Function at 0x401553
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
sub esp, 0x2d4
push ebx
mov edx, dword [0x46b558]
mov eax, section..ndata
push ebp
push esi
mov esi, dword [esp + 0x2e4]
xor ebx, ebx
push edi
push 9
pop ecx
lea edi, [esp + 0x30]
mov dword [esp + 0x28], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x38]
mov edi, ecx
mov esi, dword [esp + 0x34]
mov ebp, esi
shl ebp, 0xe
add ebp, eax
shl edi, 0xe
add edi, eax
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x34]
mov dword [esp + 0x58], ecx
mov dword [0x40c0e4], eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffffe
cmp eax, 0x46
ja case.0x4015b5.69
jmp dword [eax*4 + 0x403447]
push esi
push str.Jump:__d
call fcn.0040724c
mov eax, dword [esp + 0x3c]
pop ecx
pop ecx
jmp 0x403439
push ebx
call fcn.004035d7
push eax
push str.Aborting:___s_
call fcn.0040724c
pop ecx
pop ecx
push ebx
push dword [esp + 0x38]
call fcn.00406739
mov eax, 0x7fffffff
jmp 0x403439
inc dword [0x46b54c]
test edx, edx
je 0x4015ef
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4015ef
push esi
call fcn.00403696
lea esi, [eax - 1]
push esi
push str.Call:__d
call fcn.0040724c
pop ecx
pop ecx
push ebx
push esi
call fcn.00401399
jmp 0x403439
push ebx
call fcn.004035d7
push eax
push str.DetailPrint:__s
call fcn.0040724c
pop ecx
pop ecx
push ebx
push dword [esp + 0x38]
call fcn.00406739
jmp case.0x4015b5.69
push ebx
call fcn.0040359b
mov esi, eax
push esi
push str.Sleep__d_
call fcn.0040724c
xor eax, eax
add esp, 0xc
inc eax
cmp esi, eax
cmovg eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4015b5.69
push str.BringToFront
call fcn.0040724c
mov eax, dword [esp + 0x2c]
pop ecx
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x4015b5.69
mov eax, dword [esp + 0x3c]
test eax, eax
jg 0x4016d5
jne 0x4016ad
mov eax, dword [esi*4 + 0x473620]
mov dword [esi*4 + 0x4735e0], eax
push 1
call fcn.0040359b
mov ecx, eax
mov eax, dword [esp + 0x38]
push ecx
push eax
push str.SetFlag:__d_d
mov dword [eax*4 + 0x473620], ecx
call fcn.0040724c
add esp, 0x10
jmp case.0x4015b5.69
mov eax, dword [esi*4 + 0x4735e0]
mov dword [esi*4 + 0x473620], eax
jmp case.0x4015b5.69
mov ecx, dword [esp + 0x3c]
push 4
mov edx, dword [ecx*4 + 0x473620]
mov eax, edx
and eax, dword [esp + 0x44]
mov dword [ecx*4 + 0x473620], eax
xor eax, eax
test edx, edx
pop ecx
cmove eax, ecx
mov eax, dword [esp + eax + 0x34]
jmp 0x403439
push dword [ecx*4 + 0x473620]
push ebp
call fcn.004071b5
jmp case.0x4015b5.69
mov eax, dword [0x46b544]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x40173c
push ecx
push eax
call edi
mov esi, dword [esp + 0x34]
mov eax, dword [0x46b548]
test eax, eax
je case.0x4015b5.69
push esi
push eax
call edi
jmp case.0x4015b5.69
push 0xfffffffffffffff0
call fcn.004035d7
push dword [esp + 0x38]
mov esi, eax
push esi
push str.SetFileAttributes:___s_:_08X
call fcn.0040724c
add esp, 0xc
push dword [esp + 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x4015b5.69
push str.SetFileAttributes_failed.
call fcn.0040724c
pop ecx
xor eax, eax
inc eax
jmp 0x403431
push 0xfffffffffffffff0
call fcn.004035d7
push dword [esp + 0x38]
mov esi, eax
push esi
push str.CreateDirectory:___s____d_
call fcn.0040724c
add esp, 0xc
push esi
call fcn.00407883
mov edi, eax
test edi, edi
je 0x40184a
push 0x5c
push edi
call fcn.0040718c
mov edi, eax
xor eax, eax
movzx ebx, word [edi]
mov word [edi], ax
test bx, bx
jne 0x4017ec
cmp dword [esp + 0x3c], eax
je 0x4017ec
call fcn.00406efa
test eax, eax
je 0x4017ec
push esi
call fcn.0040683d
jmp 0x4017f2
push esi
call fcn.0040681d
test eax, eax
je 0x40182e
cmp eax, 0xb7
je 0x401812
push eax
push esi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.0040724c
add esp, 0xc
inc dword [esp + 0x10]
jmp 0x40183b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40183b
push esi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.0040724c
inc dword [esp + 0x18]
jmp 0x401839
push esi
push str.CreateDirectory:___s__created
call fcn.0040724c
pop ecx
pop ecx
mov word [edi], bx
add edi, 2
test bx, bx
jne 0x4017be
cmp dword [esp + 0x38], 0
push 0x4100e8
je 0x401896
push 0xffffffffffffffe6
call fcn.00406739
push esi
push 0x4cc000
call fcn.004077d8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne case.0x4015b5.69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.SetCurrentDirectory__s__failed___d_
call fcn.0040724c
mov eax, dword [esp + 0x1c]
add esp, 0xc
inc eax
jmp 0x403431
push 0xfffffffffffffff5
jmp 0x401646
push ebx
call fcn.004035d7
mov esi, eax
push esi
call fcn.00407165
test eax, eax
je 0x4018ca
push dword [esp + 0x38]
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.0040724c
add esp, 0xc
mov eax, dword [esp + 0x38]
jmp 0x403439
push dword [esp + 0x3c]
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.0040724c
add esp, 0xc
mov eax, dword [esp + 0x3c]
jmp 0x403439
push 0xffffffffffffffd0
call fcn.004035d7
push 0xffffffffffffffdf
mov edi, eax
call fcn.004035d7
push 0x13
mov ebx, eax
call fcn.004035d7
mov esi, eax
push esi
push str.Rename:__s
call fcn.0040724c
pop ecx
pop ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x401925
push 0x4100e8
push 0xffffffffffffffe3
jmp 0x401646
cmp dword [esp + 0x3c], 0
je 0x40195b
push edi
call fcn.00407165
test eax, eax
je 0x40195b
push ebx
push edi
call fcn.00406c3b
push 0x4100e8
push 0xffffffffffffffe4
call fcn.00406739
push esi
push str.Rename_on_reboot:__s
call fcn.0040724c
pop ecx
pop ecx
jmp case.0x4015b5.69
push esi
push str.Rename_failed:__s
call fcn.0040724c
pop ecx
jmp 0x40178a
push ebx
call fcn.004035d7
mov esi, eax
mov ebp, 0x2000
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x401999
xor eax, eax
inc eax
xor ecx, ecx
mov dword [esp + 0x10], eax
mov word [edi], cx
jmp 0x4019c1
mov eax, dword [esp + 0x18]
cmp eax, esi
jbe 0x4019bd
cmp word [eax], bx
je 0x4019bd
push esi
call fcn.00407165
test eax, eax
je 0x40198b
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call fcn.004077d8
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x3c], ebx
jne 0x403431
push ebp
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp case.0x4015b5.69
push 0xffffffffffffffff
call fcn.004035d7
lea ecx, [esp + 0x58]
push ecx
push ebp
push 0x2000
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x4015b5.69
xor eax, eax
inc eax
xor ecx, ecx
mov word [ebp], cx
jmp 0x403431
push 0xffffffffffffffef
call fcn.004035d7
push eax
push ebp
call fcn.00407714
test eax, eax
jne case.0x4015b5.69
jmp 0x40178b
push 0x31
call fcn.004035d7
mov ecx, dword [esp + 0x34]
mov ebp, eax
mov eax, ecx
mov dword [esp + 0x14], ebp
sar ecx, 3
and eax, 7
push ebp
and ecx, 2
mov dword [esp + 0x20], eax
push ecx
push eax
push str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
call fcn.0040724c
add esp, 0x10
push ebp
call fcn.00407b03
mov edi, 0x40c0e8
push ebp
test eax, eax
je 0x401a6d
push edi
call fcn.004077d8
jmp 0x401a84
push 0x4cc000
push edi
call fcn.004077d8
push eax
call fcn.004070ec
push eax
call sub.KERNEL32.dll_lstrcatW
push edi
call fcn.00407a3f
xor esi, esi
mov ebp, 0x4100e8
inc esi
mov eax, dword [esp + 0x1c]
cmp eax, 3
jl 0x401acf
push edi
call fcn.00407165
mov ecx, ebx
test eax, eax
je 0x401ab8
lea ecx, [esp + 0x44]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffd
or eax, 0x80000000
and eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x401ad9
push edi
call fcn.0040785b
xor eax, eax
cmp dword [esp + 0x1c], esi
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.004075d9
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
jne 0x401bc2
cmp dword [esp + 0x1c], ebx
jne 0x401b97
push edi
push str.File:_error_creating___s_
call fcn.0040724c
pop ecx
pop ecx
push section..ndata
push 0x4140e8
call fcn.004077d8
push edi
push section..ndata
call fcn.004077d8
push dword [esp + 0x4c]
push ebp
call fcn.004068b9
push 0x4140e8
push section..ndata
call fcn.004077d8
mov eax, dword [esp + 0x34]
sar eax, 3
push eax
push ebp
call fcn.00407766
sub eax, 4
jne 0x401b69
push str.File:_error__user_retry
call fcn.0040724c
pop ecx
jmp 0x401a92
sub eax, 1
je 0x401b81
push str.File:_error__user_abort
call fcn.0040724c
pop ecx
push edi
push 0xfffffffffffffffa
jmp 0x4015ea
push str.File:_error__user_cancel
call fcn.0040724c
inc dword [0x473628]
pop ecx
jmp 0x403437
push dword [esp + 0x14]
push 0xffffffffffffffe2
call fcn.00406739
mov ebx, dword [esp + 0x1c]
push ebx
push edi
push str.File:_skipped:___s___overwriteflag_d_
call fcn.0040724c
add esp, 0xc
xor eax, eax
cmp ebx, 2
sete al
jmp 0x403431
push dword [esp + 0x14]
push 0xffffffffffffffea
call fcn.00406739
push dword [esp + 0x50]
inc dword [0x473654]
cmp dword [esp + 0x34], 0x15
push ebx
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x50]
push dword [esp + 0x50]
jne 0x401bfc
push esi
call fcn.0040392a
mov esi, eax
mov eax, edx
mov dword [esp + 0x18], eax
jmp 0x401c0a
push ebx
call fcn.0040392a
mov esi, eax
mov dword [esp + 0x18], edx
mov eax, edx
dec dword [0x473654]
push edi
push eax
push esi
push str.File:_wrote__d_to___s_
call fcn.0040724c
or ebp, 0xffffffff
add esp, 0x10
cmp dword [esp + 0x44], ebp
jne 0x401c2f
cmp dword [esp + 0x48], ebp
je 0x401c40
lea eax, [esp + 0x44]
push eax
push ebx
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
cmp eax, ebx
jg case.0x4015b5.69
jl 0x401c60
cmp esi, ebx
jae case.0x4015b5.69
cmp esi, 0xfffffffe
jne 0x401c7d
cmp eax, ebp
jne 0x401c7d
push 0xffffffffffffffe9
push edi
call fcn.004068b9
push dword [esp + 0x14]
push edi
call sub.KERNEL32.dll_lstrcatW
jmp 0x401c85
push 0xffffffffffffffee
push edi
call fcn.004068b9
push edi
push 0x409860
call fcn.0040724c
pop ecx
pop ecx
push 0x200010
push edi
call fcn.00407766
jmp 0x4015ef
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
cmp dword [0x473564], ebx
je 0x403431
or esi, 0xffffffff
cmp dword [0x40c014], esi
jne 0x401d1f
push ebx
call fcn.004035d7
mov edi, eax
push edi
call fcn.00407b03
test eax, eax
jne 0x401cff
push 0x4e0000
mov ebp, 0x4100e8
push ebp
call fcn.004077d8
push ebp
call fcn.004079ce
push eax
push ebp
call fcn.004077d8
push ebp
push str._s.nsisbin
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
call fcn.00407a3f
push 3
push 0x80000000
push edi
call fcn.004075d9
mov dword [0x40c014], eax
cmp eax, esi
je case.0x4015b5.69
mov eax, ebx
jmp 0x403431
push ebx
call fcn.004035d7
mov esi, eax
push esi
push str.Delete:___s_
call fcn.0040724c
pop ecx
pop ecx
push dword [esp + 0x38]
push esi
call fcn.0040737d
jmp case.0x4015b5.69
push 0x31
call fcn.004035d7
mov esi, eax
push esi
push dword [esp + 0x38]
push str.MessageBox:__d___s_
call fcn.0040724c
add esp, 0xc
push dword [esp + 0x34]
push esi
call fcn.00407766
test eax, eax
je 0x40178b
cmp eax, dword [esp + 0x3c]
je 0x401edd
cmp eax, dword [esp + 0x44]
jne case.0x4015b5.69
mov eax, dword [esp + 0x48]
jmp 0x403439
push 0xfffffffffffffff0
call fcn.004035d7
mov esi, eax
push esi
push str.RMDir:___s_
jmp 0x401d34
push 1
call fcn.004035d7
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
jmp 0x40171a
push 2
call fcn.0040359b
push 3
mov edi, eax
mov esi, edx
call fcn.0040359b
pop ecx
pop ecx
push 1
mov ebx, eax
call fcn.004035d7
push eax
mov dword [esp + 0x28], eax
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
test esi, esi
mov word [ebp], cx
cmove edi, eax
test edi, edi
je case.0x4015b5.69
test ebx, ebx
jns 0x401dfe
add ebx, eax
js case.0x4015b5.69
cmp ebx, eax
cmovg ebx, eax
mov eax, dword [esp + 0x24]
lea eax, [eax + ebx*2]
push eax
push ebp
call fcn.004077d8
test edi, edi
jns 0x401e1d
push ebp
call sub.KERNEL32.dll_lstrlenW
add edi, eax
xor eax, eax
test edi, edi
cmovns eax, edi
cmp eax, 0x2000
jge case.0x4015b5.69
xor ecx, ecx
mov word [ebp + eax*2], cx
jmp case.0x4015b5.69
push 0x20
call fcn.004035d7
push 0x31
mov esi, eax
call fcn.004035d7
push eax
push esi
cmp dword [esp + 0x4c], ebx
jne 0x401e63
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4018dc
jmp 0x401edd
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x401e59
xor esi, esi
inc esi
push esi
call fcn.004035d7
push 0x2000
mov edi, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x401e99
cmp dword [esp + 0x3c], ebx
je 0x401ea3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401ea3
xor ecx, ecx
mov eax, esi
mov word [ebp], cx
jmp 0x401ea7
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [ebp + 0x3ffe], cx
jmp 0x403431
mov esi, dword [esp + 0x48]
push ebx
call fcn.0040359b
push 1
mov edi, eax
call fcn.0040359b
pop ecx
pop ecx
test esi, esi
jne 0x401ed9
cmp edi, eax
jl 0x401edd
jg 0x401eec
jmp 0x4018dc
cmp edi, eax
jae 0x401ee6
mov eax, dword [esp + 0x40]
jmp 0x403439
jbe 0x4018dc
mov eax, dword [esp + 0x44]
jmp 0x403439
xor edi, edi
inc edi
push edi
call fcn.0040359b
push 2
mov esi, eax
call fcn.0040359b
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x40]
cmp eax, 0xd
ja case.default.0x401f14
jmp dword [eax*4 + 0x403563]
add esi, ecx
jmp case.default.0x401f14
sub esi, ecx
jmp case.default.0x401f14
imul esi, ecx
jmp case.default.0x401f14
test ecx, ecx
je 0x401f35
mov eax, esi
cdq
idiv ecx
mov esi, eax
jmp 0x401f37
mov esi, ebx
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
jmp case.default.0x401f14
or esi, ecx
jmp case.default.0x401f14
and esi, ecx
jmp case.default.0x401f14
xor esi, ecx
jmp case.default.0x401f14
xor eax, eax
test esi, esi
sete al
mov esi, eax
jmp case.default.0x401f14
test esi, esi
jne 0x401f63
test ecx, ecx
je 0x401f6b
mov esi, edi
jmp case.default.0x401f14
test esi, esi
jne 0x401f5f
mov esi, ebx
jmp case.default.0x401f14
test ecx, ecx
je 0x401f35
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x401f37
shl esi, cl
jmp case.default.0x401f14
sar esi, cl
jmp case.default.0x401f14
shr esi, cl
push esi
jmp 0x40171a
push 1
call fcn.004035d7
push 2
mov esi, eax
call fcn.0040359b
push eax
push esi
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x4016cd
mov eax, dword [esp + 0x3c]
mov esi, dword [0x40c0e0]
test eax, eax
je 0x40201c
dec eax
test esi, esi
je 0x401ff9
mov esi, dword [esi]
test eax, eax
jne 0x401fb8
test esi, esi
je 0x401ff9
add esi, 4
mov edi, 0x40c0e8
push esi
push edi
call fcn.004077d8
mov eax, dword [0x40c0e0]
add eax, 4
push eax
push esi
call fcn.004077d8
mov eax, dword [0x40c0e0]
push edi
add eax, 4
push eax
call fcn.004077d8
jmp case.0x4015b5.69
push dword [esp + 0x3c]
push str.Exch:_stack____d_elements
call fcn.0040724c
pop ecx
pop ecx
push 0x200010
push 0xffffffffffffffe8
push ebx
call fcn.004068b9
push eax
jmp 0x401c98
test ecx, ecx
je 0x40204b
test esi, esi
jne 0x40202e
push str.Pop:_stack_empty
jmp 0x401785
lea eax, [esi + 4]
push eax
push ebp
call fcn.004077d8
mov eax, dword [esi]
mov dword [0x40c0e0], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x4015b5.69
push 0x4004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [esp + 0x34]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.004068b9
mov eax, dword [0x40c0e0]
mov dword [esi], eax
mov dword [0x40c0e0], esi
jmp case.0x4015b5.69
push 3
call fcn.0040359b
mov esi, eax
push 4
mov dword [esp + 0x20], esi
call fcn.0040359b
mov edi, eax
mov eax, dword [esp + 0x50]
pop ecx
pop ecx
test al, 1
je 0x4020aa
push 0x33
call fcn.004035d7
mov esi, eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], esi
test al, 2
je 0x4020b7
push 0x44
call fcn.004035d7
mov edi, eax
cmp dword [esp + 0x30], 0x23
push 1
jne 0x40210f
call fcn.0040359b
push 2
mov dword [esp + 0x20], eax
call fcn.0040359b
pop ecx
pop ecx
mov ecx, dword [esp + 0x48]
sar ecx, 2
test ecx, ecx
je 0x402100
lea edx, [esp + 0x14]
push edx
push ecx
push ebx
push edi
push esi
push eax
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ecx, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
jmp 0x402144
push edi
push esi
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40213a
call fcn.004035d7
push 0x12
mov esi, eax
call fcn.004035d7
xor ecx, ecx
cmp word [eax], bx
cmovne ecx, eax
push ecx
xor ecx, ecx
cmp word [esi], bx
cmovne ecx, esi
push ecx
push edi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x34], ebx
jl 0x403431
push ecx
jmp 0x40171a
push ebx
call fcn.0040359b
pop ecx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4018dc
jmp 0x4018c1
push 2
call fcn.0040359b
push 1
mov esi, eax
call fcn.0040359b
pop ecx
pop ecx
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401db2
mov esi, dword [0x4735a8]
push ebx
add esi, ecx
call fcn.0040359b
pop ecx
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x4015b5.69
test dword [esp + 0x40], 0x100
je 0x4021c0
push 2
call fcn.0040359b
pop ecx
jmp 0x4021cb
push dword [esp + 0x3c]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov eax, dword [esp + 0x40]
mov ecx, eax
mov edi, eax
and ecx, 4
shr edi, 0x1e
mov dword [esp + 0x14], ecx
mov esi, eax
mov ecx, eax
and esi, 3
shr ecx, 0x1f
and edi, 1
mov dword [esp + 0x24], ecx
test eax, 0x10000
je 0x402200
push 0x11
call fcn.004035d7
jmp 0x402205
movzx eax, word [esp + 0x38]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x40]
and eax, 0xfef0
push eax
mov eax, dword [esp + 0x68]
imul eax, edi
push eax
mov eax, dword [esp + 0x68]
imul eax, dword [esp + 0x2c]
push eax
xor eax, eax
cmp dword [esp + 0x20], eax
push esi
push dword [esp + 0x28]
cmovne eax, dword [0x46b554]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
push edi
push esi
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x402269
test esi, esi
jne 0x402269
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x34], 0
jl case.0x4015b5.69
push edi
jmp 0x40171a
push edx
call dword [sym.imp.USER32.dll_GetDC]
push 2
mov edi, eax
call fcn.0040359b
pop ecx
push 0x48
push 0x5a
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x4200e8], eax
mov eax, dword [esp + 0x28]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
call fcn.0040359b
pop ecx
mov ecx, dword [esp + 0x44]
push dword [esp + 0x38]
mov dword [0x4200f8], eax
mov al, cl
and al, 1
mov byte [0x4200ff], 1
mov byte [0x4200fc], al
mov al, cl
and al, 2
and cl, 4
push 0x420104
mov byte [0x4200fd], al
mov byte [0x4200fe], cl
call fcn.004068b9
push 0x4200e8
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x401db2
push ebx
call fcn.0040359b
push 1
mov esi, eax
call fcn.0040359b
mov edi, eax
pop ecx
pop ecx
cmp dword [esp + 0x3c], ebx
je 0x402328
push str.HideWindow
call fcn.0040724c
pop ecx
push edi
push esi
cmp dword [esp + 0x48], ebx
jne 0x40233b
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x4015b5.69
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x4015b5.69
push ebx
call fcn.004035d7
push 0x31
mov esi, eax
call fcn.004035d7
push 0x22
mov ebp, eax
call fcn.004035d7
push 0x15
mov edi, eax
call fcn.004035d7
push 0x4100e8
push 0xffffffffffffffec
call fcn.00406739
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x60], eax
xor eax, eax
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x74], ecx
cmp word [esi], bx
mov dword [esp + 0x68], ebp
cmovne eax, esi
mov dword [esp + 0x64], eax
xor eax, eax
cmp word [edi], bx
mov dword [esp + 0x70], 0x4cc000
cmovne eax, edi
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
push eax
call fcn.004076b1
test eax, eax
jne 0x4023d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ebp
push esi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.0040724c
add esp, 0x14
jmp 0x40178b
test byte [esp + 0x5c], 0x40
je 0x4023f9
push dword [esp + 0x90]
call fcn.00406f12
push dword [esp + 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
push str.ExecShell:_success____s_:_file:__s__params:__s__
jmp 0x4016c8
push ebx
call fcn.004035d7
mov esi, eax
push esi
push str.Exec:_command__s_
call fcn.0040724c
pop ecx
pop ecx
push esi
push 0xffffffffffffffeb
call fcn.00406739
push esi
call fcn.0040733a
mov ebx, eax
push esi
test ebx, ebx
je 0x402477
push str.Exec:_success____s__
call fcn.0040724c
cmp dword [esp + 0x44], 0
pop ecx
pop ecx
je 0x40246b
push ebx
call fcn.00406f12
cmp dword [esp + 0x38], 0
mov ecx, eax
jl 0x40245b
push ecx
push edi
call fcn.004071b5
jmp 0x40246b
mov eax, dword [esp + 0x10]
xor edx, edx
inc edx
test ecx, ecx
cmovne eax, edx
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4015b5.69
push str.Exec:_failed_createprocess____s__
jmp 0x401961
push 2
call fcn.004035d7
push eax
call fcn.00407165
mov esi, eax
test esi, esi
je 0x4024a5
push dword [esi + 0x14]
push edi
call fcn.004071b5
push dword [esi + 0x18]
jmp 0x40171a
xor eax, eax
mov word [ebp], ax
mov word [edi], ax
jmp 0x40178b
push 0xffffffffffffffee
call fcn.004035d7
lea ecx, [esp + 0x58]
mov dword [esp + 0x2c], eax
push ecx
push eax
push 0xa
call fcn.004075a4
call eax
mov ecx, eax
xor eax, eax
mov word [ebp], ax
mov word [edi], ax
inc eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x403431
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je case.0x4015b5.69
push 0xb
call fcn.004075a4
push 0xc
mov esi, eax
call fcn.004075a4
push dword [esp + 0x14]
mov dword [esp + 0x24], eax
push dword [esp + 0x28]
push ebx
push dword [esp + 0x38]
call esi
test eax, eax
je 0x402568
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x409ac4
push dword [esp + 0x20]
call dword [esp + 0x30]
test eax, eax
je 0x402568
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
push dword [ecx + eax*4 + 8]
push ebp
call fcn.004071b5
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
push dword [eax + ecx*4 + 0xc]
push edi
call fcn.004071b5
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
jmp 0x402040
xor ebp, ebp
inc ebp
mov dword [esp + 0x10], ebp
cmp dword [0x4735c0], ebx
jl 0x402675
push 0xfffffffffffffff0
call fcn.004035d7
push ebp
mov edi, eax
call fcn.004035d7
mov dword [esp + 0x18], eax
cmp dword [esp + 0x44], ebx
je 0x4025aa
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4025be
push 8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x40265e
push dword [esp + 0x18]
push esi
call fcn.00406c67
mov ecx, eax
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x40261a
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x3c], ebx
je 0x4025fa
push 0x4100e8
push dword [esp + 0x40]
call fcn.00406739
call dword [esp + 0x24]
test eax, eax
je 0x402635
mov eax, ebp
mov dword [esp + 0x10], eax
jmp 0x402639
mov eax, dword [esp + 0x28]
push section..data
push 0x40c0e0
push section..ndata
push 0x2000
push eax
call ecx
add esp, 0x14
jmp 0x402635
mov ebx, dword [esp + 0x18]
push ebx
push 0xfffffffffffffff7
call fcn.00406739
push edi
push ebx
push 0x409ac8
call fcn.0040724c
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x40], 0
jne 0x403431
push esi
call fcn.00404612
test eax, eax
je case.0x4015b5.69
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x4015b5.69
push 0x4100e8
push 0xfffffffffffffff6
call fcn.00406739
push edi
push str.Error_registering_DLL:_Could_not_load__s
jmp 0x40194f
push 0x4100e8
push 0xffffffffffffffe7
call fcn.00406739
push str.Error_registering_DLL:_Could_not_initialize_OLE
call fcn.0040724c
jmp 0x401955
push 0xfffffffffffffff0
call fcn.004035d7
push 0xffffffffffffffdf
mov dword [esp + 0x24], eax
call fcn.004035d7
push 2
mov dword [esp + 0x18], eax
call fcn.004035d7
push 0xffffffffffffffcd
mov dword [esp + 0x30], eax
call fcn.004035d7
push 0x45
mov ebp, eax
call fcn.004035d7
mov ecx, dword [esp + 0x44]
mov esi, ecx
push dword [esp + 0x14]
mov dword [esp + 0x5c], eax
mov edi, ecx
mov eax, ecx
sar edi, 0xc
and eax, 0x8000
sar ecx, 0x10
mov dword [esp + 0x28], eax
and esi, 0xfff
movzx eax, cx
and edi, 7
mov dword [esp + 0x58], esi
mov dword [esp + 0x1c], eax
call fcn.00407b03
test eax, eax
jne 0x402706
push 0x21
call fcn.004035d7
push dword [esp + 0x18]
push edi
push esi
push ebp
push dword [esp + 0x3c]
push dword [esp + 0x28]
push dword [esp + 0x38]
push str.CreateShortcut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
call fcn.0040724c
add esp, 0x20
lea eax, [esp + 0x1c]
xor esi, esi
inc esi
push eax
push 0x40ab88
push esi
push ebx
push 0x40aba8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402811
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push 0x40ab98
push eax
mov ecx, dword [eax]
call dword [ecx]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402803
mov eax, dword [esp + 0x1c]
push dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x24], ebx
jne 0x402792
mov eax, dword [esp + 0x1c]
push 0x4cc000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test edi, edi
je 0x4027a1
mov eax, dword [esp + 0x1c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x1c]
push dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp word [ebp], bx
je 0x4027c4
mov eax, dword [esp + 0x1c]
push dword [esp + 0x54]
push ebp
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x1c]
push dword [esp + 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x1c]
push dword [esp + 0x58]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [esp + 0x10], ebx
jl 0x4027f9
mov eax, dword [esp + 0x28]
push esi
push dword [esp + 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
sar eax, 0x1f
and eax, 0xfffffffc
push 0x4100e8
sub eax, 0xc
push eax
call fcn.00406739
mov eax, dword [esp + 0x10]
shr eax, 0x1f
jmp 0x403431
push ebx
call fcn.004035d7
push 0x11
mov esi, eax
call fcn.004035d7
push 0x23
mov edi, eax
call fcn.004035d7
push edi
push esi
push str.CopyFiles___s_____s_
mov ebp, eax
call fcn.0040724c
add esp, 0xc
push esi
call fcn.00407165
test eax, eax
jne 0x402871
push ebx
push 0xfffffffffffffff9
call fcn.00406739
jmp 0x40178b
mov eax, dword [esp + 0x28]
push esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 2
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push edi
mov word [esi + eax*2 + 2], cx
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push ebp
push ebx
mov word [edi + eax*2 + 2], cx
mov ax, word [esp + 0x44]
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x7a], ebp
mov word [esp + 0x70], ax
call fcn.00406739
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x4015b5.69
jmp 0x402864
cmp esi, 0xbadf00d
jne 0x402009
inc dword [0x473634]
jmp case.0x4015b5.69
push str._RM_
mov ebp, 0x4100e8
mov dword [esp + 0x18], ebx
push ebp
mov dword [esp + 0x20], ebx
call fcn.004077d8
push ebp
mov edi, 0x4140e8
push edi
call fcn.004077d8
cmp dword [esp + 0x34], ebx
je 0x402916
push ebx
call fcn.004035d7
mov ebx, eax
cmp dword [esp + 0x38], 0
je 0x402928
push 0x11
call fcn.004035d7
mov dword [esp + 0x14], eax
cmp dword [esp + 0x44], 0
je 0x40293a
push 0x22
call fcn.004035d7
mov dword [esp + 0x18], eax
push 0xffffffffffffffcd
call fcn.004035d7
mov esi, eax
push esi
push edi
push ebp
push 0x40c0e8
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.0040724c
add esp, 0x14
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x401a18
xor ebx, ebx
mov dword [esp + 0x58], 0xa
inc ebx
push ebx
call fcn.004035d7
push 0x12
mov edi, eax
call fcn.004035d7
push 0xffffffffffffffdd
mov esi, eax
call fcn.004035d7
push eax
push 0x1fff
push ebp
lea eax, [esp + 0x64]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
pop eax
cmp word [ebp], ax
jne case.0x4015b5.69
mov eax, ebx
jmp 0x4019ff
xor ebx, ebx
push ecx
inc ebx
call fcn.00406fce
cmp dword [esp + 0x48], 0
mov ebp, eax
pop ecx
jne 0x402a08
push 2
call fcn.0040365a
mov edi, eax
test edi, edi
je 0x402a33
push 0x33
call fcn.004035d7
mov esi, eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push 0x4140e8
push ebp
push str.DeleteRegValue:___s_s____s_
mov ebx, eax
call fcn.0040724c
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402a33
push 0x22
call fcn.004035d7
mov esi, eax
push esi
push ebp
push str.DeleteRegKey:___s_s_
call fcn.0040724c
mov ecx, dword [esp + 0x50]
add esp, 0xc
sar ecx, 1
push ecx
push esi
push dword [esp + 0x60]
call fcn.00403615
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x403431
mov eax, dword [esp + 0x48]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x4c]
push 2
mov dword [esp + 0x18], eax
call fcn.004035d7
push 0x11
mov dword [esp + 0x24], eax
call fcn.004035d7
mov edi, eax
push esi
mov dword [esp + 0x2c], edi
call fcn.00406fce
pop ecx
mov dword [esp + 0x1c], eax
xor ebp, ebp
lea eax, [esp + 0x58]
inc ebp
push eax
push 0x100022
push edi
push esi
mov dword [esp + 0x20], ebp
call fcn.004035bc
push eax
call fcn.00406ca3
mov esi, dword [esp + 0x58]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
mov dword [esp + 0x24], esi
test esi, esi
je 0x402bfb
mov eax, dword [esp + 0x54]
mov esi, 0x4140e8
cmp eax, ebp
jne 0x402af5
push 0x23
call fcn.004035d7
push esi
call sub.KERNEL32.dll_lstrlenW
cmp dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x28]
push esi
push dword [esp + 0x24]
lea edi, [eax*2 + 2]
push ebp
push dword [esp + 0x28]
jne 0x402aee
push str.WriteRegStr:___s_s____s___s_
call fcn.0040724c
add esp, 0x14
jmp 0x402bbb
push str.WriteRegExpandStr:___s_s____s___s_
jmp 0x402ae1
push 4
pop edi
cmp eax, edi
jne 0x402b28
push 3
call fcn.0040359b
mov ebp, dword [esp + 0x2c]
push eax
push dword [esp + 0x28]
mov dword [0x4140e8], eax
push ebp
push dword [esp + 0x2c]
push str.WriteRegDWORD:___s_s____s__0x_08x_
call fcn.0040724c
add esp, 0x18
jmp 0x402bbb
mov edi, ebx
cmp eax, 3
jne 0x402bb7
push dword [esp + 0x50]
mov ecx, dword [esp + 0x18]
mov edx, str.WriteRegBin
push 0xc000
cmp ecx, 7
mov eax, str.WriteRegMultiStr
push esi
cmovne eax, edx
mov edx, str.WriteRegNone
test ecx, ecx
push ebx
push dword [esp + 0x54]
cmovne edx, eax
push dword [esp + 0x54]
mov dword [esp + 0x6c], edx
cmp dword [0x473564], ebx
je 0x402b73
push ebp
jmp 0x402b74
push ebx
call fcn.0040392a
mov edi, eax
lea eax, [esp + 0x94]
push edi
push esi
push 0x80
push eax
call fcn.00406f54
mov ebp, dword [esp + 0x38]
lea eax, [esp + 0xa4]
push eax
push dword [esp + 0x34]
push ebp
push dword [esp + 0x38]
push dword [esp + 0x74]
push str._s:___s_s____s___s_
call fcn.0040724c
add esp, 0x28
jmp 0x402bbb
mov ebp, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x28]
push esi
push dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402bdc
mov dword [esp + 0x10], ebx
jmp 0x402bef
push esi
push ebp
push dword [esp + 0x24]
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.0040724c
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4015b5.69
push edi
push dword [esp + 0x20]
push str.WriteReg:_error_creating_key___s_s_
call fcn.0040724c
add esp, 0xc
jmp case.0x4015b5.69
push 0x20019
call fcn.0040365a
push 0x33
mov esi, eax
call fcn.004035d7
xor ecx, ecx
mov word [ebp], cx
test esi, esi
je 0x40178b
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], 0x4000
push ecx
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x402c95
cmp dword [esp + 0x14], 4
je 0x402c7d
cmp dword [esp + 0x14], ecx
je 0x402c6a
cmp dword [esp + 0x14], 2
jne 0x402c95
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], eax
xor eax, eax
mov word [ebp + 0x3ffe], ax
jmp 0x402c9f
push dword [ebp]
xor eax, eax
cmp dword [esp + 0x48], eax
push ebp
sete al
mov dword [esp + 0x18], eax
call fcn.004071b5
jmp 0x402c9f
xor eax, eax
mov dword [esp + 0x10], ecx
mov word [ebp], ax
push esi
jmp 0x402bf0
push 0x20019
call fcn.0040365a
push 3
mov esi, eax
call fcn.0040359b
pop ecx
xor ecx, ecx
mov word [ebp], cx
test esi, esi
je 0x40178b
mov ecx, 0x1fff
mov dword [esp + 0x58], ecx
cmp dword [esp + 0x44], ebx
je 0x402ce2
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x402c72
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x68]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
test eax, eax
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x402c72
push ebp
call fcn.004078e3
test eax, eax
je case.0x4015b5.69
push eax
jmp 0x40246c
push 0xffffffffffffffed
call fcn.004035d7
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push eax
call fcn.004075d9
cmp eax, 0xffffffff
jne 0x401db2
xor eax, eax
mov word [ebp], ax
jmp 0x40178b
mov ecx, dword [esp + 0x30]
xor eax, eax
mov edx, dword [esp + 0x3c]
cmp ecx, 0x3a
mov dword [esp + 0x58], edx
mov edi, 0x4100e8
sete al
xor esi, esi
inc esi
mov dword [esp + 0x18], eax
test edx, edx
je 0x402d80
push esi
call fcn.0040359b
mov word [0x4100e8], ax
mov eax, dword [esp + 0x1c]
xor eax, esi
pop ecx
inc eax
jmp 0x402db7
cmp ecx, 0x3a
jne 0x402da8
push 0x21
call fcn.004035d7
push 0x2000
push edi
push 0x4140e8
call fcn.00406e67
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x402db7
push 0x11
call fcn.004035d7
push eax
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov dword [esp + 0x14], eax
cmp word [ebp], bx
je 0x402df7
push ebp
call fcn.004078e3
mov ebx, eax
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x58]
jne 0x402de4
cmp dword [esp + 0x40], eax
je 0x402de4
push ebx
push ebx
call fcn.00406e82
test eax, eax
js 0x402df7
push dword [esp + 0x14]
push edi
push ebx
call fcn.004076c9
test eax, eax
jne case.0x4015b5.69
mov eax, esi
jmp 0x403431
push 2
pop ecx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], ecx
call fcn.0040359b
xor esi, esi
inc esi
pop ecx
cmp eax, esi
jl case.0x4015b5.69
mov ecx, 0x1fff
cmp eax, ecx
cmovg eax, ecx
mov dword [esp + 0x24], eax
cmp word [ebp], bx
je 0x402f84
push ebp
mov dword [esp + 0x30], ebx
call fcn.004078e3
mov ecx, eax
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x24], ebx
jbe 0x402f84
mov dword [esp + 0x54], 0xd
mov ebp, ebx
cmp dword [esp + 0x30], 0x3b
jne 0x402f15
push ebx
lea eax, [esp + 0x24]
push eax
push 2
pop eax
sub eax, dword [esp + 0x48]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402f84
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x402f84
movzx eax, byte [esp + 0x10]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x40], ebx
jne 0x402fc4
push esi
lea eax, [esp + 0x20]
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x402f3f
mov ecx, dword [esp + 0x28]
mov edx, ecx
neg edx
sub dword [esp + 0x20], 1
mov eax, 0xfffd
mov dword [esp + 0x1c], eax
je 0x402f47
push esi
dec ecx
inc edx
push ebx
push edx
push dword [esp + 0x20]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x68], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x58]
test eax, eax
je 0x402ec8
jmp 0x402f3f
cmp dword [esp + 0x40], ebx
jne 0x402f2e
test ebp, ebp
jne 0x402f2e
push ebx
push ecx
call fcn.00406e82
test eax, eax
js 0x402f84
mov ecx, dword [esp + 0x14]
push 2
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00407606
test eax, eax
je 0x402f84
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x40], ebx
jne 0x402fc4
push 0xd
pop edx
cmp word [esp + 0x2c], dx
push 0xa
pop edx
je 0x402f95
cmp word [esp + 0x2c], dx
je 0x402f95
mov word [edi + ebp*2], ax
inc ebp
movzx eax, ax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x2c], eax
test ax, ax
je 0x402f84
mov ecx, dword [esp + 0x14]
cmp ebp, dword [esp + 0x24]
jl 0x402e57
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
mov word [edi + ecx*2], ax
jmp 0x401bba
cmp word [esp + 0x2c], ax
je 0x402fb3
cmp ax, word [esp + 0x54]
je 0x402fa8
cmp ax, dx
jne 0x402fb3
mov word [edi + ebp*2], ax
inc ebp
mov dword [esp + 0x18], ebp
jmp 0x402f84
push esi
push ebx
neg ecx
push ecx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x402f84
movzx eax, ax
push eax
push edi
call fcn.004071b5
jmp 0x403437
cmp word [ebp], bx
je case.0x4015b5.69
push 2
call fcn.0040359b
pop ecx
push dword [esp + 0x40]
push ebx
push eax
push ebp
call fcn.004078e3
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x38], ebx
jl case.0x4015b5.69
push eax
push edi
jmp 0x40171b
push ebp
call fcn.004078e3
test eax, eax
je case.0x4015b5.69
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x4015b5.69
push edi
call fcn.004078e3
test eax, eax
je 0x4019fc
lea ecx, [esp + 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4019fc
lea eax, [esp + 0xc0]
push eax
push ebp
jmp 0x401fef
push 2
call fcn.004035d7
lea ecx, [esp + 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40307b
xor eax, eax
mov word [edi], ax
jmp 0x402d3b
push eax
push edi
call fcn.004071b5
jmp 0x403048
push 0xfffffffffffffff0
mov dword [esp + 0x30], 0xfffffd66
or esi, 0xffffffff
call fcn.004035d7
mov edi, eax
push edi
mov dword [esp + 0x58], edi
call fcn.00407b03
test eax, eax
jne 0x4030ad
push 0xffffffffffffffec
call fcn.004035d7
push edi
call fcn.0040785b
push 2
push 0x40000000
push edi
call fcn.004075d9
xor ebp, ebp
mov edx, eax
inc ebp
mov dword [esp + 0x14], edx
cmp edx, esi
je 0x4031de
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x40], ebx
je 0x4031b4
mov eax, dword [0x473570]
push eax
push 0x40
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4031a8
push ebx
call fcn.00403728
push dword [esp + 0x24]
push dword [esp + 0x1c]
call fcn.004036b4
push dword [esp + 0x40]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x58], edi
test edi, edi
je 0x403185
push dword [esp + 0x48]
push dword [esp + 0x44]
push edi
push ebx
push dword [esp + 0x30]
push dword [esp + 0x40]
cmp dword [0x473564], ebx
je 0x40314f
push ebp
jmp 0x403150
push ebx
call fcn.0040392a
cmp byte [edi], bl
je 0x40317b
mov ebp, dword [esp + 0x18]
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebp
push eax
call fcn.00407318
add edi, esi
cmp byte [edi], bl
jne 0x40315d
xor ebp, ebp
inc ebp
or esi, 0xffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
push edi
push dword [esp + 0x1c]
call fcn.004076c9
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [esp + 0x54]
mov eax, esi
mov ecx, esi
jmp 0x4031b0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push dword [esp + 0x4c]
push ebx
push ebx
push edx
push ecx
push eax
cmp dword [0x473564], ebx
je 0x4031c8
push ebp
jmp 0x4031c9
push ebx
call fcn.0040392a
push dword [esp + 0x14]
mov esi, edx
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push esi
push dword [esp + 0x34]
push str.created_uninstaller:__d____s_
call fcn.0040724c
add esp, 0x10
push 0xfffffffffffffff3
pop eax
cmp esi, ebx
jg 0x40320e
jl 0x403200
cmp dword [esp + 0x2c], ebx
jae 0x40320e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xffffffffffffffef
mov dword [esp + 0x14], ebp
pop eax
push 0x4100e8
push eax
jmp 0x401646
test esi, esi
je 0x40325b
push ecx
push str.settings_logging_to__d
call fcn.0040724c
mov eax, dword [esp + 0x40]
push eax
push str.logging_set_to__d
mov dword [0x4624e0], eax
call fcn.0040724c
add esp, 0x10
cmp dword [esp + 0x38], ebx
je 0x40324f
call fcn.004061fd
jmp case.0x4015b5.69
push 1
call fcn.0040727e
jmp case.0x4015b5.69
push 1
call fcn.004035d7
push eax
push 0x409860
jmp 0x40194f
push ebx
call fcn.0040359b
mov ebx, eax
pop ecx
cmp ebx, dword [0x47358c]
jae 0x40178b
mov ecx, dword [esp + 0x3c]
imul esi, ebx, 0x4018
add esi, dword [0x473588]
test ecx, ecx
js 0x4032a9
mov eax, dword [esi + ecx*4]
jne 0x403002
lea eax, [esi + 0x18]
push eax
push edi
jmp 0x401fef
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x3c], eax
je 0x4032c4
push 1
call fcn.0040359b
pop ecx
mov ecx, eax
mov dword [esp + 0x38], ecx
jmp 0x4032dc
push dword [esp + 0x44]
lea eax, [esi + 0x18]
push eax
call fcn.004068b9
or dword [esi + 8], 0x100
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esi + eax*4], ecx
cmp dword [esp + 0x40], 0
je case.0x4015b5.69
push ebx
call fcn.00401221
jmp case.0x4015b5.69
push ebx
call fcn.0040359b
mov edx, eax
pop ecx
cmp edx, 0x20
jae 0x40178b
cmp dword [esp + 0x40], ebx
je 0x403334
cmp dword [esp + 0x3c], ebx
je 0x403329
push edx
call fcn.00401290
push ebx
push ebx
call fcn.004012dd
jmp case.0x4015b5.69
push ebx
call fcn.004011a0
jmp 0x403002
mov eax, dword [0x473578]
cmp dword [esp + 0x3c], ebx
je 0x40334f
mov ecx, dword [esp + 0x38]
mov dword [eax + edx*4 + 0x94], ecx
jmp case.0x4015b5.69
push dword [eax + edx*4 + 0x94]
push edi
call fcn.004068b9
jmp case.0x4015b5.69
mov eax, dword [esp + 0x40]
sub eax, ebx
je 0x4033af
sub eax, 1
jne case.0x4015b5.69
push 2
call fcn.0040359b
push 4
mov esi, eax
call fcn.0040359b
pop ecx
movzx edx, al
pop ecx
shr eax, 0x18
mov ecx, 0x473620
test esi, esi
mov dword [esp + 0x24], ebx
push edx
cmovne ecx, esi
add eax, ecx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00407318
push dword [esp + 0x24]
jmp 0x403003
push 5
call fcn.004075a4
push 0x22
mov esi, eax
call fcn.004035d7
test esi, esi
je 0x4033fe
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x4033fe
lea eax, [esp + 0x24]
push eax
push ebx
push dword [esp + 0x48]
lea eax, [esp + 0x64]
push eax
call esi
test eax, eax
js 0x4033fe
push dword [esp + 0x24]
push edi
call fcn.004077d8
push dword [esp + 0x24]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp case.0x4015b5.69
xor eax, eax
inc eax
xor ecx, ecx
mov word [edi], cx
jmp 0x403431
mov eax, dword [0x438208]
push ebx
and eax, esi
push eax
push 0xb
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x34], ebx
je case.0x4015b5.69
mov eax, dword [esp + 0x28]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0x10]
add dword [0x473628], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2d4
ret 4