Function at 0x42ab31
Capabilities:
Check if file exists
Create pipe
Create process on windows
Delete file
Delete registry key
Get disk size
Get file attributes
Read file on windows
Read pipe
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42dd01
mov eax, dword fs:[0]
push eax
sub esp, 0x8f8
mov eax, dword [0x43eec0]
xor eax, esp
mov dword [esp + 0x8f0], eax
push ebx
push esi
push edi
mov eax, dword [0x43eec0]
xor eax, esp
push eax
lea eax, [esp + 0x908]
mov dword fs:[0], eax
xor esi, esi
mov ebx, ecx
mov dword [esp + 0x28], esi
xor edi, edi
cmp dword [ebx + 0xac], esi
mov dword [esp + 0x54], ebx
jle 0x42aba0
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
inc edi
mov dword [eax + 0x10], esi
cmp edi, dword [ebx + 0xac]
jl 0x42ab87
lea eax, [esp + 0x38]
push eax
call fcn.00428fc3
push esi
mov dword [esp + 0x914], esi
mov eax, dword [eax]
push 0x436728
push eax
mov ecx, ebx
call fcn.00404337
or dword [esp + 0x910], 0xffffffff
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
mov dword [esp + 0x20], eax
call fcn.00402479
push dword [esp + 0x20]
push str.CMainApp::Download.start:
call fcn.00428c4d
pop ecx
pop ecx
xor edi, edi
cmp dword [ebx + 0xac], esi
mov dword [ebx + 0xd8], esi
mov dword [ebx + 0xdc], esi
mov dword [ebx + 0xe0], esi
mov dword [ebx + 0xe4], esi
jle 0x42acbd
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
mov ecx, dword [eax + 8]
add dword [ebx + 0xe0], ecx
mov eax, dword [eax + 0xc]
lea ecx, [ebx + 0xa4]
adc dword [ebx + 0xe4], eax
mov eax, edi
call fcn.0040184c
cmp dword [eax + 0x10], esi
je 0x42ac5f
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
mov ecx, dword [eax + 8]
add dword [ebx + 0xd8], ecx
mov eax, dword [eax + 0xc]
adc dword [ebx + 0xdc], eax
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
cmp dword [eax + 4], esi
jne 0x42acb0
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
push dword [eax]
push str.File_time_is_zero:
call fcn.00428cd7
pop ecx
pop ecx
push 0x1000
push 0x43678c
push 0x436798
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc edi
cmp edi, dword [ebx + 0xac]
jl 0x42ac0f
cmp dword [esp + 0x20], esi
mov dword [esp + 0x40], esi
jle 0x42ad51
lea edi, [ebx + 0xa4]
mov eax, dword [esp + 0x40]
mov ecx, edi
call fcn.0040184c
push eax
lea eax, [ebx + 0xec]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0040142d
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
setne byte [esp + 0x17]
add ecx, 0xfffffff0
call fcn.00402479
cmp byte [esp + 0x17], 0
je 0x42ad43
mov eax, dword [esp + 0x40]
mov ecx, edi
call fcn.0040184c
mov ecx, dword [eax + 8]
add dword [ebx + 0xd8], ecx
mov eax, dword [eax + 0xc]
mov ecx, edi
adc dword [ebx + 0xdc], eax
mov eax, dword [esp + 0x40]
call fcn.0040184c
mov dword [eax + 0x10], 1
inc dword [esp + 0x40]
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x20]
jl 0x42acd1
mov eax, dword [ebx + 0xd8]
mov dword [ebx + 0x108], eax
mov eax, dword [ebx + 0xdc]
mov dword [ebx + 0x10c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], eax
jmp 0x42ae9d
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 0xa4]
call fcn.0040184c
cmp dword [eax + 0x10], esi
jne 0x42ae95
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], esi
cmp eax, dword [esp + 0x20]
jne 0x42adec
lea eax, [esp + 0x2c]
push eax
call fcn.00428fc3
xor edi, edi
push esi
inc edi
mov dword [esp + 0x914], edi
mov eax, dword [eax]
push 0x436818
push eax
mov ecx, ebx
call fcn.00404337
or dword [esp + 0x910], 0xffffffff
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
mov dword [esp + 0x30], eax
call fcn.00402479
cmp dword [esp + 0x30], esi
je 0x42adec
cmp dword [esp + 0x20], esi
je 0x42adec
mov dword [esp + 0x3c], edi
push dword [esp + 0x30]
mov ecx, ebx
push dword [esp + 0x38]
call fcn.0042a0d4
test eax, eax
jne 0x42ae1d
lea edi, [ebx + 0xc0]
push dword [esp + 0x30]
mov ecx, ebx
push dword [esp + 0x38]
mov dword [edi], esi
mov dword [edi + 4], esi
call fcn.0042a0d4
test eax, eax
je 0x42ae05
cmp dword [ebx + 0x100], esi
jne 0x42b031
cmp dword [esp + 0x3c], esi
jne 0x42aea9
lea eax, [esp + 0x24]
push eax
call fcn.00428fc3
push esi
mov dword [esp + 0x914], 3
mov eax, dword [eax]
push 0x436820
push eax
mov ecx, ebx
call fcn.004043a2
or dword [esp + 0x910], 0xffffffff
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 0xa4]
mov dword [ebx + 0xc0], esi
mov dword [ebx + 0xc4], esi
call fcn.0040184c
mov ecx, dword [eax + 8]
add dword [ebx + 0xd8], ecx
mov eax, dword [eax + 0xc]
adc dword [ebx + 0xdc], eax
inc dword [esp + 0x34]
mov eax, dword [esp + 0x34]
cmp eax, dword [ebx + 0xac]
jl 0x42ad7a
mov edi, ebx
mov dword [esp + 0x30], esi
call fcn.00429895
xor edi, edi
cmp dword [ebx + 0xac], esi
jle 0x42b006
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
cmp dword [eax + 0x10], esi
je 0x42aff1
call fcn.00403cbe
push eax
lea ecx, [esp + 0x4c]
call fcn.00402274
push edi
lea eax, [esp + 0x4c]
push 0x436828
push eax
mov dword [esp + 0x91c], 4
call fcn.0040203b
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
call fcn.00428fc3
push esi
mov byte [esp + 0x914], 5
push dword [esp + 0x4c]
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.00404337
mov byte [esp + 0x910], 4
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
mov dword [esp + 0x44], eax
call fcn.00402479
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
cmp dword [eax + 4], esi
je 0x42af66
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
mov ecx, dword [esp + 0x44]
cmp ecx, dword [eax + 4]
jne 0x42af9f
mov eax, edi
lea ecx, [ebx + 0xa4]
call fcn.0040184c
push eax
lea eax, [ebx + 0xec]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0040142d
or dword [esp + 0x34], 1
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov byte [esp + 0x17], 0
cmp eax, 0xffffffff
jne 0x42afa4
mov byte [esp + 0x17], 1
test byte [esp + 0x28], 1
je 0x42afbc
mov ecx, dword [esp + 0x1c]
and dword [esp + 0x28], 0xfffffffe
add ecx, 0xfffffff0
call fcn.00402479
cmp byte [esp + 0x17], 0
je 0x42afdb
mov eax, edi
lea ecx, [ebx + 0xa4]
mov dword [esp + 0x30], 1
call fcn.0040184c
mov dword [eax + 0x10], esi
or dword [esp + 0x910], 0xffffffff
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.00402479
jmp 0x42aff9
mov dword [esp + 0x30], 1
inc edi
cmp edi, dword [ebx + 0xac]
jl 0x42aec2
mov dword [esp + 0x20], esi
cmp dword [esp + 0x30], esi
je 0x42b06e
cmp dword [esp + 0x3c], esi
jne 0x42abe9
push esi
push 0x436830
push 0x436840
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42abe9
cmp dword [ebx + 0x128], esi
je 0x42c45c
lea eax, [esp + 0x38]
push eax
call fcn.00428fc3
mov dword [esp + 0x910], 2
push dword [eax]
mov ecx, 0x442db0
call fcn.0040425c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x38]
jmp 0x42c454
lea eax, [esp + 0x38]
push eax
call fcn.00428fc3
push eax
mov ecx, 0x442db0
mov dword [esp + 0x914], 6
call fcn.0040425c
push eax
mov ecx, ebx
call fcn.0040abf2
or dword [esp + 0x910], 0xffffffff
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.00402479
call fcn.00403cbe
push eax
lea ecx, [esp + 0x38]
call fcn.00402274
push 0x436948
mov dword [esp + 0x914], 7
call fcn.00411fdf
pop ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00402697
push 0x436954
lea eax, [esp + 0x38]
push eax
call fcn.00401178
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa
push 0x8c
push dword [0x442df4]
call edi
cmp eax, esi
je 0x42b10d
push eax
push dword [esp + 0x38]
call fcn.00428a53
pop ecx
pop ecx
push 0x436960
call fcn.00411fdf
pop ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00402697
push str.unrar.exe
lea eax, [esp + 0x38]
push eax
call fcn.00401178
push 0xa
push 0x91
push dword [0x442df4]
call edi
cmp eax, esi
je 0x42b150
push eax
push dword [esp + 0x38]
call fcn.00428a53
pop ecx
pop ecx
call fcn.00403cbe
push eax
lea ecx, [esp + 0x44]
call fcn.00402274
push str.TEMP
mov byte [esp + 0x914], 8
call fcn.00411fdf
pop ecx
push eax
lea ecx, [esp + 0x44]
call fcn.00402697
push str.unzip.exe
lea eax, [esp + 0x44]
push eax
call fcn.00401178
push 0xa
push 0x8a
push dword [0x442df4]
call edi
cmp eax, esi
je 0x42b1aa
push eax
push dword [esp + 0x44]
call fcn.00428a53
pop ecx
pop ecx
mov dword [esp + 0x78], vtable.CArray_class_CUnpackInfo__class_CUnpackInfo_const__.0
mov dword [esp + 0x7c], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], esi
mov byte [esp + 0x910], 9
mov eax, dword [ebx + 0xac]
cmp eax, esi
mov dword [esp + 0x18], esi
jle 0x42b5a5
lea eax, [ebx + 0xa4]
mov dword [esp + 0x1c], eax
lea eax, [ebx + 0xec]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.0040184c
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x2c]
push eax
call fcn.0040142d
add esp, 0xc
push 0x3e8
lea eax, [esp + 0x130]
push eax
mov byte [esp + 0x918], 0xa
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00429daf
pop ecx
pop ecx
mov byte [esp + 0x910], 0xb
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.0040184c
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0040142d
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x914], 0xc
call fcn.0040213e
mov byte [esp + 0x910], 0xb
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x1c]
push 4
lea eax, [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
call fcn.0040184c
mov ecx, eax
call fcn.004013a8
mov edi, eax
mov byte [esp + 0x910], 0xd
call fcn.0040124d
push 0x436990
mov ecx, eax
call fcn.00401694
neg eax
sbb al, al
mov byte [esp + 0x910], 0xb
mov ecx, dword [esp + 0x4c]
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x17], al
call fcn.00402479
cmp byte [esp + 0x17], 0
je 0x42b34b
lea esi, [esp + 0x8c]
call fcn.0042cbb6
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov byte [esp + 0x914], 0xe
call fcn.0040213e
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x94]
call fcn.0040213e
mov ebx, esi
lea eax, [esp + 0x78]
mov dword [esp + 0x9c], 1
call fcn.004018d2
call fcn.0042cba1
mov ebx, dword [esp + 0x54]
xor esi, esi
jmp 0x42b571
mov ecx, dword [esp + 0x1c]
push 4
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
call fcn.0040184c
mov ecx, eax
call fcn.004013a8
mov edi, eax
mov byte [esp + 0x910], 0xf
call fcn.0040124d
push 0x43699c
mov ecx, eax
call fcn.00401694
neg eax
sbb al, al
mov byte [esp + 0x910], 0xb
mov ecx, dword [esp + 0x2c]
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x17], al
call fcn.00402479
cmp byte [esp + 0x17], 0
je 0x42b571
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
mov edi, eax
inc eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
call fcn.0040184c
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x44], eax
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
jl 0x42b3f8
cmp dword [esp + 0x3c], ecx
jg 0x42b3f8
mov ecx, dword [esp + 0x3c]
lea eax, [eax + ecx*2]
push str..part
push eax
call fcn.0041319b
pop ecx
pop ecx
cmp eax, esi
je 0x42b400
mov ecx, dword [esp + 0x44]
sub eax, dword [ecx]
sar eax, 1
jmp 0x42b3fb
or eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x42b3ad
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.0040184c
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x50]
push eax
call fcn.0040142d
add esp, 0xc
mov byte [esp + 0x910], 0x10
cmp edi, 0xffffffff
je 0x42b513
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.0040184c
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x1c]
sub eax, edi
sub eax, 9
push eax
lea eax, [edi + 5]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
call fcn.0040184c
mov ecx, eax
call fcn.0040132a
push dword [eax]
call fcn.00412aa3
pop ecx
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
mov dword [esp + 0x44], eax
call fcn.00402479
cmp dword [esp + 0x44], esi
je 0x42b513
mov ecx, dword [esp + 0x1c]
push edi
lea eax, [esp + 0x54]
push eax
mov eax, dword [esp + 0x20]
call fcn.0040184c
mov ecx, eax
call fcn.004013ef
push eax
mov byte [esp + 0x914], 0x11
push dword [esp + 0x34]
lea eax, [esp + 0x68]
push eax
call fcn.0040142d
add esp, 0xc
push str...rar
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x91c], 0x12
call fcn.00401484
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x914], 0x13
call fcn.0040213e
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.00402479
cmp dword [esp + 0x44], 1
jne 0x42b565
lea esi, [esp + 0x8c]
call fcn.0042cbb6
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov byte [esp + 0x914], 0x14
call fcn.0040213e
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x94]
call fcn.0040213e
mov ebx, esi
lea eax, [esp + 0x78]
mov dword [esp + 0x9c], 2
call fcn.004018d2
call fcn.0042cba1
mov ebx, dword [esp + 0x54]
xor esi, esi
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00402479
mov byte [esp + 0x910], 9
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [ebx + 0xac]
jl 0x42b1f9
mov edx, dword [ebx + 0xe8]
push 0xa
pop ecx
lea edi, [edx + 0x88]
xor eax, eax
rep stosd dword es:[edi], eax
push str.Calculating_unpacked_files_size...
mov dword [edx + 0x7c], esi
push dword [ebx + 0xe8]
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
call fcn.0042756d
cmp dword [esp + 0x80], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], esi
jle 0x42ba36
mov esi, dword [esp + 0x7c]
and dword [esp + 0x124], 0
push 0x64
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x130], 0xc
mov dword [esp + 0x138], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x64
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
call fcn.00403cbe
push eax
lea ecx, [esp + 0x30]
call fcn.00402274
mov byte [esp + 0x910], 0x15
cmp dword [esp + 0x28], 0
jl 0x42bc2e
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x80]
jge 0x42bc2e
push dword [esi]
lea eax, [esp + 0x34]
push eax
call fcn.00429daf
pop ecx
pop ecx
mov byte [esp + 0x910], 0x16
call fcn.00403cbe
push eax
lea ecx, [esp + 0x28]
call fcn.00402274
mov byte [esp + 0x910], 0x17
call fcn.00403cbe
push eax
lea ecx, [esp + 0x24]
call fcn.00402274
mov byte [esp + 0x910], 0x18
mov eax, dword [esi + 0x10]
dec eax
je 0x42b6d7
dec eax
jne 0x42b6f9
push dword [esi]
lea eax, [esp + 0x28]
push str._l___s_
push eax
call fcn.0040203b
lea eax, [esp + 0x40]
jmp 0x42b6ec
push dword [esi]
lea eax, [esp + 0x28]
push str.__l___s_
push eax
call fcn.0040203b
lea eax, [esp + 0x4c]
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
call fcn.0040213e
push 0x44
lea eax, [esp + 0xd8]
push 0
push eax
call fcn.00413fa0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0xe0], 0x44
mov dword [esp + 0x10c], 0x100
call fcn.0040142d
add esp, 0xc
push dword [eax]
push 0x436a34
call fcn.00428cd7
pop ecx
pop ecx
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.00402479
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.0040142d
mov eax, dword [eax]
add esp, 0xc
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0xd8]
push ecx
push dword [esp + 0x38]
xor ecx, ecx
push ecx
push 0x8000400
push 1
push ecx
push ecx
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
mov dword [esp + 0x58], eax
call fcn.00402479
cmp dword [esp + 0x58], 0
je 0x42b9fc
call fcn.00403cbe
push eax
lea ecx, [esp + 0x20]
call fcn.00402274
mov byte [esp + 0x910], 0x19
push 0x1f4
mov byte [esp + 0x1b], 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00403cbe
push eax
lea ecx, [esp + 0x48]
call fcn.00402274
mov byte [esp + 0x910], 0x1a
jmp 0x42b91e
cmp dword [ebx + 0x100], 0
jne 0x42bbda
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push dword [esp + 0x18]
push 0x436a4c
call fcn.00428c4d
cmp dword [esp + 0x20], 0
pop ecx
pop ecx
je 0x42b8f2
jbe 0x42b8fa
push 0
lea eax, [esp + 0x3c]
push eax
push 1
lea eax, [esp + 0x23]
push eax
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x38], 0
je 0x42b8e6
push 1
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x1f]
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffW]
cmp byte [esp + 0x17], 0xa
jne 0x42b8d2
lea ebx, [esp + 0x1c]
call fcn.00401273
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x42b8b3
mov eax, ebx
push eax
lea ecx, [esp + 0x30]
call fcn.0040213e
push dword [esp + 0x1c]
call fcn.00428d61
lea ecx, [esp + 0x20]
mov dword [esp], 0x4336fa
call fcn.004021cd
mov ebx, dword [esp + 0x54]
jmp 0x42b8e6
cmp byte [esp + 0x17], 0xd
je 0x42b8e6
push dword [esp + 0x4c]
lea ecx, [esp + 0x20]
call fcn.00401f9e
dec dword [esp + 0x18]
jne 0x42b85e
jmp 0x42b8fa
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x3c], 0x103
jne 0x42b91e
mov dword [esp + 0x18], 1
cmp dword [esp + 0x18], 0
jne 0x42b81b
push dword [esp + 0x1c]
call fcn.00428d61
pop ecx
push dword [esp + 0xac]
call edi
push dword [esp + 0x64]
call edi
push dword [esp + 0x5c]
call edi
push dword [esp + 0x74]
call edi
push dword [esp + 0x68]
call edi
lea ebx, [esp + 0x1c]
call fcn.00401273
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x42b971
mov eax, ebx
push eax
lea ecx, [esp + 0x30]
call fcn.0040213e
mov ebx, dword [esp + 0x2c]
push 0xa
push 0
push ebx
call fcn.00412dff
mov ecx, dword [esp + 0x50]
add esp, 0xc
add dword [esp + 0x6c], eax
mov dword [esi + 8], eax
mov eax, edx
adc dword [esp + 0x70], eax
add ecx, 0xfffffff0
mov dword [esi + 0xc], edx
call fcn.00402479
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.00402479
lea ecx, [ebx - 0x10]
mov byte [esp + 0x910], 9
call fcn.00402479
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x54]
add esi, 0x18
cmp eax, dword [esp + 0x80]
jl 0x42b5ee
jmp 0x42ba34
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.00402479
mov byte [esp + 0x910], 9
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.00402479
xor esi, esi
mov eax, dword [esp + 0x6c]
mov dword [ebx + 0xe0], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0xd0], esi
mov dword [ebx + 0xd4], esi
mov dword [ebx + 0xc8], esi
mov dword [ebx + 0xcc], esi
mov dword [ebx + 0xc0], esi
mov dword [ebx + 0xc4], esi
mov dword [ebx + 0xd8], esi
mov dword [ebx + 0xdc], esi
mov dword [ebx + 0xe4], eax
call fcn.00403cbe
push eax
lea ecx, [esp + 0x20]
call fcn.00402274
push esi
mov byte [esp + 0x914], 0x1b
lea eax, [ebx + 0xec]
push esi
lea ecx, [esp + 0xac]
mov dword [esp + 0x38], eax
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebx + 0xe4]
cmp eax, dword [esp + 0xa8]
jl 0x42bcfd
jg 0x42bad6
mov eax, dword [ebx + 0xe0]
cmp eax, dword [esp + 0xa4]
jbe 0x42bcfd
push esi
mov eax, 0x96
push eax
push str.Skip_extracting_process
push eax
push str.Choose_another_folder
push str.The_total_unpacking_size_is_more_that_free_space_available._r_nYou_can_choose_another_folder_to_extract_files_or_skip_extracting_process.
call fcn.0042a05d
add esp, 0x18
mov dword [esp + 0x50], eax
cmp eax, 0xfffffffe
jne 0x42bb0c
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0x50], 0xffffffff
jne 0x42bcfd
lea eax, [esp + 0x58]
push eax
call fcn.00428fc3
push eax
lea eax, [esp + 0x64]
push str.Select_destination_folder_for_unpacking_r_n
push eax
mov byte [esp + 0x91c], 0x1c
call fcn.004014dc
add esp, 0xc
mov byte [esp + 0x910], 0x1d
mov edx, dword [eax]
lea esi, [esp + 0x50]
call fcn.00429ea2
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x914], 0x1e
call fcn.0040213e
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.00402479
mov byte [esp + 0x910], 0x1b
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.00402479
lea eax, [esp + 0x1c]
push 0x4336fb
push eax
call fcn.00401535
pop ecx
pop ecx
test al, al
je 0x42bc33
push 0x1004
push str.Extracting
push str.Skip_extracting_process_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42bce2
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42bce2
push 0
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x2c]
jmp 0x42c42b
call fcn.00403b1d
xor esi, esi
push esi
push esi
lea eax, [esp + 0xac]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebx + 0xe4]
cmp eax, dword [esp + 0xa8]
jl 0x42bc8b
jg 0x42bc69
mov eax, dword [ebx + 0xe0]
cmp eax, dword [esp + 0xa4]
jbe 0x42bc8b
push esi
push 0x436c80
push 0x436c90
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x433746
lea ecx, [esp + 0x20]
call fcn.004021cd
jmp 0x42bce2
lea eax, [esp + 0x4c]
push eax
call fcn.00428fc3
push 0x436c8c
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x91c], 0x1f
call fcn.00401484
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x914], 0x20
call fcn.00401718
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.00402479
mov byte [esp + 0x910], 0x1b
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.00402479
lea eax, [esp + 0x1c]
push 0x433747
push eax
call fcn.00401535
pop ecx
pop ecx
test al, al
jne 0x42bb17
xor esi, esi
push str.Unpacking_files...
push dword [ebx + 0xe8]
call fcn.0042756d
cmp dword [esp + 0x80], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], esi
jle 0x42c34d
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x2c], eax
push 0x64
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x68]
xor esi, esi
push eax
mov dword [esp + 0xd8], 0xc
mov dword [esp + 0xe0], 1
mov dword [esp + 0xdc], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x64
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp dword [esp + 0x48], esi
jl 0x42bc2e
mov eax, dword [esp + 0x48]
cmp eax, dword [esp + 0x80]
jge 0x42bc2e
mov eax, dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x40]
push eax
call fcn.00429daf
pop ecx
pop ecx
mov byte [esp + 0x910], 0x21
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], esi
je 0x42bdc9
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
call fcn.0040213e
call fcn.00403cbe
push eax
lea ecx, [esp + 0x2c]
call fcn.00402274
mov byte [esp + 0x910], 0x22
call fcn.00403cbe
push eax
lea ecx, [esp + 0x28]
call fcn.00402274
mov byte [esp + 0x910], 0x23
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x10]
dec eax
je 0x42be1f
dec eax
jne 0x42be45
mov eax, dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x2c]
push str._x___s_
push eax
call fcn.0040203b
lea eax, [esp + 0x40]
jmp 0x42be38
mov eax, dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x2c]
push str.__o___s_
push eax
call fcn.0040203b
lea eax, [esp + 0x4c]
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
call fcn.0040213e
push 0x44
lea eax, [esp + 0xd8]
push esi
push eax
call fcn.00413fa0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0xe0], 0x44
mov dword [esp + 0x10c], 0x100
call fcn.0040142d
add esp, 0xc
push dword [eax]
push str.Executing:
call fcn.00428cd7
pop ecx
pop ecx
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.00402479
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.0040142d
mov eax, dword [eax]
add esp, 0xc
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0xd8]
push ecx
push dword [esp + 0x44]
push esi
push 0x8004000
push 1
push esi
push esi
push eax
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
mov dword [esp + 0x58], eax
call fcn.00402479
cmp dword [esp + 0x58], esi
je 0x42c321
call fcn.00403cbe
push eax
lea ecx, [esp + 0x1c]
call fcn.00402274
mov byte [esp + 0x910], 0x24
call fcn.00403cbe
push eax
lea ecx, [esp + 0x70]
call fcn.00402274
mov byte [esp + 0x910], 0x25
push 0x1f4
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x20], 1
mov word [esp + 0x126], ax
cmp dword [ebx + 0x100], 0
je 0x42bf84
push 0
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
push eax
lea ecx, [esp + 0x24]
push ecx
push eax
push eax
push eax
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push dword [esp + 0x20]
push str.Available_in_pipe:
call fcn.00428c4d
cmp dword [esp + 0x28], 0
pop ecx
pop ecx
je 0x42c165
jbe 0x42c16d
push 0
lea eax, [esp + 0xc8]
push eax
push 1
lea eax, [esp + 0x23]
push eax
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc4], 0
je 0x42c159
push 1
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x1f]
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffW]
cmp byte [esp + 0x17], 0xa
jne 0x42c01c
push dword [esp + 0x18]
push str._r_nWhole_line:
call fcn.00428cd7
pop ecx
pop ecx
push 0x433792
lea ecx, [esp + 0x1c]
call fcn.004021cd
jmp 0x42c030
cmp byte [esp + 0x17], 0xd
je 0x42c030
push dword [esp + 0x4c]
lea ecx, [esp + 0x1c]
call fcn.00401f9e
mov ecx, dword [esp + 0x4c]
lea ebx, [esp + 0xbc]
call fcn.0040105c
push dword [eax]
call fcn.00428aba
pop ecx
mov ecx, dword [esp + 0xbc]
add ecx, 0xfffffff0
call fcn.00402479
mov eax, dword [esp + 0x18]
mov ebx, dword [eax - 0xc]
cmp ebx, 6
jle 0x42c155
lea eax, [ebx - 7]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015c8
mov ecx, 0x25d8
cmp ax, cx
jne 0x42c155
lea eax, [ebx - 6]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015c8
mov ecx, 0x25d8
cmp ax, cx
jne 0x42c155
lea eax, [ebx - 5]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015c8
mov ecx, 0x25d8
cmp ax, cx
jne 0x42c155
lea eax, [ebx - 4]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015c8
mov ecx, 0x25d8
cmp ax, cx
jne 0x42c155
lea eax, [ebx - 3]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015c8
mov word [esp + 0x120], ax
lea eax, [ebx - 2]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015c8
dec ebx
push ebx
lea ecx, [esp + 0x1c]
mov word [esp + 0x126], ax
call fcn.004015c8
push 0xa
mov word [esp + 0x128], ax
lea eax, [esp + 0x124]
push 0
push eax
call fcn.00413024
add esp, 0xc
test eax, eax
je 0x42c155
cdq
push edx
push eax
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004165b0
push 0
push 0x64
push edx
push eax
call fcn.004165f0
mov ecx, dword [esp + 0x54]
mov dword [ecx + 0xc0], eax
mov dword [ecx + 0xc4], edx
mov ebx, ecx
jmp 0x42c159
mov ebx, dword [esp + 0x54]
dec dword [esp + 0x20]
jne 0x42bfba
jmp 0x42c16d
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x44]
push eax
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x44], 0x103
jne 0x42c191
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], 0
jne 0x42bf6c
push dword [esp + 0x18]
call fcn.00428d61
pop ecx
lea eax, [esp + 0x44]
push eax
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x44], 0
jne 0x42c266
lea ecx, [esp + 0x8c]
call fcn.0040b156
mov byte [esp + 0x910], 0x26
mov eax, dword [esi + 4]
push 0
push eax
lea ecx, [esp + 0x94]
call fcn.0040b1ee
push dword [esi + 4]
mov dword [esp + 0x30], eax
push str.Deleting:
call fcn.00428cd7
pop ecx
pop ecx
jmp 0x42c249
call fcn.0040ae56
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x8c]
push 0x10
lea ecx, [esp + 0x90]
call dword [eax + 0x38]
test eax, eax
jne 0x42c249
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x90]
call fcn.0040b3ed
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc0]
add ecx, 0xfffffff0
call fcn.00402479
cmp dword [esp + 0x2c], 0
lea ecx, [esp + 0x8c]
jne 0x42c1fe
mov byte [esp + 0x910], 0x25
call fcn.0040b17f
jmp 0x42c26e
mov dword [esp + 0x38], 1
push dword [esi]
push str.File_processed:
call fcn.00428cd7
pop ecx
pop ecx
push dword [esp + 0xac]
call edi
push dword [esp + 0x64]
call edi
push dword [esp + 0x5c]
call edi
push dword [esp + 0x74]
call edi
push dword [esp + 0x68]
call edi
and dword [ebx + 0xc0], 0
and dword [ebx + 0xc4], 0
mov eax, dword [esi + 8]
add dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x6c]
adc dword [ebx + 0xdc], eax
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00402479
mov byte [esp + 0x910], 0x1b
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.00402479
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
add esi, 0x18
cmp eax, dword [esp + 0x80]
mov dword [esp + 0x2c], esi
jl 0x42bd2a
xor esi, esi
jmp 0x42c34d
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00402479
mov byte [esp + 0x910], 0x1b
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.00402479
lea eax, [esp + 0x1c]
push 0x433793
push eax
call fcn.00401580
pop ecx
pop ecx
test al, al
je 0x42c370
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x1c]
push eax
call fcn.0040213e
mov edx, dword [ebx + 0xe8]
push 0xa
xor eax, eax
lea edi, [edx + 0x88]
pop ecx
rep stosd dword es:[edi], eax
mov dword [edx + 0x7c], esi
cmp dword [esp + 0x38], esi
je 0x42c3b3
push 0x1000
push 0x436e1c
push str.There_was_a_error_during_extracting_process._Please_try_to_extract_files_manually._Click_OK_to_open_containing_folder
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push esi
push esi
push dword [0x442e9c]
push 0x436f14
jmp 0x42c3f6
mov eax, dword [ebx + 0xe8]
cmp dword [eax + 0x20], esi
je 0x42c427
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42c410
mov ecx, dword [ebx + 0xe8]
push 4
push 0x436f20
push str.Downloading_and_extracting_are_finished._Would_you_like_to_open_the_folder_with_downloaded_files_
call fcn.00406a1e
cmp eax, 6
jne 0x42c3fd
push 1
push esi
push esi
push dword [0x442e9c]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, dword [ebx + 0xe8]
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x8c]
jmp 0x42c427
mov ebx, dword [ebx + 0xe8]
push 0x10
push esi
push 0x401
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.00402479
lea edi, [esp + 0x78]
mov byte [esp + 0x910], 8
call fcn.00401924
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.00402479
mov ecx, dword [esp + 0x908]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f0]
xor ecx, esp
call fcn.00411d1d
mov esp, ebp
pop ebp
ret