Function at 0x4017a0
Capabilities:
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Self delete
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x214
push ebx
push ebp
mov ebp, dword [0x43d804]
push esi
mov esi, dword [esp + 0x224]
push edi
mov ecx, 7
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x20]
mov dword [0x417504], edx
mov edx, dword [esp + 0x1c]
mov esi, eax
mov edi, ecx
shl esi, 0xd
shl edi, 0xd
add edx, 0xffffffff
add esi, section..ndata
add edi, section..ndata
cmp edx, 0x44
mov dword [esp + 0x10], 0
ja case.0x401802.1
jmp dword [edx*4 + 0x4037d4]
push eax
push str.Jump:__d
call fcn.004072f0
mov eax, dword [esp + 0x28]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
push eax
push 0x40d4c8
call fcn.004075a0
push eax
push str.Aborting:___s_
call fcn.004072f0
mov eax, dword [esp + 0x28]
add esp, 8
push 0
push eax
call fcn.00405cb0
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x214
ret 4
add dword [0x4397d4], 1
test ebp, ebp
je 0x401872
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x214
ret 4
push eax
call fcn.004014f0
mov esi, eax
sub esi, 1
push esi
push str.Call:__d
call fcn.004072f0
add esp, 8
push 0
push esi
call fcn.00401520
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
push eax
push 0x40d4c8
call fcn.004075a0
push eax
push str.detailprint:__s
call fcn.004072f0
mov ecx, dword [esp + 0x28]
add esp, 8
push 0
push ecx
call fcn.00405cb0
jmp case.0x401802.1
xor ecx, ecx
call fcn.00401620
mov esi, eax
push esi
push str.Sleep__d_
call fcn.004072f0
add esp, 8
cmp esi, 1
jg 0x4018fd
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x401802.1
push str.BringToFront
call fcn.004072f0
add esp, 4
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x401802.1
cmp dword [esp + 0x28], 0
jne 0x401951
mov edx, dword [eax*4 + 0x43d8c0]
mov ecx, 1
mov dword [eax*4 + 0x43d880], edx
call fcn.00401620
mov ecx, dword [esp + 0x20]
mov dword [ecx*4 + 0x43d8c0], eax
jmp case.0x401802.1
mov edx, dword [eax*4 + 0x43d880]
mov dword [eax*4 + 0x43d8c0], edx
jmp case.0x401802.1
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
xor eax, eax
cmp dword [ecx*4 + 0x43d8c0], eax
pop edi
sete al
and dword [ecx*4 + 0x43d8c0], edx
pop esi
pop ebp
pop ebx
mov eax, dword [esp + eax*4 + 0x10]
add esp, 0x214
ret 4
mov eax, dword [ecx*4 + 0x43d8c0]
push eax
push esi
call fcn.00406f60
jmp case.0x401802.1
mov edx, dword [0x4397e0]
test edx, edx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4019bb
push ecx
push edx
call esi
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4397cc]
test ecx, ecx
je case.0x401802.1
push eax
push ecx
call esi
jmp case.0x401802.1
push eax
push 0x40f4c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407060
mov ecx, dword [esp + 0x24]
push ecx
push esi
push str.SetFileAttributes:___s_:_08X
call fcn.004072f0
mov edx, dword [esp + 0x30]
add esp, 0xc
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne case.0x401802.1
push str.SetFileAttributes_failed.
mov dword [esp + 0x14], 1
call fcn.004072f0
jmp 0x4037b8
push eax
push 0x40f4c8
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
mov eax, dword [esp + 0x24]
push eax
push edi
push str.CreateDirectory:___s____d_
call fcn.004072f0
add esp, 0xc
push edi
call fcn.00406d60
mov esi, eax
test esi, esi
je 0x401ad4
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401a60
push 0x5c
push esi
call fcn.00406d00
mov esi, eax
mov bl, byte [esi]
push 0
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401abd
call ebp
cmp eax, 0xb7
je 0x401a9d
call ebp
push eax
push edi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.004072f0
add esp, 0xc
add dword [esp + 0x10], 1
jmp 0x401acb
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x401acb
push edi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.004072f0
add esp, 8
add dword [esp + 0x10], 1
jmp 0x401acb
push edi
push str.CreateDirectory:___s__created
call fcn.004072f0
add esp, 8
mov byte [esi], bl
add esi, 1
test bl, bl
jne 0x401a60
cmp dword [esp + 0x24], 0
push 0x40f4c8
je 0x401afe
push 0xffffffffffffffe6
call fcn.00405cb0
push edi
push 0x46a000
call fcn.00407020
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp case.0x401802.1
push 0xfffffffffffffff5
call fcn.00405cb0
jmp case.0x401802.1
push eax
push 0x40d4c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407330
test eax, eax
je 0x401b45
mov ecx, dword [esp + 0x24]
push ecx
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.004072f0
mov eax, dword [esp + 0x30]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
mov edx, dword [esp + 0x28]
push edx
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.004072f0
mov eax, dword [esp + 0x34]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
push eax
push 0x4134c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407060
mov eax, dword [0x417504]
mov ecx, dword [eax + 4]
push ecx
push 0x4114c8
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
mov edx, dword [0x417504]
mov eax, dword [edx + 0xc]
push eax
push 0x40f4c8
call fcn.004075a0
mov ebx, eax
push ebx
push str.Rename:__s
call fcn.004072f0
add esp, 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x401bd8
push 0x40f4c8
push 0xffffffffffffffe3
call fcn.00405cb0
jmp case.0x401802.1
cmp dword [esp + 0x28], 0
je 0x401c0f
push esi
call fcn.00407330
test eax, eax
je 0x401c0f
push edi
push esi
call fcn.00407860
push 0x40f4c8
push 0xffffffffffffffe4
call fcn.00405cb0
push ebx
push str.Rename_on_reboot:__s
call fcn.004072f0
add esp, 8
jmp case.0x401802.1
push ebx
push str.Rename_failed:__s
mov dword [esp + 0x18], 1
call fcn.004072f0
add esp, 8
jmp case.0x401802.1
push eax
push 0x40d4c8
call fcn.004075a0
lea ecx, [esp + 0x14]
push ecx
push edi
mov esi, eax
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x401c74
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x401c7f
cmp byte [eax], 0
je 0x401c7f
push esi
call fcn.00407330
test eax, eax
je 0x401c74
mov edx, dword [esp + 0x14]
add eax, 0x2c
push eax
push edx
call fcn.00407020
jmp 0x401c7f
mov dword [esp + 0x10], 1
mov byte [edi], 0
cmp dword [esp + 0x28], 0
jne case.0x401802.1
push 0x2000
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp case.0x401802.1
push ecx
push 0x40d4c8
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
lea eax, [esp + 0x3c]
push eax
push esi
push 0x2000
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jmp 0x402e7c
push ecx
push 0x40f4c8
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
push edi
push esi
call fcn.00406e60
test eax, eax
jne case.0x401802.1
mov dword [esp + 0x10], 1
jmp case.0x401802.1
push ecx
push 0x4134c8
call fcn.004075a0
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, eax
sar eax, 3
push ebx
and eax, 2
push eax
and esi, 7
push esi
push str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
call fcn.004072f0
add esp, 0x10
push ebx
call fcn.00406d30
test eax, eax
push ebx
je 0x401d3e
push 0x40d4c8
call fcn.00407020
jmp 0x401d59
push 0x46a000
push 0x40d4c8
call fcn.00407020
push eax
call fcn.004073f0
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x40d4c8
call fcn.00407060
or ebp, 0xffffffff
cmp esi, 3
jl 0x401d9e
push 0x40d4c8
call fcn.00407330
xor ecx, ecx
test eax, eax
je 0x401d8c
lea ecx, [esp + 0x2c]
push ecx
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
add esi, 0xfffffffd
or esi, 0x80000000
and esi, ecx
neg esi
sbb esi, esi
add esi, 1
test esi, esi
jne 0x401dac
push 0x40d4c8
call fcn.00406e00
xor edx, edx
cmp esi, 1
setne dl
add edx, 1
push edx
push 0x40000000
push 0x40d4c8
call fcn.00406e20
mov edi, eax
cmp edi, ebp
jne 0x401ed0
test esi, esi
jne 0x401e80
push 0x40d4c8
push str.File:_error_creating___s_
call fcn.004072f0
add esp, 8
push section..ndata
push 0x4114c8
call fcn.00407020
push 0x40d4c8
push section..ndata
call fcn.00407020
mov eax, dword [esp + 0x34]
push eax
push 0x40f4c8
call fcn.004075a0
push 0x4114c8
push section..ndata
call fcn.00407020
mov ecx, dword [esp + 0x20]
sar ecx, 3
push ecx
push 0x40f4c8
call fcn.00406c90
sub eax, 4
jne 0x401e50
push str.File:_error__user_retry
call fcn.004072f0
add esp, 4
jmp 0x401d66
sub eax, 1
je 0x401ead
push str.File:_error__user_abort
call fcn.004072f0
add esp, 4
push 0x40d4c8
push 0xfffffffffffffffa
call fcn.00405cb0
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x214
ret 4
push ebx
push 0xffffffffffffffe2
call fcn.00405cb0
cmp esi, 2
jne 0x401e95
mov dword [esp + 0x10], 1
push esi
push 0x40d4c8
push str.File:_skipped:___s___overwriteflag_d_
call fcn.004072f0
add esp, 0xc
jmp case.0x401802.1
push str.File:_error__user_cancel
call fcn.004072f0
add dword [0x43d8c8], 1
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret 4
push ebx
push 0xffffffffffffffea
call fcn.00405cb0
mov edx, dword [esp + 0x28]
add dword [0x43d8f4], 1
push 0
push 0
push edi
push edx
call fcn.00403d70
sub dword [0x43d8f4], 1
mov esi, eax
push 0x40d4c8
push esi
push str.File:_wrote__d_to___s_
call fcn.004072f0
add esp, 0xc
cmp dword [esp + 0x2c], ebp
jne 0x401f16
cmp dword [esp + 0x30], ebp
je 0x401f27
lea eax, [esp + 0x2c]
push eax
push 0
mov ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jge case.0x401802.1
cmp esi, 0xfffffffe
jne 0x401f54
push 0xffffffffffffffe9
push 0x40d4c8
call fcn.004075a0
push ebx
push 0x40d4c8
call sub.KERNEL32.dll_lstrcatA
jmp 0x401f60
push 0xffffffffffffffee
push 0x40d4c8
call fcn.004075a0
push 0x40d4c8
push 0x40a6bc
call fcn.004072f0
add esp, 8
push 0x200010
push 0x40d4c8
call fcn.00406c90
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x214
ret 4
push eax
push 0x40d4c8
call fcn.004075a0
mov esi, eax
push esi
push str.Delete:___s_
jmp 0x402019
push ecx
push 0x4134c8
call fcn.004075a0
mov esi, eax
mov eax, dword [esp + 0x20]
push esi
push eax
push str.MessageBox:__d___s_
call fcn.004072f0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push esi
call fcn.00406c90
test eax, eax
je 0x40349e
cmp eax, dword [esp + 0x28]
je 0x4021b3
cmp eax, dword [esp + 0x30]
jne case.0x401802.1
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
push eax
push 0x40f4c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407060
push esi
push str.RMDir:___s_
call fcn.004072f0
mov edx, dword [esp + 0x2c]
add esp, 8
push edx
push esi
call fcn.00407a60
jmp case.0x401802.1
push ecx
push 0x40d4c8
call fcn.004075a0
push eax
call sub.KERNEL32.dll_lstrlenA
push eax
push esi
call fcn.00406f60
jmp case.0x401802.1
mov ecx, 2
call fcn.00401620
mov ecx, 3
mov ebx, eax
call fcn.00401620
mov edi, eax
mov eax, dword [0x417504]
mov ecx, dword [eax + 4]
push ecx
push 0x40d4c8
call fcn.004075a0
cmp dword [esp + 0x28], 0
mov ebp, eax
mov byte [esi], 0
je 0x40208d
test ebx, ebx
je case.0x401802.1
push ebp
call sub.KERNEL32.dll_lstrlenA
test edi, edi
jge 0x40209f
add edi, eax
js case.0x401802.1
cmp edi, eax
jle 0x4020a5
mov edi, eax
add ebp, edi
push ebp
push esi
call fcn.00407020
test ebx, ebx
je case.0x401802.1
jge 0x4020cc
push esi
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
jns 0x4020cc
xor ebx, ebx
mov byte [ebx + esi], bl
jmp case.0x401802.1
cmp ebx, 0x2000
jge case.0x401802.1
mov byte [ebx + esi], 0
jmp case.0x401802.1
push eax
push 0x4114c8
call fcn.004075a0
mov edx, dword [0x417504]
mov esi, eax
mov eax, dword [edx + 4]
push eax
push 0x4134c8
call fcn.004075a0
cmp dword [esp + 0x30], 0
push eax
push esi
jne 0x40212a
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4021b3
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
jmp 0x402111
push ecx
push 0x40d4c8
call fcn.004075a0
push 0x2000
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x402163
cmp dword [esp + 0x28], 0
je 0x40216e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40216e
mov dword [esp + 0x10], 1
mov byte [esi], 0
mov byte [esi + 0x1fff], 0
jmp case.0x401802.1
xor ecx, ecx
call fcn.00401620
mov ecx, 1
mov esi, eax
call fcn.00401620
cmp dword [esp + 0x34], 0
jne 0x4021af
cmp esi, eax
jl 0x4021b3
jle 0x402119
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
cmp esi, eax
jae 0x4021c4
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
jbe 0x402119
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
mov ebx, 1
mov ecx, ebx
call fcn.00401620
mov ecx, 2
mov edi, eax
call fcn.00401620
mov ecx, eax
mov eax, dword [esp + 0x2c]
cmp eax, 0xc
ja case.default.0x402202
jmp dword [eax*4 + 0x4038e8]
add edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
sub edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
imul ecx, edi
mov edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
test ecx, ecx
je 0x4022d3
mov eax, edi
cdq
idiv ecx
mov edi, eax
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
or edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
and edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
xor edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
xor ecx, ecx
test edi, edi
sete cl
mov edi, ecx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
test edi, edi
jne 0x4022ae
test ecx, ecx
jne 0x4022ae
xor edi, edi
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
test edi, edi
je 0x402298
test ecx, ecx
je 0x402298
mov edi, ebx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
test ecx, ecx
je 0x4022d3
mov eax, edi
cdq
idiv ecx
mov edi, edx
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
xor edi, edi
push edi
push esi
mov dword [esp + 0x18], ebx
call fcn.00406f60
jmp case.0x401802.1
shl edi, cl
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
sar edi, cl
push edi
push esi
call fcn.00406f60
jmp case.0x401802.1
push ecx
push 0x40d4c8
call fcn.004075a0
mov ecx, 2
mov edi, eax
call fcn.00401620
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x401802.1
mov edx, dword [esp + 0x28]
test edx, edx
mov edi, dword [0x40d4c0]
mov eax, edx
je 0x4023bb
lea ecx, [ecx]
sub eax, 1
test edi, edi
je 0x402351
test eax, eax
mov edi, dword [edi]
jne 0x402340
test edi, edi
jne 0x402385
push edx
push str.Exch:_stack____d_elements
call fcn.004072f0
add esp, 8
push 0x200010
push 0xffffffffffffffe8
push 0
call fcn.004075a0
push eax
call fcn.00406c90
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x214
ret 4
add edi, 4
push edi
push 0x40d4c8
call fcn.00407020
mov edx, dword [0x40d4c0]
add edx, 4
push edx
push edi
call fcn.00407020
mov eax, dword [0x40d4c0]
push 0x40d4c8
add eax, 4
push eax
call fcn.00407020
jmp case.0x401802.1
test ecx, ecx
je 0x4023f8
test edi, edi
jne 0x4023da
push str.Pop:_stack_empty
call fcn.004072f0
mov dword [esp + 0x14], 1
jmp 0x4037b8
lea ecx, [edi + 4]
push ecx
push esi
call fcn.00407020
mov edx, dword [edi]
push edi
mov dword [0x40d4c0], edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x401802.1
push 0x2004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esi + 4]
push ecx
call fcn.004075a0
mov edx, dword [0x40d4c0]
mov dword [esi], edx
mov dword [0x40d4c0], esi
jmp case.0x401802.1
mov ecx, 3
call fcn.00401620
mov ecx, 4
mov edi, eax
call fcn.00401620
test byte [esp + 0x34], 1
mov ebx, eax
je 0x40245c
mov eax, dword [0x417504]
mov ecx, dword [eax + 0xc]
push ecx
push 0x4134c8
call fcn.004075a0
mov edi, eax
test byte [esp + 0x34], 2
je 0x402479
mov edx, dword [0x417504]
mov eax, dword [edx + 0x10]
push eax
push 0x4154c8
call fcn.004075a0
mov ebx, eax
cmp dword [esp + 0x1c], 0x22
jne 0x4024ca
mov ecx, 1
call fcn.00401620
mov ecx, 2
mov ebp, eax
call fcn.00401620
mov ecx, dword [esp + 0x34]
sar ecx, 2
je 0x4024be
lea edx, [esp + 0x14]
push edx
push ecx
push 0
push ebx
push edi
push eax
push ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
neg eax
sbb eax, eax
add eax, 1
mov dword [esp + 0x10], eax
jmp 0x402512
push ebx
push edi
push eax
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40250e
mov eax, dword [0x417504]
mov ecx, dword [eax + 4]
push ecx
push 0x40d4c8
call fcn.004075a0
mov edx, dword [0x417504]
mov ebp, eax
mov eax, dword [edx + 8]
push eax
push 0x40f4c8
call fcn.004075a0
mov cl, byte [eax]
mov dl, byte [ebp]
neg cl
sbb ecx, ecx
and ecx, eax
neg dl
push ecx
sbb edx, edx
and edx, ebp
push edx
push ebx
push edi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x20], 0
jl case.0x401802.1
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00406f60
jmp case.0x401802.1
xor ecx, ecx
call fcn.00401620
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402119
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
mov ecx, 2
call fcn.00401620
push eax
mov ecx, 1
call fcn.00401620
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push esi
call fcn.00406f60
jmp case.0x401802.1
mov edx, dword [0x43d850]
add ecx, edx
push ecx
push 0xffffffffffffffeb
xor ecx, ecx
call fcn.00401620
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x401802.1
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [0x417504]
mov edx, dword [ecx]
push edx
push 0x40d4c8
call fcn.004075a0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x50]
imul edx, ecx
push 0x10
push edx
mov edx, dword [esp + 0x54]
imul edx, ecx
push edx
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je case.0x401802.1
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x401802.1
push 0x48
push 0x5a
push ebp
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov ecx, 2
call fcn.00401620
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov ecx, 3
mov dword [0x4174c8], eax
call fcn.00401620
mov dword [0x4174d8], eax
mov al, byte [esp + 0x30]
mov cl, al
mov dl, al
and al, 4
mov byte [0x4174de], al
mov eax, dword [esp + 0x24]
push eax
and cl, 1
and dl, 2
push 0x4174e4
mov byte [0x4174dc], cl
mov byte [0x4174dd], dl
mov byte [0x4174df], 1
call fcn.004075a0
push 0x4174c8
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call fcn.00406f60
jmp case.0x401802.1
xor ecx, ecx
call fcn.00401620
mov ecx, 1
mov esi, eax
call fcn.00401620
cmp dword [esp + 0x28], 0
mov edi, eax
je 0x4026b8
push str.HideWindow
call fcn.004072f0
add esp, 4
cmp dword [esp + 0x2c], 0
push edi
push esi
jne 0x4026cc
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x401802.1
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x401802.1
push eax
push 0x40d4c8
call fcn.004075a0
mov ecx, dword [0x417504]
mov edx, dword [ecx + 4]
push edx
push 0x4134c8
mov esi, eax
call fcn.004075a0
mov ebx, eax
mov eax, dword [0x417504]
mov ecx, dword [eax + 8]
push ecx
push 0x4114c8
call fcn.004075a0
mov edx, dword [0x417504]
mov edi, eax
mov eax, dword [edx + 0x14]
push eax
push 0x40f4c8
call fcn.004075a0
push 0x40f4c8
push 0xffffffffffffffec
call fcn.00405cb0
mov dl, byte [edi]
mov al, byte [esi]
mov ecx, dword [esp + 0x2c]
neg dl
push ecx
push 0x46a000
sbb edx, edx
and edx, edi
neg al
push edx
push ebx
sbb eax, eax
and eax, esi
push eax
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jge 0x402776
push eax
push edi
push ebx
push esi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.004072f0
add esp, 0x14
mov dword [esp + 0x10], 1
jmp case.0x401802.1
push edi
push ebx
push esi
push str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.004072f0
add esp, 0x10
jmp case.0x401802.1
push eax
push 0x40d4c8
call fcn.004075a0
mov ebp, eax
push ebp
push str.Exec:_command__s_
call fcn.004072f0
add esp, 8
push ebp
push 0xffffffffffffffeb
call fcn.00405cb0
push ebp
call fcn.00406c10
mov esi, eax
test esi, esi
push ebp
je 0x40283d
push str.Exec:_success____s__
call fcn.004072f0
add esp, 8
cmp dword [esp + 0x28], 0
je 0x402831
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push esi
call ebx
cmp eax, 0x102
jne 0x4027f8
push 0xf
call fcn.004073a0
push 0x64
push esi
call ebx
cmp eax, 0x102
je 0x4027e5
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x24], 0
jl 0x402822
mov edx, dword [esp + 0x14]
push edx
push edi
call fcn.00406f60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401802.1
cmp dword [esp + 0x14], 0
je 0x402831
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401802.1
push str.Exec:_failed_createprocess____s__
mov dword [esp + 0x18], 1
call fcn.004072f0
add esp, 8
jmp case.0x401802.1
mov eax, dword [esp + 0x28]
push eax
push 0x40d4c8
call fcn.004075a0
push eax
call fcn.00407330
mov ebx, eax
test ebx, ebx
je 0x40288b
mov ecx, dword [ebx + 0x14]
push ecx
push edi
call fcn.00406f60
mov edx, dword [ebx + 0x18]
push edx
push esi
call fcn.00406f60
jmp case.0x401802.1
mov byte [esi], 0
mov byte [edi], 0
mov dword [esp + 0x10], 1
jmp case.0x401802.1
mov eax, dword [esp + 0x28]
push eax
push 0x40f4c8
call fcn.004075a0
mov ebp, eax
push ebp
call fcn.00407060
lea ecx, [esp + 0x3c]
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
mov byte [esi], 0
mov byte [edi], 0
mov dword [esp + 0x10], 1
je case.0x401802.1
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x18], eax
je case.0x401802.1
push eax
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40293c
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x18]
push eax
push 0x40a58c
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40293c
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 8]
push eax
push esi
call fcn.00406f60
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0xc]
push edx
push edi
call fcn.00406f60
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x401802.1
cmp dword [0x43d8f8], 0
mov dword [esp + 0x10], 1
jl 0x402a68
push eax
push 0x40f4c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407060
mov ecx, dword [0x417504]
mov edx, dword [ecx + 4]
push edx
push 0x40d4c8
call fcn.004075a0
cmp dword [esp + 0x30], 0
mov dword [esp + 0x18], eax
je 0x4029a0
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x4029b5
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
je 0x402a49
mov eax, dword [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x402a09
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x10], 0
je 0x4029ed
push eax
call fcn.00401600
call edi
test eax, eax
je 0x402a24
mov dword [esp + 0x10], 1
jmp 0x402a24
push section..data
push 0x40d4c0
push section..ndata
push 0x2000
push ebp
call edi
add esp, 0x14
jmp 0x402a24
mov edi, dword [esp + 0x18]
push edi
push 0xfffffffffffffff7
call fcn.00405cb0
push esi
push edi
push str.Error_registering_DLL:__s_not_found_in__s
call fcn.004072f0
add esp, 0xc
cmp dword [esp + 0x2c], 0
jne case.0x401802.1
push ebx
call fcn.004047b0
test eax, eax
je case.0x401802.1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x401802.1
push 0x40f4c8
push 0xfffffffffffffff6
call fcn.00405cb0
push esi
push str.Error_registering_DLL:_Could_not_load__s
call fcn.004072f0
add esp, 8
jmp case.0x401802.1
push 0x40f4c8
push 0xffffffffffffffe7
call fcn.00405cb0
push str.Error_registering_DLL:_Could_not_initialize_OLE
call fcn.004072f0
jmp 0x4037b8
push eax
push 0x40f4c8
call fcn.004075a0
mov ebx, eax
push ebx
call fcn.00407060
mov ecx, dword [0x417504]
mov edx, dword [ecx + 4]
push edx
push 0x4114c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407060
mov eax, dword [0x417504]
mov ecx, dword [eax + 8]
push ecx
push 0x40d4c8
call fcn.004075a0
mov edx, dword [0x417504]
mov ebp, eax
mov eax, dword [edx + 0xc]
push eax
push 0x4134c8
mov dword [esp + 0x48], ebp
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
mov ecx, dword [0x417504]
mov edx, dword [ecx + 0x14]
push edx
push 0x4154c8
call fcn.004075a0
push esi
mov dword [esp + 0x40], eax
call fcn.00406d30
test eax, eax
jne 0x402b1c
mov eax, dword [0x417504]
mov ecx, dword [eax + 4]
push ecx
push 0x4114c8
call fcn.004075a0
mov eax, dword [esp + 0x30]
mov edx, eax
movzx ecx, ah
sar edx, 0x10
push edx
push ecx
and eax, 0xff
push eax
push edi
push ebp
push esi
push ebx
push str.CreateShortCut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
call fcn.004072f0
add esp, 0x20
lea edx, [esp + 0x14]
push edx
push 0x40af70
push 1
push 0
push 0x40af80
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x402c50
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x40af90
push eax
call dword [ecx]
mov ebp, eax
test ebp, ebp
jl 0x402c42
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov ebp, eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push 0x46a000
push eax
call dword [edx + 0x24]
mov ecx, dword [esp + 0x30]
mov eax, ecx
sar eax, 8
and eax, 0xff
je 0x402bba
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x3c]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
sar ecx, 0x10
push ecx
push eax
call dword [edx + 0x34]
cmp byte [edi], 0
je 0x402be3
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
and edx, 0xff
push edx
push edi
push eax
call dword [ecx + 0x44]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
test ebp, ebp
jl 0x402c38
push 0x400
push 0x417508
push 0xffffffffffffffff
push ebx
push 0
push 0
mov ebp, 0x80004005
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x402c38
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push 1
push 0x417508
push eax
call dword [ecx + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test ebp, ebp
jge 0x402c69
push 0x40f4c8
push 0xfffffffffffffff0
mov dword [esp + 0x18], 1
call fcn.00405cb0
jmp case.0x401802.1
push 0x40f4c8
push 0xfffffffffffffff4
call fcn.00405cb0
jmp case.0x401802.1
push eax
push 0x40d4c8
call fcn.004075a0
mov edx, dword [0x417504]
mov esi, eax
mov eax, dword [edx + 4]
push eax
push 0x40f4c8
call fcn.004075a0
mov ecx, dword [0x417504]
mov edx, dword [ecx + 0xc]
push edx
push 0x4114c8
mov edi, eax
call fcn.004075a0
push edi
push esi
push str.CopyFiles___s_____s_
mov ebx, eax
call fcn.004072f0
add esp, 0xc
push esi
call fcn.00407330
test eax, eax
je 0x402d1f
push esi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], 2
call sub.KERNEL32.dll_lstrlenA
push edi
mov byte [eax + esi + 1], 0
call sub.KERNEL32.dll_lstrlenA
mov byte [eax + edi + 1], 0
mov ax, word [esp + 0x28]
push ebx
push 0
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x66], ebx
mov word [esp + 0x5c], ax
call fcn.00405cb0
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.0x401802.1
push 0
push 0xfffffffffffffff9
call fcn.00405cb0
mov dword [esp + 0x10], 1
jmp case.0x401802.1
cmp eax, 0xbadf00d
jne 0x40235f
add dword [0x43d8d4], 1
jmp case.0x401802.1
push str._RM_
push 0x40f4c8
xor ebp, ebp
xor ebx, ebx
xor edi, edi
call fcn.00407020
push 0x40f4c8
push 0x4114c8
call fcn.00407020
cmp dword [esp + 0x20], edi
je 0x402d8b
mov edx, dword [0x417504]
mov eax, dword [edx]
push eax
push 0x40d4c8
call fcn.004075a0
mov ebp, eax
cmp dword [esp + 0x24], 0
je 0x402da8
mov ecx, dword [0x417504]
mov edx, dword [ecx + 4]
push edx
push 0x40f4c8
call fcn.004075a0
mov ebx, eax
cmp dword [esp + 0x30], 0
je 0x402dc4
mov eax, dword [0x417504]
mov ecx, dword [eax + 8]
push ecx
push 0x4114c8
call fcn.004075a0
mov edi, eax
mov edx, dword [0x417504]
mov eax, dword [edx + 0xc]
push eax
push 0x4134c8
call fcn.004075a0
mov esi, eax
push esi
call fcn.00407060
push esi
push 0x4114c8
push 0x40f4c8
push 0x40d4c8
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.004072f0
add esp, 0x14
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne case.0x401802.1
mov dword [esp + 0x10], 1
jmp case.0x401802.1
push ecx
push 0x40d4c8
mov dword [esp + 0x20], 0x7e4e21
call fcn.004075a0
mov ecx, dword [0x417504]
mov edx, dword [ecx + 8]
push edx
push 0x40f4c8
mov ebx, eax
call fcn.004075a0
mov ebp, eax
mov eax, dword [0x417504]
mov ecx, dword [eax + 0xc]
push ecx
push 0x4114c8
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
push edi
push 0x1fff
push esi
lea edx, [esp + 0x24]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
cmp eax, dword [esp + 0x18]
jne case.0x401802.1
mov dword [esp + 0x10], 1
mov byte [esi], 0
jmp case.0x401802.1
push ecx
call fcn.004071f0
add esp, 4
cmp dword [esp + 0x30], 0
mov ebx, eax
jne 0x402ef2
push 2
call fcn.00401740
mov edi, eax
test edi, edi
je 0x402f41
mov ecx, dword [0x417504]
mov edx, dword [ecx + 0xc]
push edx
push 0x4134c8
call fcn.004075a0
mov esi, eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
push 0x4114c8
push ebx
push str.DeleteRegValue:___s_s____s_
mov ebp, eax
call fcn.004072f0
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402f39
mov eax, dword [0x417504]
mov ecx, dword [eax + 8]
push ecx
push 0x4114c8
call fcn.004075a0
mov esi, eax
push esi
push ebx
push str.DeleteRegKey:___s_s_
call fcn.004072f0
mov eax, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402f28
mov eax, dword [0x43d8c4]
add eax, 0x80000001
mov edx, dword [esp + 0x30]
and edx, 2
push edx
push esi
push eax
call fcn.00401640
mov ebp, eax
test ebp, ebp
je case.0x401802.1
mov dword [esp + 0x10], 1
jmp case.0x401802.1
test eax, eax
je 0x402f56
mov esi, eax
jmp 0x402f62
mov esi, dword [0x43d8c4]
add esi, 0x80000001
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push edx
push 0x40d4c8
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], ecx
call fcn.004075a0
mov ebp, eax
mov eax, dword [0x417504]
mov ecx, dword [eax + 4]
push ecx
push 0x40f4c8
call fcn.004075a0
push esi
mov edi, eax
call fcn.004071f0
add esp, 4
push 0
mov ebx, eax
mov eax, dword [0x43d8f0]
or al, 2
lea edx, [esp + 0x18]
push edx
push 0
mov dword [esp + 0x1c], 1
push eax
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4030f4
mov eax, dword [esp + 0x3c]
xor esi, esi
cmp eax, 1
jne 0x403030
mov ecx, dword [0x417504]
mov edx, dword [ecx + 0xc]
push edx
push 0x4114c8
call fcn.004075a0
push 0x4114c8
call sub.KERNEL32.dll_lstrlenA
push 0x4114c8
push ebp
mov esi, eax
add esi, 1
cmp dword [esp + 0x20], 1
push edi
push ebx
jne 0x403021
push str.WriteRegStr:___s_s____s___s_
call fcn.004072f0
add esp, 0x14
jmp 0x4030a3
push str.WriteRegExpandStr:___s_s____s___s_
call fcn.004072f0
add esp, 0x14
jmp 0x4030a3
cmp eax, 4
jne 0x40305c
mov ecx, 3
call fcn.00401620
push eax
push ebp
push edi
push ebx
push str.WriteRegDWORD:___s_s____s__0x_08x_
mov dword [0x4114c8], eax
mov esi, 4
call fcn.004072f0
add esp, 0x14
jmp 0x4030a3
cmp eax, 3
jne 0x4030a3
mov eax, dword [esp + 0x2c]
push 0x6000
push 0x4114c8
push 0
push eax
call fcn.00403d70
mov esi, eax
push esi
push 0x4114c8
lea ecx, [esp + 0x6c]
push 0x80
push ecx
call fcn.00407260
lea edx, [esp + 0x74]
push edx
push ebp
push edi
push ebx
push str.WriteRegBin:___s_s____s___s_
call fcn.004072f0
add esp, 0x24
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0x4114c8
push eax
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4030d4
mov edx, dword [esp + 0x14]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
push ebp
push edi
push ebx
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.004072f0
mov edx, dword [esp + 0x24]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
push edi
push ebx
push str.WriteReg:_error_creating_key___s_s_
call fcn.004072f0
add esp, 0xc
jmp case.0x401802.1
push 0x20019
call fcn.00401740
mov edi, eax
mov eax, dword [0x417504]
mov ecx, dword [eax + 0xc]
push ecx
push 0x4134c8
call fcn.004075a0
test edi, edi
mov byte [esi], 0
je 0x40349e
lea edx, [esp + 0x18]
push edx
push esi
lea ecx, [esp + 0x44]
push ecx
push 0
push eax
push edi
mov dword [esp + 0x30], 0x1fff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4031a4
mov eax, dword [esp + 0x3c]
cmp eax, 4
je 0x403182
cmp eax, 1
je 0x403166
cmp eax, 2
jne 0x4031a4
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], ecx
mov byte [edx + esi], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
mov eax, dword [esi]
xor edx, edx
cmp dword [esp + 0x30], edx
push eax
sete dl
push esi
mov dword [esp + 0x18], edx
call fcn.00406f60
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
push edi
mov byte [esi], 0
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
push 0x20019
call fcn.00401740
mov ecx, 3
mov edi, eax
call fcn.00401620
test edi, edi
mov byte [esi], 0
je 0x40349e
cmp dword [esp + 0x30], 0
mov dword [esp + 0x3c], 0x1fff
je 0x40320c
push 0x1fff
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push edi
mov byte [esi + 0x1fff], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x4c]
push ecx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40349e
push edi
mov byte [esi + 0x1fff], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401802.1
cmp byte [esi], 0
je case.0x401802.1
push esi
call fcn.00406f80
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401802.1
mov edx, dword [esp + 0x2c]
push edx
push 0x40f4c8
call fcn.004075a0
mov edi, eax
push edi
call fcn.00407060
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push edi
call fcn.00406e20
cmp eax, 0xffffffff
jne 0x402683
mov byte [esi], 0
mov dword [esp + 0x10], 1
jmp case.0x401802.1
cmp dword [esp + 0x28], 0
je 0x4032b4
mov ecx, 1
call fcn.00401620
mov byte [0x40f4c8], al
mov eax, 1
jmp 0x4032c5
push ecx
push 0x40f4c8
call fcn.004075a0
push eax
call sub.KERNEL32.dll_lstrlenA
cmp byte [esi], 0
je 0x4032ec
push 0
lea edx, [esp + 0x40]
push edx
push eax
push 0x40f4c8
push esi
call fcn.00406f80
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne case.0x401802.1
mov dword [esp + 0x10], 1
jmp case.0x401802.1
mov ecx, 2
xor ebp, ebp
call fcn.00401620
cmp eax, 1
mov dword [esp + 0x14], eax
jl case.0x401802.1
cmp eax, 0x1fff
jle 0x403321
mov dword [esp + 0x14], 0x1fff
cmp byte [esi], 0
je 0x4033c9
push esi
xor bl, bl
call fcn.00406f80
cmp dword [esp + 0x14], 0
mov esi, eax
jle 0x4033c9
nop
push 0
lea eax, [esp + 0x40]
push eax
push 1
lea ecx, [esp + 0x47]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4033c9
cmp dword [esp + 0x3c], 1
jne 0x4033c9
cmp dword [esp + 0x2c], 0
jne 0x403389
cmp bl, 0xd
je 0x4033a4
cmp bl, 0xa
je 0x4033a4
mov al, byte [esp + 0x3b]
mov byte [edi + ebp], al
add ebp, 1
test al, al
mov bl, al
je 0x4033c9
cmp ebp, dword [esp + 0x14]
jl 0x403340
jmp 0x4033c9
movzx edx, byte [esp + 0x3b]
push edx
push edi
call fcn.00406f60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret 4
mov al, byte [esp + 0x3b]
cmp bl, al
je 0x4033bc
cmp al, 0xd
je 0x4033b4
cmp al, 0xa
jne 0x4033bc
mov byte [edi + ebp], al
add ebp, 1
jmp 0x4033c9
push 1
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebp, ebp
mov byte [edi + ebp], 0
jne case.0x401802.1
mov dword [esp + 0x10], 1
jmp case.0x401802.1
cmp byte [esi], 0
je case.0x401802.1
mov eax, dword [esp + 0x2c]
push eax
push 0
mov ecx, 2
call fcn.00401620
push eax
push esi
call fcn.00406f80
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x24], 0
jl case.0x401802.1
push eax
push edi
call fcn.00406f60
jmp case.0x401802.1
cmp byte [esi], 0
je case.0x401802.1
push esi
call fcn.00406f80
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x401802.1
cmp byte [edi], 0
je 0x402e82
lea ecx, [esp + 0xe4]
push ecx
push edi
call fcn.00406f80
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402e82
lea edx, [esp + 0x110]
push edx
push esi
call fcn.00407020
jmp case.0x401802.1
mov eax, dword [esp + 0x28]
push eax
push 0x40d4c8
call fcn.004075a0
lea ecx, [esp + 0xe4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4034ab
mov byte [edi], 0
mov byte [esi], 0
mov dword [esp + 0x10], 1
jmp case.0x401802.1
push eax
push edi
call fcn.00406f60
lea edx, [esp + 0x110]
push edx
push esi
call fcn.00407020
jmp case.0x401802.1
push eax
push 0x40f4c8
mov ebp, 0xfffffd66
call fcn.004075a0
mov esi, eax
push esi
mov dword [esp + 0x44], esi
call fcn.00407060
push esi
call fcn.00406d30
test eax, eax
jne 0x403504
mov eax, dword [0x417504]
mov ecx, dword [eax + 0xc]
push ecx
push 0x40f4c8
call fcn.004075a0
push eax
call fcn.00407060
push esi
call fcn.00406e00
push 2
push 0x40000000
push esi
call fcn.00406e20
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x4035d5
mov ebx, dword [0x43d86c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push 0x40
call esi
mov edi, eax
test edi, edi
je 0x4035c6
push 0
call fcn.00403ac0
push ebx
push edi
call fcn.00403a80
mov edx, dword [esp + 0x28]
push edx
push 0x40
call esi
mov esi, eax
test esi, esi
mov dword [esp + 0x3c], esi
je 0x40359b
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push esi
push 0
push ecx
call fcn.00403d70
cmp byte [esi], 0
je 0x403590
mov ebp, dword [esi]
mov eax, dword [esi + 4]
push ebp
add esi, 8
push esi
add eax, edi
push eax
call fcn.00406dd0
add esi, ebp
cmp byte [esi], 0
jne 0x403577
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
push esi
push 0xffffffffffffffff
call fcn.00403d70
mov ebp, eax
jmp 0x4035ca
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x40]
push esi
push ebp
push str.created_uninstaller:__d____s_
call fcn.004072f0
add esp, 0xc
test ebp, ebp
mov edi, 0xfffffff3
jge 0x403601
push esi
mov edi, 0xffffffef
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x10], 1
push edi
call fcn.00401600
jmp case.0x401802.1
test eax, eax
push ecx
je 0x40364f
push str.settings_logging_to__d
call fcn.004072f0
mov eax, dword [esp + 0x2c]
push eax
push str.logging_set_to__d
mov dword [0x434b88], eax
call fcn.004072f0
add esp, 0x10
cmp dword [esp + 0x24], 0
je 0x403643
call fcn.00404970
jmp case.0x401802.1
push 1
call fcn.00407140
jmp case.0x401802.1
push 0x40d4c8
call fcn.004075a0
push eax
push 0x40a6bc
call fcn.004072f0
add esp, 8
jmp case.0x401802.1
xor ecx, ecx
call fcn.00401620
mov ebx, eax
cmp ebx, dword [0x43d834]
jae 0x40349e
mov eax, dword [esp + 0x28]
mov edx, dword [0x43d830]
mov ecx, ebx
shl ecx, 8
add ecx, ebx
add ecx, ecx
add ecx, ecx
sub ecx, ebx
test eax, eax
lea esi, [edx + ecx*8]
jl 0x4036bf
mov ecx, dword [esi + eax*4]
jne 0x4036b3
add esi, 0x18
push esi
push edi
call fcn.00407020
jmp case.0x401802.1
push ecx
push edi
call fcn.00406f60
jmp case.0x401802.1
or ecx, 0xffffffff
sub ecx, eax
mov dword [esp + 0x28], ecx
je 0x4036da
mov ecx, 1
call fcn.00401620
mov dword [esp + 0x24], eax
jmp 0x4036ec
mov edx, dword [esp + 0x30]
push edx
lea eax, [esi + 0x18]
push eax
call fcn.004075a0
or byte [esi + 9], 1
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esi + ecx*4], edx
cmp dword [esp + 0x2c], 0
je case.0x401802.1
push ebx
call fcn.004011a0
jmp case.0x401802.1
xor ecx, ecx
call fcn.00401620
cmp eax, 0x20
jae 0x40349e
cmp dword [esp + 0x2c], 0
je 0x40374f
cmp dword [esp + 0x28], 0
je 0x40373f
push eax
call fcn.00401300
push 0
push 0
call fcn.00401230
jmp case.0x401802.1
push 0
call fcn.00401350
push eax
push edi
call fcn.00406f60
jmp case.0x401802.1
cmp dword [esp + 0x28], 0
je 0x403769
mov ecx, dword [esp + 0x24]
mov edx, dword [0x43d80c]
mov dword [edx + eax*4 + 0x94], ecx
jmp case.0x401802.1
mov ecx, dword [0x43d80c]
mov edx, dword [ecx + eax*4 + 0x94]
push edx
push edi
call fcn.004075a0
jmp case.0x401802.1
mov ecx, dword [0x433dec]
push 0
and ecx, eax
push ecx
push 0xb
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x20], 0
je case.0x401802.1
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x401802.1
push eax
push 0x40d4c8
call fcn.004075a0
push eax
call fcn.00408e00
add esp, 4
mov edx, dword [esp + 0x10]
add dword [0x43d8c8], edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret 4