Function at 0x4113d0
Capabilities:
Delete file
Set current directory

Disassembly:
push ebp
sub esp, 0x28c
lea ebp, [esp - 4]
mov eax, dword [0x46c054]
xor eax, ebp
mov dword [ebp + 0x28c], eax
push 0x60
mov eax, 0x441462
call fcn.004266a4
mov eax, dword [ebp + 0x298]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x2a0]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x50]
call fcn.00403913
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
mov byte [ebp - 0x12], 1
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x40], bl
push 0x444954
lea ecx, [ebp + 0x54]
call fcn.00405057
mov byte [ebp - 4], 1
mov esi, 0x4450ac
push esi
lea ecx, [ebp + 0x38]
call fcn.00408b46
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp + 0x1c]
call fcn.00408b46
mov byte [ebp - 4], 3
call dword [0x46b508]
mov byte [ebp - 4], 4
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.00413e68
push 0x29
push 0x28
lea eax, [ebp - 0x1c]
push eax
push 0x44ada4
push dword [ebp - 0x20]
call fcn.00414077
add esp, 0x20
test al, al
je 0x4114dd
push dword [ebp - 0x1c]
call fcn.00427e00
push eax
push 0x46d438
push dword [ebp - 0x1c]
call fcn.00412b25
add esp, 0x10
test al, al
je 0x4114ca
push dword [0x46d438]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [0x46d438]
push str.WinMain__WinMain__szWorkingFolder_from_service____s_
jmp 0x4114d2
push dword [ebp - 0x1c]
push str.WinMain__WinMain__Error_hex2char___s__
call fcn.00414978
pop ecx
pop ecx
mov byte [ebp - 0x13], 1
cmp dword [0x46d438], ebx
jne 0x411505
push 1
push ebx
push 0x46d438
call fcn.00412ef5
push dword [0x46d438]
push str.WinMain__WinMain__szWorkingFolder____s_
call fcn.00414978
add esp, 0x14
push 1
lea eax, [ebp + 0x8c]
push eax
push ebx
push ebx
call fcn.00412062
lea eax, [ebp + 0x8c]
push eax
push str.WinMain______s
call fcn.00414978
push dword [ebp - 0x20]
push str.WinMain__WinMain__szCmdLine___s_
call fcn.00414978
add esp, 0x20
push ebx
mov edi, 0x40f661
push edi
push 0x104
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call esi
push ebx
push edi
push 0xa
push dword [ebp - 0x24]
call esi
lea eax, [ebp - 0x50]
push eax
push str.PARAMS
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00413403
add esp, 0xc
cmp dword [ebp - 0x48], ebx
jne 0x41157e
push str.WinMain__WinMain__Error_extracting_params
jmp 0x411975
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x46d444
push 0x46d440
push 0x46d43c
push 0x46d434
push dword [ebp - 0x20]
lea eax, [ebp - 0x50]
push eax
call fcn.004100d5
push dword [0x46d444]
push dword [0x46d440]
push dword [0x46d43c]
push dword [0x46d434]
push str.WinMain__WinMain__Params_Loaded:_szLang__s__szURL__s__szCode__s__szOwner__s_
call fcn.00414978
add esp, 0x40
push dword [ebp - 0x44]
push dword [ebp - 0x18]
push str.WinMain__WinMain__Params_Loaded:_szScript__s__szTmp__s_
call fcn.00414978
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x40]
push eax
movzx eax, byte [ebp - 0x11]
push eax
push str.WinMain__WinMain__Params_Loaded:_bSelfDelete__i__bPrintScript__i__bElevation__i__bFromService__i_
call fcn.00414978
lea eax, [ebp + 0x54]
push eax
call fcn.00410915
add esp, 0x24
cmp dword [ebp - 0x18], ebx
je 0x411748
mov byte [ebp - 0x12], 1
cmp dword [0x46d43c], ebx
je 0x411970
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov esi, str.WinMain__WinMain__Extracting_proxy_data_from_command_line...
push esi
call fcn.00414978
push 0x29
push 0x28
lea eax, [ebp - 0x30]
push eax
push str.proxy
push dword [ebp - 0x20]
call fcn.00414077
push 0x29
push 0x28
lea eax, [ebp - 0x28]
push eax
push str.auth
push dword [ebp - 0x20]
call fcn.00414077
push esi
call fcn.00414978
add esp, 0x30
cmp dword [ebp - 0x30], ebx
je 0x411888
push dword [ebp - 0x30]
lea ecx, [ebp + 0x54]
call fcn.00404f6a
lea eax, [ebp - 0x30]
push eax
call fcn.00413de9
pop ecx
cmp dword [ebp - 0x28], ebx
je 0x41184c
push dword [ebp - 0x28]
call fcn.00427e00
pop ecx
test eax, eax
jbe 0x41184c
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
call fcn.00412a56
pop ecx
pop ecx
cmp dword [ebp - 0x2c], ebx
je 0x411842
push dword [ebp - 0x2c]
lea ecx, [ebp + 0x70]
call fcn.00408b46
mov byte [ebp - 4], 5
push ebx
push 0x4450a8
lea ecx, [ebp + 0x70]
call fcn.0040a631
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x411817
push esi
push ebx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 0x70]
call fcn.0040a8a4
mov byte [ebp - 4], 6
push edi
push ebx
push eax
lea ecx, [ebp + 0x38]
call fcn.004088b5
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.00408542
push edi
inc esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 0x70]
call fcn.0040a8a4
mov byte [ebp - 4], 7
push edi
push ebx
push eax
lea ecx, [ebp + 0x1c]
call fcn.004088b5
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.00408542
jmp 0x411833
push str.WinMain__WinMain__Getting_script...
call fcn.00414978
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11]
push eax
call fcn.004109bd
push dword [ebp - 0x18]
push str.WinMain__WinMain__script_:__s
call fcn.00414978
add esp, 0x2c
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x411792
mov eax, 0x444954
push eax
push str.WinMain__WinMain__error_:__s
call fcn.00414978
push dword [ebp - 0x38]
push str.WinMain__WinMain__szRCMode_:__s
call fcn.00414978
push dword [ebp - 0x3c]
push str.WinMain__WinMain__szTicket_:__s
call fcn.00414978
add esp, 0x18
cmp dword [ebp - 0x38], ebx
je 0x41161e
push 0x44aac8
push dword [ebp - 0x38]
call fcn.00428e10
pop ecx
pop ecx
test eax, eax
jne 0x41161e
call fcn.00412d7e
cmp eax, 0x50
jl 0x41161e
push str.scrRC.tmp
push dword [ebp - 0x18]
call fcn.0040f9f1
push str.WinMain__WinMain__Elevating...
call fcn.00414978
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x12]
push eax
push dword [ebp - 0x24]
call fcn.00410618
add esp, 0x18
jmp 0x411992
cmp dword [ebp + 0x88], 8
mov eax, dword [ebp + 0x74]
jae 0x411826
lea eax, [ebp + 0x74]
push eax
push str.WinMain_GetProxyAuth__could_not_decrypt_auth___ws_
call fcn.00414978
pop ecx
pop ecx
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp + 0x70]
call fcn.00408542
lea eax, [ebp - 0x2c]
push eax
call fcn.00413de9
pop ecx
cmp dword [ebp + 0x34], 8
mov edx, dword [ebp + 0x20]
jae 0x411858
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x50], 8
mov ecx, dword [ebp + 0x3c]
jae 0x411864
lea ecx, [ebp + 0x3c]
cmp dword [ebp + 0x6c], 0x10
mov eax, dword [ebp + 0x58]
jae 0x411870
lea eax, [ebp + 0x58]
push edx
push ecx
push eax
push dword [0x46d43c]
push str.WinMain__WinMain__szURL___s__proxy___s__auth_ws:_ws
call fcn.00414978
add esp, 0x14
jmp 0x411893
push str.WinMain__WinMain__No_proxy_data_in_command_line...
call fcn.00414978
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x411969
push 0x444954
lea ecx, [ebp + 0x70]
call fcn.00405057
mov byte [ebp - 4], 8
push dword [ebp - 0x18]
lea ecx, [ebp]
call fcn.00405057
mov byte [ebp - 4], 9
push str.WinMain__WinMain__Executing_script...
call fcn.00414978
pop ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6c]
call fcn.00405057
mov byte [ebp - 4], 0xa
lea eax, [ebp + 0x70]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x24]
call fcn.00410f8d
add esp, 0x24
mov byte [ebp - 4], 9
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.004049a0
cmp dword [ebp + 0x84], ebx
jbe 0x411949
cmp dword [ebp + 0x88], 0x10
mov eax, dword [ebp + 0x74]
jae 0x411926
lea eax, [ebp + 0x74]
push eax
push str.WinMain__WinMain__ShowQuest__s_
call fcn.00414978
pop ecx
pop ecx
cmp dword [ebp + 0x88], 0x10
mov eax, dword [ebp + 0x74]
jae 0x411942
lea eax, [ebp + 0x74]
push eax
call fcn.004107c4
pop ecx
mov byte [ebp - 4], 8
push ebx
push 1
lea ecx, [ebp]
call fcn.004049a0
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp + 0x70]
call fcn.004049a0
jmp 0x41197b
push str.WinMain__WinMain_Could_not_retrieve_script
jmp 0x411975
push str.WinMain__WinMain_szURL_Error...
call fcn.00414978
pop ecx
push str.WinMain__WinMain__Deleting_files...
call fcn.00414978
mov dword [esp], 0x44a184
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.WinMain__WinMain__Cleanning_up
call fcn.00414978
mov dword [esp], 0x46d434
call fcn.00413de9
mov dword [esp], 0x46d43c
call fcn.00413de9
mov dword [esp], 0x46d440
call fcn.00413de9
mov dword [esp], 0x46d444
call fcn.00413de9
lea eax, [ebp - 0x18]
push eax
call fcn.00413de9
lea eax, [ebp - 0x20]
push eax
call fcn.00413de9
lea eax, [ebp - 0x44]
push eax
call fcn.00413de9
lea eax, [ebp - 0x3c]
push eax
call fcn.00413de9
lea eax, [ebp - 0x1c]
push eax
call fcn.00413de9
add esp, 0x18
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xc
jge 0x411a1b
mov eax, dword [ebp - 0x34]
lea eax, [eax*4 + 0x46d454]
push eax
call fcn.00413de9
pop ecx
inc dword [ebp - 0x34]
jmp 0x4119ff
mov eax, dword [0x46d450]
cmp eax, ebx
je 0x411a2b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x46d450], ebx
cmp byte [ebp - 0x11], bl
je 0x411a4d
push str.WinMain__WinMain_SelfDelete
call fcn.00414978
push dword [0x46d438]
call fcn.0040f750
pop ecx
pop ecx
push 0x46d438
call fcn.00413de9
mov dword [esp], str.WinMain____
call fcn.00414978
pop ecx
mov dword [ebp - 4], 3
jmp 0x411a88
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.00408542
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.00408542
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.004049a0
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x50]
call fcn.00427f66
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x28c]
xor ecx, ebp
call fcn.00425c6b
add ebp, 0x290
leave
ret 0x10