c]
cmp ebx, 1
jg 0x4032d6
push 0x23
call fcn.00403a7d
mov esi, eax
push esi
call sub.KERNEL32.dll_lstrlenA
inc eax
push eax
xor eax, eax
cmp ebx, 1
push esi
setne al
inc eax
push eax
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40342a
and dword [ebp - 4], eax
jmp 0x40342a
cmp ebx, 2
jne 0x4032ef
push 3
call fcn.00403a60
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
push 4
jmp 0x4032ba
cmp ebx, 3
jne 0x40342a
mov ebx, 0x40bab0
push 0x400
xor esi, esi
push ebx
push esi
push dword [ebp - 0x24]
call fcn.00403dd9
cmp eax, esi
jl 0x40342a
push eax
push ebx
push 3
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40342a
mov dword [ebp - 4], esi
jmp 0x40342a
push 2
call fcn.00403a7d
push 0x13
mov esi, eax
call fcn.00403a7d
mov ebx, eax
lea eax, [ebp - 8]
and byte [edi], 0
push eax
push 0x20019
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403623
lea eax, [ebp - 0x20]
xor esi, esi
push eax
lea eax, [ebp + 8]
push edi
push eax
push esi
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x20], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x4033b9
cmp dword [ebp + 8], 4
je 0x4033a3
cmp dword [ebp + 8], ecx
je 0x40339c
cmp dword [ebp + 8], 2
jne 0x4033b9
cmp dword [ebp - 0x2c], esi
je 0x4033bf
jmp 0x4033bc
cmp dword [ebp - 0x2c], esi
jne 0x4033af
mov dword [ebp - 4], 1
push dword [edi]
push edi
call fcn.00406844
jmp 0x4033bf
and byte [edi], 0
mov dword [ebp - 4], ecx
push dword [ebp - 8]
jmp 0x40342d
push 3
call fcn.00403a60
push 0x12
mov ebx, eax
call fcn.00403a7d
lea ecx, [ebp + 8]
and byte [edi], 0
push ecx
xor esi, esi
push 0x20019
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403623
cmp dword [ebp - 0x2c], esi
mov eax, 0x3ff
mov dword [ebp - 8], eax
je 0x403410
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x403423
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
and byte [edi + 0x3ff], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x402164.65
cmp byte [edi], 0
je case.0x402164.65
push edi
call fcn.0040685d
push eax
jmp 0x402d3b
push 0xfffffffffffffff0
call fcn.00403a7d
push dword [ebp + 8]
push dword [ebp - 0xc]
push eax
call fcn.004065bb
cmp eax, 0xffffffff
jne 0x4035a5
mov eax, dword [ebp - 0x14]
jmp 0x402d73
cmp dword [ebp + 8], 0
je 0x403488
push 1
call fcn.00403a60
mov byte [0x40b6b0], al
xor eax, eax
inc eax
jmp 0x403495
push 0x11
call fcn.00403a7d
push eax
call sub.KERNEL32.dll_lstrlenA
cmp byte [edi], 0
je 0x403623
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push 0x40b6b0
push edi
call fcn.0040685d
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4022a0
push 2
xor esi, esi
call fcn.00403a60
cmp eax, 1
mov dword [ebp - 0x10], eax
jl case.0x402164.65
mov eax, 0x3ff
cmp dword [ebp - 0x10], eax
jle 0x4034de
mov dword [ebp - 0x10], eax
cmp byte [edi], 0
je 0x40356d
and byte [ebp + 0xb], 0
push edi
call fcn.0040685d
cmp dword [ebp - 0x10], 0
mov edi, eax
jle 0x40356d
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x25]
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40356d
cmp dword [ebp - 8], 1
jne 0x40356d
cmp dword [ebp - 0x24], 0
jne 0x40353d
mov al, byte [ebp - 0x25]
test al, al
je 0x40356d
cmp byte [ebp + 0xb], 0xd
je 0x40354d
cmp byte [ebp + 0xb], 0xa
je 0x40354d
mov byte [esi + ebx], al
inc esi
cmp esi, dword [ebp - 0x10]
mov byte [ebp + 0xb], al
jl 0x4034f9
jmp 0x40356d
movzx eax, byte [ebp - 0x25]
push eax
push ebx
call fcn.00406844
jmp 0x40389c
cmp byte [ebp + 0xb], al
je 0x403560
cmp al, 0xd
je 0x40355a
cmp al, 0xa
jne 0x403560
mov byte [esi + ebx], al
inc esi
jmp 0x40356d
push 1
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and byte [esi + ebx], 0
test esi, esi
jmp 0x4022a2
cmp byte [edi], 0
je case.0x402164.65
push dword [ebp + 8]
push 0
push 1
call fcn.00403a60
push eax
push edi
call fcn.0040685d
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x24], 0
jl case.0x402164.65
push eax
push dword [ebp - 0x14]
jmp 0x4037b4
cmp byte [edi], 0
je case.0x402164.65
push edi
call fcn.0040685d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x402164.65
cmp byte [ebx], 0
je 0x402466
lea eax, [ebp - 0x190]
push eax
push ebx
call fcn.0040685d
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402466
lea eax, [ebp - 0x164]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
jmp case.0x402164.65
push 0
call fcn.00403a7d
lea ecx, [ebp - 0x190]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40362f
mov eax, dword [ebp - 0x1c]
and byte [eax], 0
and byte [ebx], 0
mov dword [ebp - 4], 1
jmp case.0x402164.65
push eax
push dword [ebp - 0x1c]
call fcn.00406844
lea eax, [ebp - 0x164]
push eax
push ebx
jmp 0x4035f6
push 0
mov esi, 0xfffffd66
call fcn.00403a7d
mov edi, eax
push edi
call fcn.0040645e
test eax, eax
push edi
je 0x403668
mov ebx, 0x40b6b0
push ebx
call sub.KERNEL32.dll_lstrcpyA
jmp 0x403689
push 0x42c400
push 0x40b6b0
call sub.KERNEL32.dll_lstrcpyA
push eax
call fcn.00406405
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, 0x40b6b0
push ebx
call fcn.00406b0f
push 2
push 0x40000000
push ebx
call fcn.004065bb
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40375d
mov eax, dword [0x426eec]
push eax
mov dword [ebp - 8], eax
call fcn.0040638b
mov edi, eax
test edi, edi
je 0x403754
push 0
call fcn.00404030
push dword [ebp - 8]
push edi
call fcn.00403ffe
mov eax, dword [0x426ee8]
push dword [eax + 0x118]
call fcn.0040638b
mov esi, eax
test esi, esi
mov dword [ebp - 0x20], esi
je 0x40372b
mov eax, dword [0x426ee8]
push dword [eax + 0x118]
push esi
push 0
push dword [eax + 0x114]
call fcn.00403dd9
jmp 0x403718
mov ebx, dword [esi]
mov eax, dword [esi + 4]
add esi, 8
push ebx
add eax, edi
push esi
push eax
call fcn.00406597
add esi, ebx
cmp byte [esi], 0
jne 0x403704
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, 0x40b6b0
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp - 8]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
push esi
push dword [ebp + 8]
push 0xffffffffffffffff
call fcn.00403dd9
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff3
test esi, esi
pop edi
jge 0x403775
push 0xffffffffffffffef
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 1
push ebx
push edi
jmp 0x403021
push 0
call fcn.00403a60
mov esi, eax
cmp esi, dword [0x426f0c]
jae 0x403623
mov ecx, dword [0x426f08]
lea eax, [esi + esi*2]
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
mov dword [ebp - 8], eax
jl 0x4037be
mov eax, dword [eax + ecx*4]
push eax
push dword [ebp - 0x1c]
je 0x403855
call fcn.00406844
jmp case.0x402164.65
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
or edi, 0xffffffff
sub edi, ecx
je 0x4037d7
push 2
call fcn.00403a60
mov dword [ebp + 8], eax
jmp 0x4037e5
push dword [ebp + 8]
push esi
push 0x417
push dword [ebp - 0x20]
call ebx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
test edi, edi
mov dword [ecx + edi*4], eax
je case.0x402164.65
push 0
push esi
push 0x418
push dword [ebp - 0x20]
call ebx
jmp case.0x402164.65
xor esi, esi
push esi
call fcn.00403a60
cmp dword [ebp - 0x24], esi
je 0x40382d
inc dword [0x426f58]
push esi
push esi
push 0x432
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x402164.65
cmp eax, 0x20
jae 0x403623
cmp dword [ebp + 8], esi
mov ecx, dword [0x426ee8]
je 0x40384d
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4 + 0x88], edx
jmp case.0x402164.65
push dword [ecx + eax*4 + 0x88]
push ebx
call fcn.004068f4
jmp case.0x402164.65
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x40386c
cmp dword [0x424d30], eax
je 0x40386c
inc eax
push 0
push eax
push 0xb
push dword [0x426ee4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x18], 0
je case.0x402164.65
push 0
push 0
push dword [0x426ee4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 4]
add dword [0x426f48], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4