Function at 0x405cb2
Capabilities:
Delete file
Get common file path
Set current directory
Shutdown system

Disassembly:
push 0xaf8
mov eax, 0x4bc595
call fcn.004180a8
xor eax, eax
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xaf4], eax
lea eax, [ebp - 0xadc]
push eax
call fcn.00406d5c
pop ecx
and dword [ebp - 4], 0
mov esi, 0x5201f0
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0xadc]
push eax
call fcn.00406bb0
pop ecx
xor ebx, ebx
mov ecx, 0x5201f4
inc ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [0x5201fc]
cmp dword [eax - 0xc], 0
jle 0x405d4c
push ecx
mov ecx, esp
push 0x5201fc
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__20]
call fcn.00406969
pop ecx
lea ecx, [ebp - 0xaec]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [ebp - 4], 2
mov edi, ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
push 4
pop ecx
cmp dword [eax], ebx
jle 0x405fca
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov esi, ecx
mov dword [ebp - 0xae8], esi
mov dword [ebp - 0xadc], ecx
call ebx
push str._inst
mov eax, dword [eax]
push dword [esi + eax]
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
mov esi, eax
call ebx
mov ecx, dword [eax]
mov eax, dword [ebp - 0xadc]
cmp esi, dword [eax + ecx]
jne 0x40618d
call ebx
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
push str._instport
mov eax, dword [eax]
push dword [eax + edi*4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x405dd4
mov dword [0x511074], 2
jmp 0x405dec
call ebx
push str._instdir
mov eax, dword [eax]
push dword [eax + edi*4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x405f9d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov eax, dword [eax]
dec eax
cmp edi, eax
jge 0x405f9d
call ebx
lea ecx, [ebp - 0xaec]
mov eax, dword [eax]
push dword [eax + edi*4 + 4]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
xor esi, esi
lea eax, [ebp - 0xafc]
inc esi
lea ecx, [ebp - 0xaec]
push esi
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
push 0x4d5790
push eax
mov byte [ebp - 4], 3
call fcn.004019a5
pop ecx
pop ecx
lea ecx, [ebp - 0xafc]
mov byte [ebp - 4], 2
mov bl, al
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test bl, bl
je 0x405e8e
mov eax, dword [ebp - 0xaec]
lea ecx, [ebp - 0xaec]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0xb04]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
push eax
lea ecx, [ebp - 0xaec]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xb04]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push esi
lea eax, [ebp - 0xb00]
push eax
lea ecx, [ebp - 0xaec]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
mov ebx, dword [ebp - 0xaf8]
or ebx, esi
mov byte [ebp - 4], 5
push 0x4d4dfc
push eax
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xaf4], ebx
call fcn.004019a5
pop ecx
pop ecx
test al, al
jne 0x405f0d
push esi
lea eax, [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0xaec]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
or ebx, 2
mov dword [ebp - 4], 6
push 0x4d5794
push eax
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xaf4], ebx
call fcn.004019a5
mov byte [ebp - 0xadd], 0
pop ecx
pop ecx
test al, al
je 0x405f14
mov byte [ebp - 0xadd], 1
test bl, 2
je 0x405f2e
and ebx, 0xfffffffd
lea ecx, [ebp - 0xaf0]
mov dword [ebp - 0xaf8], ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 2
test bl, 1
je 0x405f4f
and ebx, 0xfffffffe
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0xaf8], ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
cmp byte [ebp - 0xadd], 0
je 0x405f97
mov eax, dword [ebp - 0xaec]
lea ecx, [ebp - 0xaec]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0xae4]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
push eax
lea ecx, [ebp - 0xaec]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xae4]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
inc edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, dword [ebp - 0xae8]
add dword [ebp - 0xadc], 4
add esi, 4
mov dword [ebp - 0xae8], esi
cmp edi, dword [eax]
jl 0x405d86
xor ebx, ebx
mov esi, 0x5201f0
inc ebx
mov eax, dword [ebp - 0xaec]
cmp dword [eax - 0xc], 0
je 0x405fe5
lea eax, [ebp - 0xaec]
mov ecx, esi
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
mov eax, dword [0x5201f0]
cmp dword [eax - 0xc], 0
jne 0x40602d
lea eax, [ebp - 0xae4]
push eax
call fcn.004070ce
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xae4]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d57f0
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator_2]
mov dword [0x5201e0], ebx
push 0x4d415c
mov ecx, 0x5201f8
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
cmp dword [0x5201e0], 0
lea eax, [ebp - 0xae4]
push 0x20
pop edi
push str.HprSnap.exe
jne 0x40675e
push esi
push eax
call fcn.00401a36
push dword [eax]
mov byte [ebp - 4], 9
call fcn.00407025
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xae4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [0x5201d8]
mov edi, dword [0x5201d4]
mov ebx, dword [0x5201d0]
mov esi, dword [0x5201dc]
push str.HprSnap.exe
mov dword [ebp - 0xafc], eax
lea eax, [ebp - 0xae4]
push 0x5201f4
push eax
mov dword [ebp - 0xb00], edi
call fcn.00401a36
push dword [eax]
mov byte [ebp - 4], 0xa
call fcn.00407025
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xae4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
imul eax, ebx, 0x64
add eax, edi
imul eax, eax, 0x64
add eax, dword [ebp - 0xafc]
imul edi, eax, 0x64
imul eax, dword [0x5201d0], 0x64
add edi, esi
add eax, dword [0x5201d4]
imul eax, eax, 0x64
add eax, dword [0x5201d8]
imul esi, eax, 0x64
add esi, dword [0x5201dc]
cmp dword [0x511070], 0
jne 0x406290
cmp edi, esi
jb 0x406290
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0xae8]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
cmp esi, edi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xae8]
sbb eax, eax
add eax, 0x11
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__23]
lea eax, [ebp - 0xadc]
push dword [0x5201d8]
push dword [0x5201d4]
push dword [0x5201d0]
cmp edi, esi
jbe 0x40622c
push dword [ebp - 0xafc]
push dword [ebp - 0xb00]
push ebx
push dword [ebp - 0xae8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
add esp, 0x20
jmp 0x40623c
call ebx
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
push 0x4d5798
mov eax, dword [eax]
push dword [eax + edi*4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4061b6
mov dword [0x5201e4], 1
jmp 0x405f9d
cmp dword [0x511074], 0
jne 0x4061e2
call ebx
push str._allusers
mov eax, dword [eax]
push dword [eax + edi*4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4061e2
mov dword [0x511074], 1
jmp 0x405f9d
call ebx
push str._autostart
mov eax, dword [eax]
push dword [eax + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x406209
mov dword [0x5201e8], 1
jmp 0x405f9d
call ebx
push str._nodeskico
mov eax, dword [eax]
push dword [eax + edi*4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x405f9d
and dword [0x511078], eax
jmp 0x405f9d
push dword [ebp - 0xae8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
add esp, 0x14
push 0
push 0x24
push dword [ebp - 0xadc]
call sub.mfc140u.dll_AfxMessageBox_1
lea ecx, [ebp - 0xae8]
cmp eax, 6
je 0x40627c
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xaec]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
inc eax
jmp 0x40695d
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x4062a4
mov dword [0x520480], 1
call fcn.00406c23
mov dword [0x520484], eax
lea ecx, [ebp - 0xaf4]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
cmp dword [0x511074], 2
mov byte [ebp - 4], 0xd
jge 0x406317
push 0x4d50e8
push str.SOFTWAREHyperionicsHyperSnap_9
lea eax, [ebp - 0xae4]
push SysStringLen
push eax
call fcn.0040a5b0
add esp, 0x10
push eax
lea ecx, [ebp - 0xaf4]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xae4]
mov byte [ebp - 4], 0xd
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d4dec
lea ecx, [ebp - 0xaf4]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__25]
neg eax
sbb eax, eax
inc eax
mov dword [0x511074], eax
push 0x4d5048
lea eax, [ebp - 0xae4]
push 0x5201f0
push eax
call fcn.00401a36
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, 0x4d4890
push esi
push dword [eax]
call ebx
add esp, 0x14
lea ecx, [ebp - 0xae4]
mov edi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test edi, edi
jne 0x406386
push str.install.log
lea eax, [ebp - 0xb00]
push 0x5201f0
push eax
call fcn.00401a36
push esi
push dword [eax]
call ebx
add esp, 0x14
lea ecx, [ebp - 0xb00]
mov edi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test edi, edi
je 0x40661d
lea ecx, [ebp - 0xae8]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov eax, dword [0x511074]
mov byte [ebp - 4], 0x10
cmp eax, 1
jne 0x4063f3
lea eax, [ebp - 0xaf0]
push 0x17
push eax
call fcn.0040a110
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xae8]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xaf0]
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0xaf0]
push 0x18
push eax
call fcn.0040a110
pop ecx
pop ecx
mov byte [ebp - 4], 0x12
jmp 0x40643c
test eax, eax
jne 0x406459
lea eax, [ebp - 0xaf0]
push 2
push eax
call fcn.0040a110
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xae8]
mov byte [ebp - 4], 0x13
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xaf0]
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0xaf0]
push 7
push eax
call fcn.0040a110
pop ecx
pop ecx
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xaf0]
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 1
lea eax, [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0xae8]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
push 0x5c
push eax
call fcn.004048ef
pop ecx
pop ecx
lea ecx, [ebp - 0xaf0]
mov bl, al
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test bl, bl
je 0x40649b
push 0x4d3d70
lea ecx, [ebp - 0xae8]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator_2]
lea ecx, [ebp - 0xae8]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
jmp 0x4065df
xor eax, eax
mov word [ebp - 0x2ca], ax
lea eax, [ebp - 0x6c8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea ecx, [ebp - 0x6c8]
lea eax, [ecx + eax*2]
cmp eax, ecx
jbe 0x406502
push 0x20
pop ebx
cmp word [eax], bx
ja 0x4064fc
xor ecx, ecx
mov word [eax], cx
sub eax, 2
lea ecx, [ebp - 0x6c8]
cmp eax, ecx
ja 0x4064e5
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
lea eax, [ebp - 0x6c8]
push str.Shell_Link:
push eax
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
lea ecx, [ebp - 0x6c8]
cmp eax, ecx
jne 0x4065df
push str.Shell_Link:
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea ecx, [ebp - 0x6c8]
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0xaf4]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
lea ecx, [ebp - 0xaf4]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
push 0
push dword [ebp - 0xae8]
lea ecx, [ebp - 0xaf4]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
test eax, eax
jne 0x4065df
push eax
push dword [ebp - 0xadc]
lea ecx, [ebp - 0xaf4]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
test eax, eax
jns 0x4065df
mov eax, dword [ebp - 0xae8]
push str.Shell_Link:
mov esi, dword [eax - 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add eax, esi
mov esi, 0x5201f8
pop ecx
lea ecx, [ebp - 0x6c8]
lea eax, [ecx + eax*2]
mov ecx, esi
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push dword [0x5201f8]
lea eax, [ebp - 0xaf0]
push eax
call fcn.00406f5a
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0xaf0]
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push edi
lea eax, [ebp - 0x6c8]
push 0x200
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x4064be
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
lea ecx, [ebp - 0xadc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xae8]
mov byte [ebp - 4], 0xd
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0xae4]
xor edi, edi
push 0x18
push eax
call fcn.0040a110
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
push dword [eax]
lea eax, [ebp - 0x8d0]
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0xae4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0xae4]
push 7
push eax
call fcn.0040a110
push dword [eax]
lea eax, [ebp - 0xad8]
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0xae4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea eax, [ebp - 0x8d0]
push eax
call ebx
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
pop ecx
cmp eax, 4
jbe 0x406701
lea eax, [ebp - 0x218]
push eax
push edi
push 0x4d5828
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x218]
push 0x4d5830
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
pop ecx
pop ecx
test eax, eax
je 0x4066d7
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4d5834
lea eax, [ebp - 0x8d0]
push 0x104
push eax
call esi
lea eax, [ebp - 0x8d0]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
add esp, 0x14
neg eax
sbb edi, edi
inc edi
lea eax, [ebp - 0xad8]
push eax
call ebx
pop ecx
cmp eax, 4
jbe 0x406739
push 0x4d5834
lea eax, [ebp - 0xad8]
push 0x104
push eax
call esi
lea eax, [ebp - 0xad8]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
add esp, 0x14
test eax, eax
je 0x406741
test edi, edi
jne 0x406741
xor eax, eax
jmp 0x406744
xor eax, eax
inc eax
lea ecx, [ebp - 0xaf4]
mov byte [ebp - 4], 2
mov dword [0x5201e8], eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x20
pop edi
jmp 0x406787
push 0x5201f4
push eax
call fcn.00401a36
push dword [eax]
mov byte [ebp - 4], 0x16
call fcn.00407025
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xae4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
cmp dword [0x5201d0], 0
je 0x4067c9
push 0x4d5048
lea eax, [ebp - 0xae4]
push 0x5201f4
push eax
call fcn.00401a36
mov ebx, dword [ebp - 0xaf8]
push 0
or ebx, 4
push dword [eax]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
add esp, 0x14
test eax, eax
js 0x4067cf
mov byte [ebp - 0xadd], 0
jmp 0x4067d6
mov ebx, dword [ebp - 0xaf8]
mov byte [ebp - 0xadd], 1
test bl, 4
je 0x4067e7
lea ecx, [ebp - 0xae4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
cmp byte [ebp - 0xadd], 0
jne 0x406963
cmp dword [0x511070], 0
je 0x4068df
cmp dword [0x5201e0], 0
je 0x406814
mov dword [0x511074], 1
call fcn.00404c42
cmp dword [0x511070], 2
jne 0x40685b
push 0
lea ecx, [ebp - 0x2c8]
call fcn.004087f4
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 0x17
mov ecx, eax
mov dword [0x51c520], eax
mov dword [ebp - 0x20], 4
call sub.mfc140u.dll_CDialog::DoModal
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 2
call fcn.004048ac
push dword [0x5201f0]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [0x5201e4], 0
je 0x40694f
cmp dword [0x5201ec], 0
je 0x40691b
cmp dword [0x520478], 0
je 0x4068d0
and dword [ebp - 0xadc], 0
lea eax, [ebp - 0xadc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x520478]
cmp dword [ebp - 0xadc], 0
je 0x4068d0
push 1
push str.SeShutdownPrivilege
push dword [ebp - 0xadc]
call fcn.004080bc
add esp, 0xc
push dword [ebp - 0xadc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40694f
push 0
lea ecx, [ebp - 0x2c8]
call fcn.004087f4
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 0x18
mov ecx, eax
mov dword [0x51c520], eax
call sub.mfc140u.dll_CDialog::DoModal
cmp eax, 1
je 0x40684c
lea ecx, [ebp - 0x2c8]
call fcn.004048ac
jmp 0x406268
push str.HprSnap.exe
lea eax, [ebp - 0xafc]
push 0x5201f0
push eax
call fcn.00401a36
push 0
push 0
push dword [ebp - 0xafc]
call fcn.00407ff9
add esp, 0x18
lea ecx, [ebp - 0xafc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xaec]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
call fcn.00418057
ret
call fcn.00408177
int3