Function at 0x401672
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x174]
lea edx, [ebp - 0x170]
sub esp, 0x1cc
mov eax, dword [0x7a9644]
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [0x41183c], edx
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x16c]
mov edi, dword [ebp - 0x170]
mov ecx, eax
mov esi, edi
shl ecx, 0xa
shl esi, 0xa
mov dword [ebp - 0x194], ecx
add ecx, section..ndata
lea ebx, [esi + section..ndata]
mov dword [ebp - 0x18c], ecx
mov ecx, dword [ebp - 0x174]
lea edx, [ecx - 2]
cmp edx, 0x41
ja case.0x4016e5.65
jmp dword [edx*4 + 0x40b004]
mov dword [esp + 4], 0
mov dword [esp], edi
jmp 0x401cb1
inc dword [0x7a9e80]
cmp dword [ebp - 0x190], 0
mov edi, 0x7fffffff
je case.0x4016e5.2
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push eax
jmp case.0x4016e5.2
mov dword [esp], edi
call fcn.00401632
push ebx
dec eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403848
mov edi, eax
push esi
push esi
jmp case.0x4016e5.2
mov dword [esp], edi
mov dword [esp + 4], 0
call fcn.00406c87
jmp 0x4037d7
mov dword [esp], 0
call fcn.0040146e
test eax, eax
push ecx
mov edx, 1
cmovle eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40219b
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x40219b
cmp dword [ebp - 0x168], 0
jne 0x4017be
mov eax, dword [edi*4 + 0x7a9538]
mov dword [esp], 1
mov dword [edi*4 + 0x7a9500], eax
call fcn.0040146e
push edx
jmp 0x4017c5
mov eax, dword [edi*4 + 0x7a9500]
mov dword [edi*4 + 0x7a9538], eax
jmp case.0x4016e5.65
mov edx, dword [ebp - 0x168]
xor ecx, ecx
mov eax, dword [edx*4 + 0x7a9538]
test eax, eax
sete cl
and eax, dword [ebp - 0x164]
mov edi, dword [ebp + ecx*4 - 0x170]
mov dword [edx*4 + 0x7a9538], eax
jmp case.0x4016e5.2
mov eax, dword [eax*4 + 0x7a9538]
jmp 0x402530
mov edx, dword [0x7a9e84]
test edx, edx
je 0x401823
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
mov eax, dword [0x7a9e88]
test eax, eax
je case.0x4016e5.65
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x40256d
mov dword [esp], 0xfffffff0
call fcn.00401418
mov edx, dword [ebp - 0x16c]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401aec
mov dword [esp], 0xfffffff0
xor edi, edi
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], eax
call fcn.00407525
test eax, eax
push esi
je 0x4018f9
mov ecx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x190], ecx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call fcn.00407494
mov esi, eax
push ecx
push ecx
mov al, byte [eax]
mov byte [esi], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
mov byte [ebp - 0x18c], al
call dword [ebp - 0x190]
test eax, eax
push edx
push edx
jne 0x4018ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4018d7
inc edi
jmp 0x4018ea
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
push edx
cmp eax, 1
adc edi, 0
mov cl, byte [ebp - 0x18c]
lea eax, [esi + 1]
test cl, cl
mov byte [esi], cl
jne 0x401891
cmp dword [ebp - 0x16c], 0
je 0x40192f
mov dword [esp], 0xffffffe6
call fcn.00401653
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x7b2800
call fcn.004078a6
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp fcn.0040367b
mov dword [esp], 0xfffffff5
jmp 0x403676
mov dword [esp], 0
call fcn.00401418
push ecx
mov dword [esp], eax
call fcn.00407d18
jmp 0x40234f
mov dword [esp], 0xffffffd0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0xffffffdf
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 0x13
call fcn.00401418
push edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
push edx
push edx
je 0x40199f
mov dword [esp], 0xffffffe3
jmp 0x402b96
cmp dword [ebp - 0x168], 0
je 0x402a06
mov dword [esp], ebx
call fcn.00407d18
test eax, eax
push edi
je 0x402a06
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00407e56
push ebx
push ebx
mov dword [esp], 0xffffffe4
jmp 0x402b96
mov dword [esp], 0
call fcn.00401418
mov ebx, eax
push ecx
lea eax, [ebp - 0x158]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], 0x400
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x401a49
mov eax, dword [ebp - 0x158]
xor edi, edi
cmp eax, ebx
jbe 0x401a5b
cmp byte [eax], 0
je 0x401a5b
mov dword [esp], ebx
call fcn.00407d18
test eax, eax
push edx
je 0x401a49
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call fcn.004078a6
push eax
push eax
jmp 0x401a5b
mov eax, dword [ebp - 0x194]
mov edi, 1
mov byte [eax + section..ndata], 0
cmp dword [ebp - 0x168], 0
jne fcn.00403834
mov eax, dword [ebp - 0x18c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 0xc
jmp fcn.00403834
mov dword [esp], 0xffffffff
call fcn.00401418
lea edx, [ebp - 0x158]
push edi
xor edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
sub esp, 0x18
test eax, eax
jmp 0x402d92
mov dword [esp], 0xffffffef
call fcn.00401418
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004076c4
push edx
push edx
jmp 0x40321c
mov dword [esp], 0x31
call fcn.00401418
push ebx
mov ebx, dword [ebp - 0x170]
mov esi, eax
mov dword [esp], eax
call fcn.004074f7
and ebx, 7
test eax, eax
push edi
je 0x401b2a
mov dword [esp + 4], esi
mov dword [esp], 0x411840
call fcn.004078a6
jmp 0x401b55
mov dword [esp + 4], 0x7b2800
mov dword [esp], 0x411840
call fcn.004078a6
push edx
push edx
mov dword [esp], eax
call fcn.004078e4
push ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004078d9
push edi
push edi
mov dword [esp], 0x411840
call fcn.00407929
cmp ebx, 2
push eax
jle 0x401ba7
mov dword [esp], 0x411840
call fcn.00407d18
mov edx, eax
xor eax, eax
push ecx
test edx, edx
je 0x401b96
lea eax, [ebp - 0x164]
add edx, 0x14
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push edx
push edx
sub ebx, 3
or ebx, 0x80000000
test eax, ebx
sete bl
movzx ebx, bl
test ebx, ebx
jne 0x401bbf
mov dword [esp], 0x411840
call fcn.00407636
mov eax, 2
push edi
jmp 0x401bc8
xor eax, eax
cmp ebx, 1
setne al
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x411840
call fcn.00407668
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
jne 0x401cc2
test ebx, ebx
je 0x401c14
mov dword [esp + 4], esi
mov dword [esp], 0xffffffe2
call fcn.00406c87
push esi
push esi
cmp ebx, 2
sete al
movzx eax, al
mov edi, eax
jmp fcn.00403834
mov dword [esp + 4], section..ndata
mov dword [esp], 0x412040
call fcn.004078a6
push eax
push eax
mov dword [esp + 4], 0x411840
mov dword [esp], section..ndata
call fcn.004078a6
push eax
push eax
mov eax, dword [ebp - 0x15c]
mov dword [esp], 0x411c40
mov dword [esp + 4], eax
call fcn.004079f6
push eax
push eax
mov dword [esp + 4], 0x412040
mov dword [esp], section..ndata
call fcn.004078a6
mov eax, dword [ebp - 0x170]
push edx
push edx
sar eax, 3
mov dword [esp], 0x411c40
mov dword [esp + 4], eax
call fcn.00407426
cmp eax, 4
push ecx
push ecx
je 0x401bab
cmp eax, 5
jne 0x401ca2
inc dword [0x7a9540]
jmp fcn.0040383a
mov dword [esp + 4], 0x411840
mov dword [esp], 0xfffffffa
call fcn.00406c87
mov edi, 0x7fffffff
push eax
push eax
jmp case.0x4016e5.2
mov dword [esp + 4], esi
mov dword [esp], 0xffffffea
call fcn.00406c87
push eax
push eax
mov eax, dword [ebp - 0x168]
inc dword [0x7a956c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00403af3
dec dword [0x7a956c]
sub esp, 0x10
cmp dword [ebp - 0x164], 0xffffffff
mov ebx, eax
jne 0x401d19
cmp dword [ebp - 0x160], 0xffffffff
je 0x401d3b
lea eax, [ebp - 0x164]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
push eax
jns case.0x4016e5.65
cmp ebx, 0xfffffffe
jne 0x401d7a
mov dword [esp + 4], 0xffffffe9
mov dword [esp], 0x411840
call fcn.004079f6
push edi
push edi
mov dword [esp + 4], esi
mov dword [esp], 0x411840
call fcn.004078d9
jmp 0x401d8e
mov dword [esp + 4], 0xffffffee
mov dword [esp], 0x411840
call fcn.004079f6
push ebx
push ebx
mov dword [esp + 4], 0x200010
mov dword [esp], 0x411840
jmp 0x402124
mov dword [esp], 0
jmp 0x401e00
mov dword [esp], 0x31
call fcn.00401418
push edx
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00407426
test eax, eax
push ecx
push ecx
je 0x402a06
cmp eax, dword [ebp - 0x168]
je 0x401fe3
cmp eax, dword [ebp - 0x160]
jne case.0x4016e5.65
mov edi, dword [ebp - 0x15c]
jmp case.0x4016e5.2
mov dword [esp], 0xfffffff0
call fcn.00401418
mov edx, dword [ebp - 0x16c]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004080fd
jmp 0x4037d7
mov dword [esp], 1
call fcn.00401418
push esi
mov dword [esp], eax
call fcn.004078ce
jmp 0x40252f
mov dword [esp], 2
call fcn.0040146e
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.0040146e
push edx
mov dword [ebp - 0x190], eax
mov dword [esp], 1
call fcn.00401418
test edi, edi
push ecx
mov byte [esi + section..ndata], 0
mov ecx, eax
setne byte [ebp - 0x18c]
mov edx, dword [ebp - 0x190]
jne 0x401e8d
cmp dword [ebp - 0x168], 0
jne case.0x4016e5.65
mov dword [esp], ecx
mov dword [ebp - 0x194], edx
mov dword [ebp - 0x190], ecx
call fcn.004078ce
push edx
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x190]
test edx, edx
jns 0x401eba
add edx, eax
js case.0x4016e5.65
cmp edx, eax
mov dword [esp], ebx
cmovle eax, edx
add eax, ecx
mov dword [esp + 4], eax
call fcn.004078a6
cmp byte [ebp - 0x18c], 0
push ecx
push ecx
je case.0x4016e5.65
test edi, edi
jns 0x401eed
mov dword [esp], ebx
call fcn.004078ce
add edi, eax
push edx
js 0x401efb
cmp edi, 0x3ff
jg case.0x4016e5.65
jmp 0x401efd
xor edi, edi
mov byte [edi + esi + section..ndata], 0
jmp case.0x4016e5.65
mov dword [esp], 0x20
call fcn.00401418
push ebx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401418
cmp dword [ebp - 0x160], 0
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x401f3e
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x401f44
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push ecx
push ecx
jne 0x401fe3
jmp 0x40235f
mov dword [esp], 1
call fcn.00401418
push edx
mov edi, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
test eax, eax
jne 0x401f8c
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x401fae
cmp dword [ebp - 0x168], 0
jne 0x401f99
xor edi, edi
jmp 0x401fae
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push edi
push edi
je 0x401f7e
jmp 0x401f95
mov byte [ebx + 0x3ff], 0
jmp fcn.00403834
mov dword [esp], 0
call fcn.0040146e
push ebx
mov ebx, eax
mov dword [esp], 1
call fcn.0040146e
cmp dword [ebp - 0x15c], 0
push esi
jne 0x401fff
cmp ebx, eax
jge 0x401fee
mov edi, dword [ebp - 0x164]
jmp case.0x4016e5.2
jle 0x40235f
mov edi, dword [ebp - 0x160]
jmp case.0x4016e5.2
cmp ebx, eax
jb 0x401fe3
ja 0x401ff4
jmp 0x40235f
mov dword [esp], 1
xor edi, edi
call fcn.0040146e
push edx
mov esi, eax
mov dword [esp], 2
call fcn.0040146e
cmp dword [ebp - 0x164], 0xc
push ecx
mov ecx, eax
ja case.default.0x402039
mov eax, dword [ebp - 0x164]
jmp dword [eax*4 + 0x40b10c]
add esi, ecx
jmp 0x40209c
sub esi, ecx
jmp 0x40209c
imul esi, ecx
jmp 0x40209c
test ecx, ecx
je 0x4020a0
mov eax, esi
cdq
idiv ecx
jmp 0x402073
or esi, ecx
jmp 0x40209c
and esi, ecx
jmp 0x40209c
xor esi, ecx
jmp 0x40209c
test esi, esi
sete al
jmp 0x402070
or ecx, esi
setne al
movzx eax, al
mov esi, eax
jmp 0x40209c
test ecx, ecx
setne al
xor edx, edx
test esi, esi
setne dl
mov esi, edx
and esi, eax
jmp 0x40209c
test ecx, ecx
je 0x4020a0
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x40209c
shl esi, cl
jmp 0x40209c
sar esi, cl
xor edi, edi
jmp case.default.0x402039
xor esi, esi
mov edi, 1
mov dword [esp + 4], esi
jmp 0x40232a
mov dword [esp], 1
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 2
call fcn.0040146e
push edi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp case.0x4016e5.65
mov edx, dword [ebp - 0x168]
mov esi, dword [0x412c40]
test edx, edx
je 0x40216e
mov eax, edx
dec eax
test esi, esi
je 0x402103
test eax, eax
mov esi, dword [esi]
jne 0x4020f4
test esi, esi
jne 0x40212e
mov dword [esp + 4], 0xffffffe8
mov dword [esp], 0
call fcn.004079f6
push edx
push edx
mov dword [esp + 4], 0x200010
mov dword [esp], eax
call fcn.00407426
jmp 0x401cb6
add esi, 4
mov dword [esp], 0x411840
mov dword [esp + 4], esi
call fcn.004078a6
push eax
push eax
mov eax, dword [0x412c40]
mov dword [esp], esi
add eax, 4
mov dword [esp + 4], eax
call fcn.004078a6
push eax
push eax
mov eax, dword [0x412c40]
mov dword [esp + 4], 0x411840
add eax, 4
jmp 0x4036c4
test eax, eax
je 0x4021a1
test esi, esi
je 0x402a06
lea eax, [esi + 4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004078a6
push edi
push edi
mov eax, dword [esi]
mov dword [esp], esi
mov dword [0x412c40], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
jmp case.0x4016e5.65
mov dword [esp + 4], 0x404
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x170]
push edx
push edx
mov dword [esp + 4], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.004079f6
mov eax, dword [0x412c40]
push ecx
push ecx
mov dword [ebx], eax
mov dword [0x412c40], ebx
jmp case.0x4016e5.65
mov dword [esp], 3
call fcn.0040146e
push ecx
mov esi, eax
mov dword [esp], 4
call fcn.0040146e
test byte [ebp - 0x15c], 1
push edi
mov edi, eax
je 0x402219
mov dword [esp], 0x33
call fcn.00401418
push edx
mov esi, eax
test byte [ebp - 0x15c], 2
je 0x402231
mov dword [esp], 0x44
call fcn.00401418
push edi
mov edi, eax
cmp dword [ebp - 0x174], 0x21
mov dword [esp], 1
jne 0x4022c6
call fcn.0040146e
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 2
call fcn.0040146e
mov edx, dword [ebp - 0x15c]
push ecx
sar edx, 2
je 0x4022a9
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x158]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
sub esp, 0x1c
test eax, eax
sete al
movzx eax, al
mov edi, eax
jmp 0x402313
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x402308
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x12
call fcn.00401418
push ecx
xor ecx, ecx
cmp byte [eax], 0
mov edx, dword [ebp - 0x18c]
cmove eax, ecx
cmp byte [edx], 0
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], esi
cmove edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_FindWindowExA]
sub esp, 0x10
mov dword [ebp - 0x158], eax
xor edi, edi
cmp dword [ebp - 0x170], 0
js fcn.00403834
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004077d3
push esi
push esi
jmp fcn.00403834
mov dword [esp], 0
call fcn.0040146e
push ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
push ecx
je 0x40235f
mov edi, dword [ebp - 0x16c]
jmp case.0x4016e5.2
mov edi, dword [ebp - 0x168]
jmp case.0x4016e5.2
mov dword [esp], 2
call fcn.0040146e
push esi
mov esi, eax
mov dword [esp], 1
call fcn.0040146e
push edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push edx
push edx
jmp 0x402530
add eax, dword [0x7a95e8]
mov dword [esp], 0
mov ebx, eax
call fcn.0040146e
push ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x40382f
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edx
lea eax, [ebp - 0x158]
push edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x168]
mov edi, dword [ebp - 0x14c]
mov ebx, dword [ebp - 0x150]
push ecx
push ecx
imul edi, edx
imul ebx, edx
mov dword [esp], 0
call fcn.00401418
push edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadImageA]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x172
mov dword [esp], esi
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
test eax, eax
je case.0x4016e5.65
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x40219b
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push edi
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edx
push edx
mov esi, eax
mov dword [esp], 2
call fcn.0040146e
push ecx
mov dword [esp + 4], esi
mov dword [esp + 8], 0x48
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esp, 0xc
neg eax
mov dword [esp], 3
mov dword [0x411800], eax
call fcn.0040146e
mov dword [0x411810], eax
mov eax, dword [ebp - 0x160]
push esi
mov byte [0x411817], 1
mov dl, al
mov dword [esp], 0x41181c
and edx, 1
mov byte [0x411814], dl
mov dl, al
and eax, 4
mov byte [0x411816], al
mov eax, dword [ebp - 0x16c]
and edx, 2
mov byte [0x411815], dl
mov dword [esp + 4], eax
call fcn.004079f6
push edi
push edi
mov dword [esp], 0x411800
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004077d3
jmp 0x4037d7
mov dword [esp], 0
call fcn.0040146e
push edx
mov ebx, eax
mov dword [esp], 1
call fcn.0040146e
cmp dword [ebp - 0x164], 0
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x402578
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4037d7
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4037d7
mov dword [esp], 0
call fcn.00401418
push esi
mov edi, eax
mov dword [esp], 0x31
call fcn.00401418
push edx
mov esi, eax
mov dword [esp], 0x22
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], 0x15
call fcn.00401418
push eax
mov dword [esp], 0xffffffec
call fcn.00401653
xor edx, edx
push eax
cmp byte [ebx], 0
mov eax, dword [ebp - 0x164]
cmove ebx, edx
cmp byte [edi], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 0x10], 0x7b2800
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
cmovne edx, edi
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
sub esp, 0x18
cmp eax, 0x20
setle al
jmp 0x401c0a
mov dword [esp], 0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0xffffffeb
call fcn.00406c87
push ecx
push ecx
mov dword [esp], ebx
call fcn.00407368
test eax, eax
push ebx
mov ebx, eax
je 0x402a06
cmp dword [ebp - 0x168], 0
je 0x4026b3
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], 0x64
mov dword [esp], ebx
call esi
cmp eax, 0x102
push edi
push edi
jne 0x40267b
mov dword [esp], 0xf
call fcn.0040838d
push eax
jmp 0x402656
lea eax, [ebp - 0x158]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x16c], 0
push esi
push esi
js 0x4026b7
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004077d3
push ecx
push ecx
xor edi, edi
jmp 0x4026c5
xor eax, eax
cmp dword [ebp - 0x158], 0
setne al
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp fcn.0040367b
mov dword [esp], 2
call fcn.00401418
push edi
mov dword [esp], eax
call fcn.00407d18
test eax, eax
push edx
mov edi, eax
je 0x40270e
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004077d3
push ecx
push ecx
mov eax, dword [edi + 0x18]
jmp 0x402530
mov eax, dword [ebp - 0x194]
mov byte [esi + section..ndata], 0
mov byte [eax + section..ndata], 0
jmp 0x402a06
mov dword [esp], 0xffffffee
call fcn.00401418
mov edi, eax
push ecx
lea eax, [ebp - 0x178]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
push edx
push edx
mov edx, eax
mov eax, dword [ebp - 0x194]
test edx, edx
mov byte [esi + section..ndata], 0
mov byte [eax + section..ndata], 0
je 0x402a06
mov dword [esp + 4], edx
mov dword [ebp - 0x190], edx
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
push edx
mov esi, eax
push edx
je 0x402a06
mov edx, dword [ebp - 0x190]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [esp + 8], edx
call sub.VERSION.dll_GetFileVersionInfoA
sub esp, 0x10
test eax, eax
jne 0x4027b7
mov edi, 1
jmp 0x402818
lea eax, [ebp - 0x158]
mov dword [esp + 4], 0x40b000
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x17c]
mov dword [esp + 8], eax
call sub.VERSION.dll_VerQueryValueA
sub esp, 0x10
test eax, eax
je 0x4027b0
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004077d3
mov eax, dword [ebp - 0x17c]
push edi
push edi
xor edi, edi
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004077d3
push eax
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp fcn.0040367b
cmp dword [0x7a9570], 0
js 0x402946
mov dword [esp], 0xfffffff0
call fcn.00401418
push ebx
mov edi, eax
mov dword [esp], 1
call fcn.00401418
cmp dword [ebp - 0x160], 0
push esi
mov esi, eax
jne 0x402882
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x40293a
jmp 0x402892
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push ecx
mov ebx, eax
je 0x40285a
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push edx
mov edi, eax
push edx
je 0x4028f7
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4028c8
mov dword [esp], eax
call fcn.00401653
push eax
call edi
test eax, eax
setne al
movzx eax, al
mov edi, eax
jmp 0x40290e
jmp loc.007c40fb
mov dword [esp + 4], esi
mov dword [esp], 0xfffffff6
jmp 0x402a00
mov dword [esp], 0xffffffe7
jmp 0x402a00
mov dword [esp], 0xfffffff0
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdf
call fcn.00401418
push ecx
mov edi, eax
mov dword [esp], 2
call fcn.00401418
push ebx
mov dword [ebp - 0x190], eax
mov dword [esp], 0xffffffcd
call fcn.00401418
push esi
mov esi, eax
mov dword [esp], 0x45
call fcn.00401418
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], edi
call fcn.004074f7
test eax, eax
push ecx
jne 0x4029c3
mov dword [esp], 0x21
call fcn.00401418
push eax
lea eax, [ebp - 0x178]
mov dword [esp + 0xc], 0x40f8ac
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40c0cc
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jns 0x402a10
mov dword [esp], 0xfffffff0
call fcn.00401653
push ebx
mov edi, 1
jmp fcn.00403834
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40effc
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov ebx, eax
js 0x402b78
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x50]
mov ebx, eax
mov eax, dword [ebp - 0x178]
push edx
push edx
mov edx, dword [eax]
mov dword [esp + 4], 0x7b2800
mov dword [esp], eax
call dword [edx + 0x24]
mov eax, dword [ebp - 0x160]
push ecx
push ecx
movzx eax, ah
test eax, eax
je 0x402a8b
mov edx, dword [ebp - 0x178]
mov ecx, dword [edx]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x3c]
push eax
push eax
mov eax, dword [ebp - 0x178]
movzx ecx, word [ebp - 0x15e]
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x34]
push eax
push eax
cmp byte [esi], 0
je 0x402acb
mov eax, dword [ebp - 0x178]
movzx ecx, byte [ebp - 0x160]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x190]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x178]
push edi
mov ecx, dword [ebp - 0x194]
push edi
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x1c]
test ebx, ebx
push eax
push eax
js 0x402b69
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x14], 0x400
mov ebx, 0x80004005
mov dword [esp + 0x10], 0x411000
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
je 0x402b69
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x411000
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
test ebx, ebx
push ecx
js 0x4029f9
mov dword [esp], 0xfffffff4
call fcn.00401653
jmp 0x40219b
mov dword [esp], 0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0x11
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 0x23
call fcn.00401418
push edi
mov edi, eax
mov dword [esp], ebx
call fcn.00407d18
test eax, eax
push edx
jne 0x402bf5
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00406c87
push edi
push edi
jmp 0x402a06
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [ebp - 0x154], 2
mov dword [ebp - 0x158], eax
call fcn.004078ce
push edx
mov byte [ebx + eax + 1], 0
mov dword [esp], esi
call fcn.004078ce
push ecx
mov byte [esi + eax + 1], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x150], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x13e], edi
xor edi, edi
mov word [ebp - 0x148], ax
call fcn.00406c87
lea eax, [ebp - 0x158]
push ebx
push ebx
mov dword [esp], eax
call dword [sym.imp.SHELL32.DLL_SHFileOperationA]
test eax, eax
push esi
je fcn.00403834
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00406c87
push eax
push eax
mov di, 1
jmp fcn.00403834
cmp edi, 0xbadf00d
jne 0x402103
inc dword [0x7a954c]
jmp case.0x4016e5.65
xor esi, esi
test edi, edi
je 0x402cbd
mov dword [esp], 0
call fcn.00401418
push esi
mov esi, eax
xor edi, edi
cmp dword [ebp - 0x16c], 0
je 0x402cd7
mov dword [esp], 0x11
call fcn.00401418
push ebx
mov edi, eax
xor ebx, ebx
cmp dword [ebp - 0x160], 0
je 0x402cf1
mov dword [esp], 0x22
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], 0xffffffcd
call fcn.00401418
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
sub esp, 0x10
jmp 0x40321c
mov dword [esp], 1
mov dword [ebp - 0x158], 0x7e4e21
call fcn.00401418
push ecx
mov edi, eax
mov dword [esp], 0x12
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdd
call fcn.00401418
push ecx
mov edx, dword [ebp - 0x18c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x158]
mov dword [esp], edi
mov dword [esp + 0x10], 0x3ff
mov dword [esp + 0xc], ebx
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x158]
sub esp, 0x18
cmp dword [esi + section..ndata], eax
jne fcn.00403834
mov byte [esi + section..ndata], 0
jmp 0x402c88
cmp dword [ebp - 0x160], 0
jne 0x402dee
mov dword [esp], 2
call fcn.004015c8
test eax, eax
push edx
mov ebx, eax
je 0x402a06
mov dword [esp], 0x33
call fcn.00401418
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push edi
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x402e2f
mov dword [esp], 0x22
call fcn.00401418
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x16c]
push ebx
and ecx, 2
test edx, edx
jne 0x402e1a
mov esi, dword [0x7a953c]
lea edx, [esi - 0x7fffffff]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0040149a
sub esp, 0xc
mov esi, eax
test esi, esi
setne al
jmp 0x401c0a
test edi, edi
jne 0x402e48
mov eax, dword [0x7a953c]
lea edi, [eax - 0x7fffffff]
mov dword [esp], 2
mov ebx, dword [ebp - 0x160]
mov esi, dword [ebp - 0x15c]
call fcn.00401418
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x11
call fcn.00401418
lea edx, [ebp - 0x158]
push ecx
mov dword [esp + 0x1c], edx
mov edx, dword [0x7a9568]
mov dword [esp], edi
mov dword [esp + 0x20], 0
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
or edx, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne fcn.00403834
cmp ebx, 1
jne 0x402ef2
mov dword [esp], 0x23
call fcn.00401418
push ebx
mov dword [esp], 0x412040
call fcn.004078ce
inc eax
push edi
jmp 0x402f40
cmp ebx, 4
jne 0x402f10
mov dword [esp], 3
call fcn.0040146e
mov dword [0x412040], eax
push ecx
mov eax, 4
jmp 0x402f40
xor eax, eax
cmp ebx, 3
jne 0x402f40
mov eax, dword [ebp - 0x164]
mov dword [esp + 0xc], 0xc00
mov dword [esp + 8], 0x412040
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403af3
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x10], 0x412040
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
setne al
movzx eax, al
mov edi, eax
mov eax, dword [ebp - 0x158]
jmp 0x403067
mov dword [esp], 0x20019
call fcn.004015c8
push edi
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x33
call fcn.00401418
cmp dword [ebp - 0x18c], 0
push edx
mov byte [esi + section..ndata], 0
je 0x402a06
lea edx, [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x178], 0x3ff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x158]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x403016
mov eax, dword [ebp - 0x158]
cmp eax, 1
je 0x403024
cmp eax, 4
je 0x403024
cmp eax, 2
je 0x40304d
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x403061
cmp eax, 4
jne 0x40304d
xor eax, eax
cmp dword [ebp - 0x160], 0
mov dword [esp], ebx
sete al
mov edi, eax
mov eax, dword [esi + section..ndata]
mov dword [esp + 4], eax
call fcn.004077d3
push ecx
push ecx
jmp 0x403061
mov eax, dword [ebp - 0x178]
mov edi, dword [ebp - 0x160]
mov byte [esi + eax + section..ndata], 0
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp fcn.0040367b
mov dword [esp], 0x20019
call fcn.004015c8
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.0040146e
test edi, edi
push edx
mov byte [esi + section..ndata], 0
je 0x402a06
cmp dword [ebp - 0x160], 0
mov dword [ebp - 0x158], 0x3ff
je 0x4030d1
mov dword [esp + 0xc], 0x3ff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
sub esp, 0x10
jmp 0x403117
lea edx, [ebp - 0x158]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
sub esp, 0x20
test eax, eax
jne 0x402a06
mov byte [ebx + 0x3ff], 0
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40219b
cmp byte [esi + section..ndata], 0
je case.0x4016e5.65
mov dword [esp], ebx
call fcn.004077f8
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40219b
mov dword [esp], 0xffffffed
call fcn.00401418
mov edx, dword [ebp - 0x168]
push edi
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x16c]
mov dword [esp + 4], edx
call fcn.00407668
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402530
mov byte [esi + section..ndata], 0
jmp 0x402a06
cmp dword [ebp - 0x168], 0
je 0x4031b3
mov dword [esp], 1
call fcn.0040146e
mov byte [0x411c40], al
push ecx
mov ecx, 1
jmp 0x4031cb
mov dword [esp], 0x11
call fcn.00401418
push edi
mov dword [esp], eax
call fcn.004078ce
push edx
mov ecx, eax
cmp byte [esi + section..ndata], 0
mov edi, 1
je fcn.00403834
mov dword [esp], ebx
mov dword [ebp - 0x18c], ecx
call fcn.004077f8
mov ecx, dword [ebp - 0x18c]
push ebx
lea edx, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x411c40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jmp 0x401c07
mov dword [esp], 2
xor edi, edi
call fcn.0040146e
test eax, eax
push ecx
mov dword [ebp - 0x190], eax
jle fcn.00403834
cmp byte [esi + section..ndata], 0
je 0x403363
mov dword [esp], ebx
xor ebx, ebx
call fcn.004077f8
lea ecx, [ebp - 0x158]
push edx
lea edx, [ebp - 0x178]
mov esi, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [ebp - 0x19c], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [ebp - 0x198], edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403363
cmp dword [ebp - 0x158], 1
jne 0x403363
cmp dword [ebp - 0x164], 0
mov edx, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x19c]
je 0x4032e0
movzx eax, byte [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004077d3
push esi
push esi
jmp fcn.0040383a
cmp bl, 0xa
mov al, byte [ebp - 0x178]
je 0x4032f0
cmp bl, 0xd
jne 0x403334
cmp bl, al
mov edx, edi
je 0x4032fe
cmp al, 0xa
je 0x403324
cmp al, 0xd
je 0x403324
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x403363
mov ecx, dword [ebp - 0x194]
inc edi
mov byte [edx + ecx + section..ndata], al
jmp 0x403363
mov ebx, dword [ebp - 0x18c]
inc edi
test al, al
mov byte [ebx + edi - 1], al
mov bl, al
je 0x403363
cmp dword [ebp - 0x190], 0x3ff
mov eax, 0x3ff
cmovle eax, dword [ebp - 0x190]
cmp edi, eax
jl 0x403266
mov eax, dword [ebp - 0x194]
test edi, edi
mov byte [edi + eax + section..ndata], 0
jmp 0x401c07
cmp byte [esi + section..ndata], 0
je case.0x4016e5.65
mov dword [esp], 2
mov edi, dword [ebp - 0x164]
call fcn.0040146e
push ecx
mov esi, eax
mov dword [esp], ebx
call fcn.004077f8
push ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp dword [ebp - 0x16c], 0
jns 0x4036de
jmp case.0x4016e5.65
cmp byte [esi + section..ndata], 0
je case.0x4016e5.65
mov dword [esp], ebx
call fcn.004077f8
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40219b
mov eax, dword [ebp - 0x194]
cmp byte [eax + section..ndata], 0
je 0x403185
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004077f8
lea edx, [ebp - 0x158]
push ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
push edi
push edi
je 0x403185
jmp 0x403483
mov dword [esp], 2
call fcn.00401418
lea edx, [ebp - 0x158]
push edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
push edx
push edx
jne 0x40346f
mov eax, dword [ebp - 0x194]
mov byte [eax + section..ndata], 0
jmp 0x403185
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004077d3
push esi
push esi
lea eax, [ebp - 0x12c]
mov dword [esp], ebx
mov dword [esp + 4], eax
jmp 0x4036c7
mov dword [esp], 0xfffffff0
call fcn.00401418
push edx
mov esi, eax
mov dword [esp], eax
call fcn.004074f7
test eax, eax
push ecx
jne 0x4034be
mov dword [esp], 0xffffffed
call fcn.00401418
push eax
mov dword [esp], esi
call fcn.00407636
push edi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call fcn.00407668
sub esp, 0xc
mov dword [ebp - 0x18c], eax
inc eax
jne 0x403504
mov dword [esp], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xffffffef
push ebx
jmp 0x403673
mov eax, dword [0x7a960c]
mov dword [esp], 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x190], eax
mov dword [esp + 4], eax
call edi
test eax, eax
push ecx
mov ebx, eax
push ecx
mov edx, 0xfffffd66
je 0x403648
mov dword [esp], 0
call fcn.00403ac1
push eax
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00403a79
push eax
push eax
mov eax, dword [ebp - 0x168]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call edi
test eax, eax
push edx
mov edi, eax
push edx
je 0x4035e1
mov eax, dword [ebp - 0x168]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call fcn.00403af3
mov edx, edi
sub esp, 0x10
cmp byte [edx], 0
je 0x4035d7
mov ecx, dword [edx]
lea eax, [edx + 8]
mov dword [esp + 4], eax
mov dword [ebp - 0x194], eax
mov dword [esp + 8], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x198], ecx
add eax, ebx
mov dword [esp], eax
call fcn.00407613
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x198]
sub esp, 0xc
lea edx, [eax + ecx]
jmp 0x403598
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00403af3
sub esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x190], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x190]
push edi
test edx, edx
js 0x4034eb
mov eax, 0xfffffff3
xor edi, edi
mov dword [esp], eax
call fcn.00401653
mov dword [esp], 0
call fcn.0040146e
cmp eax, dword [0x7a95cc]
push ecx
mov ebx, eax
jae 0x402a06
mov edx, dword [ebp - 0x168]
imul esi, eax, 0x418
add esi, dword [0x7a95c8]
test edx, edx
js 0x4036f0
mov eax, dword [esi + edx*4]
jne 0x4036de
mov eax, dword [ebp - 0x18c]
add esi, 0x18
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004078a6
jmp 0x4037d7
mov dword [esp], 0
call fcn.00401393
push edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
jmp 0x402537
not edx
test edx, edx
mov dword [ebp - 0x168], edx
je 0x403711
mov dword [esp], 1
call fcn.0040146e
mov dword [ebp - 0x16c], eax
push edx
jmp 0x40372f
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], eax
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.004079f6
push edi
push edi
or dword [esi + 8], 0x100
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x16c]
mov dword [esi + eax*4], edx
cmp dword [ebp - 0x164], 0
je case.0x4016e5.65
mov dword [esp], ebx
call fcn.00401234
jmp 0x40219b
mov dword [esp], 0
call fcn.0040146e
cmp eax, 0x1f
push ebx
ja 0x402a06
cmp dword [ebp - 0x164], 0
je 0x4037a3
cmp dword [ebp - 0x168], 0
je 0x4036d1
mov dword [esp], eax
call fcn.00401349
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00401299
jmp 0x4037d7
cmp dword [ebp - 0x168], 0
mov edx, dword [0x7a9580]
lea eax, [eax + 0x24]
je 0x4037c1
mov ecx, dword [ebp - 0x16c]
mov dword [edx + eax*4 + 4], ecx
jmp case.0x4016e5.65
mov eax, dword [edx + eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004079f6
push eax
push eax
jmp case.0x4016e5.65
and edi, dword [0x7a5a00]
mov eax, dword [ebp - 0x190]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0xb
mov dword [esp], eax
mov dword [esp + 8], edi
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
cmp dword [ebp - 0x170], 0
je case.0x4016e5.65
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
xor edi, edi