Function at 0x40167c
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x284]
sub esp, 0x2cc
mov eax, dword [0x473cc4]
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x27c]
mov ebx, dword [ebp - 0x280]
mov edx, eax
mov esi, ebx
shl edx, 0xe
add edx, dword [0x40b9c8]
shl esi, 0xe
add esi, dword [0x40b9c8]
mov dword [ebp - 0x29c], edx
lea edx, [ebp - 0x280]
mov dword [0x41305c], edx
mov edx, dword [ebp - 0x284]
lea ecx, [edx - 2]
cmp ecx, 0x43
ja case.0x4016e9.65
jmp dword [ecx*4 + 0x40b008]
mov dword [esp + 4], 0
mov dword [esp], ebx
jmp 0x401cdd
inc dword [0x47bd00]
cmp dword [ebp - 0x2a0], 0
mov ebx, 0x7fffffff
je case.0x4016e9.2
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push eax
jmp case.0x4016e9.2
mov dword [esp], ebx
call fcn.0040163b
push esi
dec eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040396e
mov ebx, eax
push edi
push edi
jmp case.0x4016e9.2
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.00407147
jmp 0x4038fd
xor eax, eax
call fcn.0040146e
mov edx, 1
test eax, eax
cmovle eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402188
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x402188
cmp dword [ebp - 0x278], 0
jne 0x4017b9
mov eax, dword [ebx*4 + 0x473bb8]
mov dword [ebx*4 + 0x473b80], eax
mov eax, 1
call fcn.0040146e
jmp 0x4017c0
mov eax, dword [ebx*4 + 0x473b80]
mov dword [ebx*4 + 0x473bb8], eax
jmp case.0x4016e9.65
mov edx, dword [ebp - 0x278]
xor ecx, ecx
mov eax, dword [edx*4 + 0x473bb8]
test eax, eax
sete cl
and eax, dword [ebp - 0x274]
mov ebx, dword [ebp + ecx*4 - 0x280]
mov dword [edx*4 + 0x473bb8], eax
jmp case.0x4016e9.2
mov eax, dword [eax*4 + 0x473bb8]
jmp 0x4026e6
mov edx, dword [0x47bd04]
test edx, edx
je 0x40181e
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
mov eax, dword [0x47bd08]
test eax, eax
je case.0x4016e9.65
mov edx, dword [ebp - 0x280]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x402541
mov dword [esp], 0xfffffff0
call fcn.00401418
mov edx, dword [ebp - 0x27c]
push ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x401b0f
mov dword [esp], 0xfffffff0
call fcn.00401418
push edi
mov ebx, eax
xor edi, edi
mov dword [esp], eax
call fcn.00407ad3
push edx
test eax, eax
je 0x401910
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call fcn.00407a2d
push esi
push esi
mov esi, eax
mov ax, word [eax]
mov word [esi], 0
test ax, ax
mov word [ebp - 0x29c], ax
jne 0x4018cd
cmp dword [ebp - 0x278], 0
je 0x4018cd
call fcn.00408c2c
test eax, eax
je 0x4018cd
mov dword [esp], ebx
call fcn.00407838
test eax, eax
push ecx
jne 0x4018da
jmp 0x40190b
mov dword [esp], ebx
call fcn.004078d3
test eax, eax
push edx
je 0x4018f7
cmp eax, 0xb7
je 0x4018e4
inc edi
jmp 0x4018f7
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
push ecx
cmp eax, 1
adc edi, 0
mov ecx, dword [ebp - 0x29c]
lea eax, [esi + 2]
mov word [esi], cx
test cx, cx
jmp 0x40187e
mov word [esi], 0
cmp dword [ebp - 0x27c], 0
je 0x401953
mov dword [esp], 0xffffffe6
call fcn.0040165d
mov eax, dword [0x40b9c8]
push esi
mov dword [esp + 4], ebx
add eax, 0x58000
mov dword [esp], eax
call fcn.00408063
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, 1
push edx
adc edi, 0
jmp 0x40395a
mov dword [esp], 0xfffffff5
jmp 0x4037b8
mov dword [esp], 0
call fcn.00401418
push ecx
mov dword [esp], eax
call fcn.004087bc
jmp 0x402333
mov dword [esp], 0xffffffd0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0xffffffdf
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 0x13
call fcn.00401418
push edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
push edx
push edx
je 0x4019c3
mov dword [esp], 0xffffffe3
jmp 0x402b83
cmp dword [ebp - 0x278], 0
je 0x4035ba
mov dword [esp], ebx
call fcn.004087bc
test eax, eax
push edi
je 0x4035ba
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00408777
push ebx
push ebx
mov dword [esp], 0xffffffe4
jmp 0x402b83
mov dword [esp], 0
call fcn.00401418
mov ebx, eax
push ecx
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 4], 0x2000
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
sub esp, 0x10
test eax, eax
je 0x401a6e
mov eax, dword [ebp - 0x268]
xor edi, edi
cmp eax, ebx
jbe 0x401a7e
cmp word [eax], 0
je 0x401a7e
mov dword [esp], ebx
call fcn.004087bc
test eax, eax
push edx
je 0x401a6e
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call fcn.00408063
push esi
push esi
jmp 0x401a7e
mov eax, dword [ebp - 0x29c]
mov edi, 1
mov word [eax], 0
cmp dword [ebp - 0x278], 0
jne 0x40395a
mov eax, dword [ebp - 0x29c]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub esp, 0xc
jmp 0x40395a
mov dword [esp], 0xffffffff
xor edi, edi
call fcn.00401418
lea edx, [ebp - 0x268]
push ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x2000
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
sub esp, 0x18
test eax, eax
jmp 0x402d74
mov dword [esp], 0xffffffef
call fcn.00401418
push ecx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00407cf0
push edx
push edx
jmp 0x402d07
mov dword [esp], 0x31
call fcn.00401418
push ebx
mov ebx, dword [ebp - 0x280]
mov esi, eax
mov dword [esp], eax
call fcn.00407a9a
and ebx, 7
test eax, eax
push edi
je 0x401b4d
mov dword [esp + 4], esi
mov dword [esp], 0x413080
call fcn.00408063
jmp 0x401b7e
mov eax, dword [0x40b9c8]
mov dword [esp], 0x413080
add eax, 0x58000
mov dword [esp + 4], eax
call fcn.00408063
push edx
push edx
mov dword [esp], eax
call fcn.004080a1
push ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00408096
push edi
push edi
mov dword [esp], 0x413080
call fcn.004080ea
cmp ebx, 2
push eax
jle 0x401bd0
mov dword [esp], 0x413080
call fcn.004087bc
mov edx, eax
xor eax, eax
push ecx
test edx, edx
je 0x401bbf
lea eax, [ebp - 0x274]
add edx, 0x14
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push edx
push edx
sub ebx, 3
or ebx, 0x80000000
test eax, ebx
sete bl
movzx ebx, bl
test ebx, ebx
jne 0x401be8
mov dword [esp], 0x413080
call fcn.00407bf5
mov eax, 2
push edi
jmp 0x401bf1
xor eax, eax
cmp ebx, 1
setne al
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x413080
call fcn.00407c94
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
jne 0x401cee
test ebx, ebx
je 0x401c3d
mov dword [esp + 4], esi
mov dword [esp], 0xffffffe2
call fcn.00407147
push ecx
push ecx
cmp ebx, 2
sete al
movzx eax, al
mov edi, eax
jmp 0x40395a
mov eax, dword [0x40b9c8]
mov dword [esp], 0x41b080
mov dword [esp + 4], eax
call fcn.00408063
push eax
push eax
mov eax, dword [0x40b9c8]
mov dword [esp + 4], 0x413080
mov dword [esp], eax
call fcn.00408063
push eax
push eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], 0x417080
mov dword [esp + 4], eax
call fcn.004081cb
push eax
push eax
mov eax, dword [0x40b9c8]
mov dword [esp + 4], 0x41b080
mov dword [esp], eax
call fcn.00408063
push eax
push eax
mov eax, dword [ebp - 0x280]
mov dword [esp], 0x417080
sar eax, 3
mov dword [esp + 4], eax
call fcn.004079bf
cmp eax, 4
push edx
push edx
je 0x401bd4
cmp eax, 5
jne 0x401cce
inc dword [0x473bc0]
jmp 0x403960
mov dword [esp + 4], 0x413080
mov dword [esp], 0xfffffffa
call fcn.00407147
mov ebx, 0x7fffffff
push eax
push eax
jmp case.0x4016e9.2
mov dword [esp + 4], esi
mov dword [esp], 0xffffffea
call fcn.00407147
push eax
push eax
mov eax, dword [ebp - 0x278]
inc dword [0x473bec]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00403c01
dec dword [0x473bec]
sub esp, 0x10
cmp dword [ebp - 0x274], 0xffffffff
mov ebx, eax
jne 0x401d45
cmp dword [ebp - 0x270], 0xffffffff
je 0x401d67
lea eax, [ebp - 0x274]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
push edi
jns case.0x4016e9.65
cmp ebx, 0xfffffffe
jne 0x401da6
mov dword [esp + 4], 0xffffffe9
mov dword [esp], 0x413080
call fcn.004081cb
push ebx
push ebx
mov dword [esp + 4], esi
mov dword [esp], 0x413080
call fcn.00408096
jmp 0x401dba
mov dword [esp + 4], 0xffffffee
mov dword [esp], 0x413080
call fcn.004081cb
push ecx
push ecx
mov dword [esp + 4], 0x200010
mov dword [esp], 0x413080
jmp 0x402111
mov dword [esp], 0
jmp 0x401e2c
mov dword [esp], 0x31
call fcn.00401418
mov edx, dword [ebp - 0x280]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004079bf
test eax, eax
push edx
push edx
je 0x4035ba
cmp eax, dword [ebp - 0x278]
je 0x401fda
cmp eax, dword [ebp - 0x270]
jne case.0x4016e9.65
mov ebx, dword [ebp - 0x26c]
jmp case.0x4016e9.2
mov dword [esp], 0xfffffff0
call fcn.00401418
mov edx, dword [ebp - 0x27c]
push esi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004088b6
jmp 0x4038fd
mov dword [esp], 1
call fcn.00401418
push ebx
mov dword [esp], eax
call fcn.0040808b
jmp 0x402518
mov eax, 2
call fcn.0040146e
mov edi, eax
mov eax, 3
mov ebx, edx
call fcn.0040146e
mov dword [esp], 1
mov dword [ebp - 0x29c], eax
call fcn.00401418
push edx
mov dword [ebp - 0x2a0], eax
mov dword [esp], eax
call fcn.0040808b
test ebx, ebx
push ecx
mov edx, dword [ebp - 0x2a0]
cmove edi, eax
mov word [esi], 0
test edi, edi
je case.0x4016e9.65
mov ebx, dword [ebp - 0x29c]
test ebx, ebx
jns 0x401ec7
add ebx, eax
js case.0x4016e9.65
cmp ebx, eax
mov dword [esp], esi
cmovg ebx, eax
add ebx, ebx
add edx, ebx
mov dword [esp + 4], edx
call fcn.00408063
test edi, edi
push ecx
push ecx
jns 0x401eef
mov dword [esp], esi
call fcn.0040808b
add edi, eax
push edx
js 0x401efd
cmp edi, 0x1fff
jg case.0x4016e9.65
jmp 0x401eff
xor edi, edi
mov word [esi + edi*2], 0
jmp case.0x4016e9.65
mov dword [esp], 0x20
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401418
cmp dword [ebp - 0x270], 0
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x401f3e
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x401f44
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
push edx
push edx
jne 0x401fda
jmp 0x402343
mov dword [esp], 1
call fcn.00401418
push edi
mov ebx, eax
mov dword [esp + 8], 0x2000
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
test eax, eax
jne 0x401f8a
mov word [esi], 0
mov edi, 1
jmp 0x401fac
cmp dword [ebp - 0x278], 0
jne 0x401f97
xor edi, edi
jmp 0x401fac
mov dword [esp], ebx
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
push ebx
push ebx
je 0x401f7e
jmp 0x401f93
mov word [esi + 0x3ffe], 0
jmp 0x40395a
xor eax, eax
call fcn.0040146e
mov ebx, eax
mov eax, 1
call fcn.0040146e
cmp dword [ebp - 0x26c], 0
jne 0x401ff6
cmp ebx, eax
jge 0x401fe5
mov ebx, dword [ebp - 0x274]
jmp case.0x4016e9.2
jle 0x402343
mov ebx, dword [ebp - 0x270]
jmp case.0x4016e9.2
cmp ebx, eax
jb 0x401fda
ja 0x401feb
jmp 0x402343
mov eax, 1
xor edi, edi
call fcn.0040146e
mov ebx, eax
mov eax, 2
call fcn.0040146e
cmp dword [ebp - 0x274], 0xc
mov ecx, eax
ja case.default.0x40202a
mov eax, dword [ebp - 0x274]
jmp dword [eax*4 + 0x40b118]
add ebx, ecx
jmp 0x40208c
sub ebx, ecx
jmp 0x40208c
imul ebx, ecx
jmp 0x40208c
test ecx, ecx
je 0x402090
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
jmp 0x40208c
or ebx, ecx
jmp 0x40208c
and ebx, ecx
jmp 0x40208c
xor ebx, ecx
jmp 0x40208c
test ebx, ebx
sete bl
jmp 0x402063
or ecx, ebx
setne bl
movzx ebx, bl
jmp 0x40208c
test ecx, ecx
setne al
test ebx, ebx
setne bl
movzx ebx, bl
and ebx, eax
jmp 0x40208c
test ecx, ecx
je 0x402090
mov eax, ebx
cdq
idiv ecx
mov ebx, edx
jmp 0x40208c
shl ebx, cl
jmp 0x40208c
sar ebx, cl
xor edi, edi
jmp case.default.0x40202a
xor ebx, ebx
mov edi, 1
mov dword [esp + 4], ebx
jmp 0x402314
mov dword [esp], 1
call fcn.00401418
push ecx
mov ebx, eax
mov eax, 2
call fcn.0040146e
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_wsprintfW]
jmp case.0x4016e9.65
mov edx, dword [ebp - 0x278]
mov ebx, dword [0x427080]
test edx, edx
je 0x40215b
mov eax, edx
dec eax
test ebx, ebx
je 0x4020f0
test eax, eax
mov ebx, dword [ebx]
jne 0x4020e1
test ebx, ebx
jne 0x40211b
mov dword [esp + 4], 0xffffffe8
mov dword [esp], 0
call fcn.004081cb
push edx
push edx
mov dword [esp + 4], 0x200010
mov dword [esp], eax
call fcn.004079bf
jmp 0x401ce2
add ebx, 4
mov dword [esp], 0x413080
mov dword [esp + 4], ebx
call fcn.00408063
push eax
push eax
mov eax, dword [0x427080]
mov dword [esp], ebx
add eax, 4
mov dword [esp + 4], eax
call fcn.00408063
push eax
push eax
mov eax, dword [0x427080]
mov dword [esp + 4], 0x413080
add eax, 4
jmp 0x403804
test eax, eax
je 0x40218e
test ebx, ebx
je 0x4035ba
lea eax, [ebx + 4]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00408063
push eax
push eax
mov eax, dword [ebx]
mov dword [esp], ebx
mov dword [0x427080], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
jmp case.0x4016e9.65
mov dword [esp + 4], 0x4004
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x280]
push ecx
push ecx
mov dword [esp + 4], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.004081cb
mov eax, dword [0x427080]
push esi
push esi
mov dword [ebx], eax
mov dword [0x427080], ebx
jmp case.0x4016e9.65
mov eax, 3
call fcn.0040146e
mov ebx, eax
mov eax, 4
call fcn.0040146e
test byte [ebp - 0x26c], 1
mov edi, eax
je 0x402200
mov dword [esp], 0x33
call fcn.00401418
push edx
mov ebx, eax
test byte [ebp - 0x26c], 2
je 0x402218
mov dword [esp], 0x44
call fcn.00401418
push edi
mov edi, eax
cmp dword [ebp - 0x284], 0x21
jne 0x4022a7
mov eax, 1
call fcn.0040146e
mov dword [ebp - 0x29c], eax
mov eax, 2
call fcn.0040146e
mov ecx, dword [ebp - 0x26c]
sar ecx, 2
je 0x40228a
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
lea edx, [ebp - 0x268]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
sub esp, 0x1c
test eax, eax
sete al
movzx eax, al
mov edi, eax
jmp 0x4022fd
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4022f2
mov dword [esp], 1
call fcn.00401418
push edx
mov dword [ebp - 0x29c], eax
mov dword [esp], 0x12
call fcn.00401418
push ecx
xor ecx, ecx
cmp word [eax], 0
mov edx, dword [ebp - 0x29c]
cmove eax, ecx
cmp word [edx], 0
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], ebx
cmove edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_FindWindowExW]
sub esp, 0x10
mov dword [ebp - 0x268], eax
xor edi, edi
cmp dword [ebp - 0x280], 0
js 0x40395a
mov eax, dword [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00407f88
push esi
push esi
jmp 0x40395a
xor eax, eax
call fcn.0040146e
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
push ebx
je 0x402343
mov ebx, dword [ebp - 0x27c]
jmp case.0x4016e9.2
mov ebx, dword [ebp - 0x278]
jmp case.0x4016e9.2
mov eax, 2
call fcn.0040146e
mov ebx, eax
mov eax, 1
call fcn.0040146e
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ecx
push ecx
jmp 0x4026e6
add eax, dword [0x473c68]
mov ebx, eax
xor eax, eax
call fcn.0040146e
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x403955
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edx
lea eax, [ebp - 0x268]
push edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x278]
mov edi, dword [ebp - 0x25c]
push ecx
push ecx
imul edi, edx
mov dword [esp], 0
imul edx, dword [ebp - 0x260]
mov ebx, edx
call fcn.00401418
push edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadImageW]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x172
mov dword [esp], esi
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
je case.0x4016e9.65
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x402188
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push ecx
mov ebx, eax
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push edi
mov edi, eax
mov eax, 2
call fcn.0040146e
mov dword [esp + 8], 0x48
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
sub esp, 0xc
mov dword [section..bss], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push eax
push eax
mov eax, 3
call fcn.0040146e
mov dword [0x413010], eax
mov eax, dword [ebp - 0x270]
mov dword [esp], 0x41301c
mov byte [0x413017], 1
mov dl, al
and edx, 1
mov byte [0x413014], dl
mov dl, al
and eax, 4
mov byte [0x413016], al
mov eax, dword [ebp - 0x27c]
and edx, 2
mov byte [0x413015], dl
mov dword [esp + 4], eax
call fcn.004081cb
push eax
push eax
mov dword [esp], section..bss
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push edx
jmp 0x4026e6
xor eax, eax
call fcn.0040146e
mov ebx, eax
mov eax, 1
call fcn.0040146e
cmp dword [ebp - 0x274], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x40254c
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4038fd
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4038fd
mov dword [esp], 0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401418
push ecx
mov edi, eax
mov dword [esp], 0x22
call fcn.00401418
push esi
mov esi, eax
mov dword [esp], 0x15
call fcn.00401418
push eax
mov dword [esp], 0xffffffec
call fcn.0040165d
push eax
mov eax, dword [0x40b9c8]
lea edx, [eax + 0x58000]
xor eax, eax
cmp word [esi], 0
cmove esi, eax
cmp word [ebx], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
cmove ebx, eax
mov eax, dword [ebp - 0x274]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
cmp eax, 0x20
setle al
jmp 0x401c33
mov dword [esp], 0
call fcn.00401418
push ebx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0xffffffeb
call fcn.00407147
push esi
push esi
mov dword [esp], ebx
call fcn.00407901
test eax, eax
push edi
mov ebx, eax
je 0x4035ba
cmp dword [ebp - 0x278], 0
je 0x402690
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], 0x64
mov dword [esp], ebx
call esi
cmp eax, 0x102
push edx
push edx
jne 0x402658
mov dword [esp], 0xf
call fcn.00408c52
push ecx
jmp 0x402633
lea eax, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x27c], 0
push edi
push edi
js 0x402694
mov eax, dword [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407f88
push esi
push esi
xor edi, edi
jmp 0x4026a2
xor eax, eax
cmp dword [ebp - 0x268], 0
setne al
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4037bd
mov dword [esp], 2
call fcn.00401418
push edx
mov dword [esp], eax
call fcn.004087bc
test eax, eax
push ecx
mov ebx, eax
je 0x4026f2
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407f88
push edi
push edi
mov eax, dword [ebx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], esi
jmp 0x40352c
mov eax, dword [ebp - 0x29c]
mov word [esi], 0
mov word [eax], 0
jmp 0x4035ba
mov dword [esp], 0xffffffee
call fcn.00401418
push edi
mov dword [ebp - 0x2a0], eax
mov dword [esp], 8
call fcn.00408bda
mov ecx, dword [ebp - 0x2a0]
push edx
lea edx, [ebp - 0x28c]
mov dword [esp + 4], edx
mov dword [esp], ecx
call eax
mov edi, eax
mov eax, dword [ebp - 0x29c]
push ecx
test edi, edi
push ecx
mov word [esi], 0
mov word [eax], 0
je 0x4035ba
mov dword [esp + 4], edi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
push ebx
push ebx
mov ebx, eax
je 0x4035ba
mov dword [esp], 9
call fcn.00408bda
push edx
mov dword [ebp - 0x2a4], eax
mov dword [esp], 0xa
call fcn.00408bda
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a0]
push ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x2a4]
sub esp, 0x10
test eax, eax
jne 0x4027c8
mov edi, 1
jmp 0x40282a
lea eax, [ebp - 0x268]
mov dword [esp + 4], 0x40b000
mov dword [esp], ebx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x288]
mov dword [esp + 8], eax
call dword [ebp - 0x2a8]
sub esp, 0x10
test eax, eax
je 0x4027c1
mov eax, dword [ebp - 0x288]
mov eax, dword [eax + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00407f88
mov eax, dword [ebp - 0x288]
push edi
push edi
xor edi, edi
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407f88
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4037bd
cmp dword [0x473bf0], 0
js 0x402958
mov dword [esp], 0xfffffff0
call fcn.00401418
push ebx
mov edi, eax
mov dword [esp], 1
call fcn.00401418
cmp dword [ebp - 0x270], 0
push esi
mov esi, eax
jne 0x402894
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x40294c
jmp 0x4028a4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
push ecx
mov ebx, eax
je 0x40286c
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00408ca1
test eax, eax
push edx
mov edi, eax
push edx
je 0x402909
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x4028d9
mov dword [esp], eax
call fcn.0040165d
push eax
call edi
test eax, eax
setne al
movzx eax, al
mov edi, eax
jmp 0x402920
mov eax, dword [0x40b9c8]
mov dword [esp + 0x10], 0x40a000
mov dword [esp + 0xc], 0x427080
mov dword [esp + 4], 0x2000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call edi
xor edi, edi
jmp 0x402920
mov dword [esp + 4], esi
mov dword [esp], 0xfffffff7
mov edi, 1
call fcn.00407147
push esi
push esi
cmp dword [ebp - 0x274], 0
jne 0x40395a
mov dword [esp], ebx
call fcn.00404a9f
test eax, eax
push ecx
je 0x40395a
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4037bd
mov dword [esp], 0xfffffff6
jmp 0x402a1c
mov dword [esp], 0xffffffe7
jmp 0x402a1c
mov dword [esp], 0xfffffff0
call fcn.00401418
push esi
mov dword [ebp - 0x2a0], eax
mov dword [esp], 0xffffffdf
call fcn.00401418
push edi
mov esi, eax
mov dword [esp], 2
call fcn.00401418
push edx
mov dword [ebp - 0x2a4], eax
mov dword [esp], 0xffffffcd
call fcn.00401418
push ecx
mov dword [ebp - 0x29c], eax
mov dword [esp], 0x45
call fcn.00401418
push ebx
mov dword [ebp - 0x2a8], eax
mov edi, dword [ebp - 0x270]
mov dword [esp], esi
call fcn.00407a9a
test eax, eax
push edx
jne 0x4029df
mov dword [esp], 0x21
call fcn.00401418
push ebx
lea eax, [ebp - 0x288]
mov dword [esp + 0xc], 0x410e40
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40ca30
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jns 0x402a27
mov dword [esp], 0xfffffff0
call fcn.0040165d
push ecx
jmp 0x4035ba
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x268]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4104c0
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov ebx, eax
js 0x402b65
mov eax, dword [ebp - 0x288]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x50]
test edi, 0x8000
push edx
mov ebx, eax
push edx
jne 0x402a91
mov eax, dword [ebp - 0x288]
mov ecx, dword [0x40b9c8]
mov edx, dword [eax]
add ecx, 0x58000
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x24]
push eax
push eax
mov eax, edi
sar eax, 0xc
and eax, 7
je 0x402aaf
mov edx, dword [ebp - 0x288]
mov ecx, dword [edx]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x3c]
push eax
push eax
mov eax, dword [ebp - 0x288]
mov ecx, edi
shr ecx, 0x10
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x34]
push eax
push eax
mov eax, dword [ebp - 0x29c]
cmp word [eax], 0
je 0x402af9
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x29c]
and edi, 0xfff
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x288]
push edi
mov ecx, dword [ebp - 0x2a8]
push edi
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x1c]
test ebx, ebx
push eax
push eax
js 0x402b56
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x268]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0x288]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
test ebx, ebx
push ecx
js 0x402a15
mov dword [esp], 0xfffffff4
call fcn.0040165d
jmp 0x402188
mov dword [esp], 0
call fcn.00401418
push edx
mov ebx, eax
mov dword [esp], 0x11
call fcn.00401418
push ecx
mov esi, eax
mov dword [esp], 0x23
call fcn.00401418
push edi
mov edi, eax
mov dword [esp], ebx
call fcn.004087bc
test eax, eax
push edx
jne 0x402be2
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00407147
push edi
push edi
jmp 0x4035ba
mov eax, dword [ebp - 0x2a0]
mov dword [esp], ebx
mov dword [ebp - 0x264], 2
mov dword [ebp - 0x268], eax
call fcn.0040808b
push edx
mov word [ebx + eax*2 + 2], 0
mov dword [esp], esi
call fcn.0040808b
push ecx
mov word [esi + eax*2 + 2], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x260], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x24e], edi
xor edi, edi
mov word [ebp - 0x258], ax
call fcn.00407147
lea eax, [ebp - 0x268]
push ebx
push ebx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
push esi
je 0x40395a
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00407147
push ecx
push ecx
mov di, 1
jmp 0x40395a
cmp ebx, 0xbadf00d
jne 0x4020f0
inc dword [0x473bcc]
jmp case.0x4016e9.65
xor esi, esi
test ebx, ebx
je 0x402cae
mov dword [esp], 0
call fcn.00401418
push edx
mov esi, eax
xor edi, edi
cmp dword [ebp - 0x27c], 0
je 0x402cc8
mov dword [esp], 0x11
call fcn.00401418
push edi
mov edi, eax
xor ebx, ebx
cmp dword [ebp - 0x270], 0
je 0x402ce2
mov dword [esp], 0x22
call fcn.00401418
push ebx
mov ebx, eax
mov dword [esp], 0xffffffcd
call fcn.00401418
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
sub esp, 0x10
test eax, eax
jmp 0x401c30
mov eax, dword [0x40b004]
mov dword [esp], 1
mov dword [ebp - 0x268], eax
call fcn.00401418
push ecx
mov ebx, eax
mov dword [esp], 0x12
call fcn.00401418
push edi
mov edi, eax
mov dword [esp], 0xffffffdd
call fcn.00401418
push edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0x1fff
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub esp, 0x18
cmp word [esi], 0xa
jne 0x40395a
mov word [esi], 0
jmp 0x402c79
cmp dword [ebp - 0x270], 0
jne 0x402dce
mov dword [esp], 2
call fcn.004015d1
test eax, eax
push edx
mov ebx, eax
je 0x4035ba
mov dword [esp], 0x33
call fcn.00401418
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
push edi
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x402e0f
mov dword [esp], 0x22
call fcn.00401418
mov edx, dword [ebp - 0x27c]
push ecx
mov ecx, dword [ebp - 0x270]
and ecx, 2
test edx, edx
jne 0x402dfa
mov esi, dword [0x473bbc]
lea edx, [esi - 0x7fffffff]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004014a3
sub esp, 0xc
mov esi, eax
test esi, esi
setne al
jmp 0x401c33
test ebx, ebx
mov edi, ebx
jne 0x402e2a
mov eax, dword [0x473bbc]
lea edi, [eax - 0x7fffffff]
mov eax, dword [ebp - 0x26c]
mov dword [esp], 2
mov ebx, dword [ebp - 0x270]
mov dword [ebp - 0x29c], eax
call fcn.00401418
push esi
mov esi, eax
mov dword [esp], 0x11
call fcn.00401418
push edx
lea edx, [ebp - 0x268]
mov dword [esp + 0x1c], edx
mov edx, dword [0x473be8]
mov dword [esp], edi
mov dword [esp + 0x20], 0
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
or edx, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
jne 0x40395a
cmp ebx, 1
jne 0x402ed9
mov dword [esp], 0x23
call fcn.00401418
push ecx
mov dword [esp], 0x41b080
call fcn.0040808b
lea eax, [eax + eax + 2]
push ebx
jmp 0x402f24
cmp ebx, 4
jne 0x402ef4
mov eax, 3
call fcn.0040146e
mov dword [0x41b080], eax
mov eax, 4
jmp 0x402f24
xor eax, eax
cmp ebx, 3
jne 0x402f24
mov eax, dword [ebp - 0x274]
mov dword [esp + 0xc], 0xc000
mov dword [esp + 8], 0x41b080
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403c01
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 0x10], 0x41b080
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
setne al
movzx eax, al
mov edi, eax
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
jmp 0x40302f
mov dword [esp], 0x20019
call fcn.004015d1
push edi
mov ebx, eax
mov dword [esp], 0x33
call fcn.00401418
test ebx, ebx
push edx
mov word [esi], 0
je 0x4035ba
lea edx, [ebp - 0x288]
mov dword [ebp - 0x288], 0x4000
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x402fec
mov eax, dword [ebp - 0x268]
cmp eax, 1
je 0x402ff8
cmp eax, 4
je 0x402ff8
cmp eax, 2
je 0x40301d
mov word [esi], 0
mov edi, 1
jmp 0x40302c
cmp eax, 4
jne 0x40301d
xor eax, eax
cmp dword [ebp - 0x270], 0
sete al
mov edi, eax
mov eax, dword [esi]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00407f88
push esi
push esi
jmp 0x40302c
mov edi, dword [ebp - 0x270]
mov word [esi + 0x3ffe], 0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4037bd
mov dword [esp], 0x20019
call fcn.004015d1
push ebx
mov ebx, eax
mov eax, 3
call fcn.0040146e
test ebx, ebx
mov edx, eax
mov word [esi], 0
je 0x4035ba
cmp dword [ebp - 0x270], 0
mov dword [ebp - 0x268], 0x1fff
je 0x403093
mov dword [esp + 0xc], 0x1fff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
sub esp, 0x10
jmp 0x4030d9
lea eax, [ebp - 0x268]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
jne 0x4035ba
mov word [esi + 0x3ffe], 0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402188
mov dword [esp], esi
call fcn.00407fad
test eax, eax
push ecx
je case.0x4016e9.65
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402188
mov dword [esp], 0xffffffed
call fcn.00401418
push edx
mov edx, dword [ebp - 0x278]
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x27c]
mov dword [esp + 4], edx
call fcn.00407c94
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x4026e6
jmp 0x4035b5
mov eax, dword [ebp - 0x278]
cmp edx, 0x38
sete bl
test eax, eax
mov dword [ebp - 0x29c], eax
je 0x40317f
mov edi, ebx
mov eax, 1
shl edi, 0x1f
sar edi, 0x1f
call fcn.0040146e
add edi, 2
mov word [0x417080], ax
jmp 0x403203
test bl, bl
je 0x4031ea
mov dword [esp], 0x21
call fcn.00401418
push ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000
mov dword [esp + 0x10], 0x417080
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x41b080
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], 0x417080
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov edi, eax
jmp 0x403203
mov dword [esp], 0x11
call fcn.00401418
push edi
mov dword [esp], eax
call fcn.0040808b
lea edi, [eax + eax]
push edx
cmp word [esi], 0
je 0x4035ba
mov dword [esp], esi
movzx ebx, bl
call fcn.00407fad
mov esi, eax
mov eax, dword [ebp - 0x29c]
push ecx
or eax, ebx
je 0x403241
mov dword [esp + 8], edi
mov dword [esp + 4], 0x417080
mov dword [esp], esi
call fcn.00407da7
sub esp, 0xc
jmp 0x402d07
cmp dword [ebp - 0x274], 0
je 0x403225
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00407ded
test eax, eax
push edx
push edx
jns 0x403225
jmp 0x4035ba
mov eax, 2
call fcn.0040146e
test eax, eax
mov dword [ebp - 0x2a8], eax
jle case.0x4016e9.65
xor ebx, ebx
cmp word [esi], 0
je 0x4034be
mov dword [esp], esi
call fcn.00407fad
mov word [ebp - 0x2a0], 0
push edi
mov edi, eax
mov dword [ebp - 0x2a4], 2
cmp dword [ebp - 0x284], 0x39
jne 0x4033a6
lea eax, [ebp - 0x268]
lea esi, [ebp - 0x288]
mov dword [esp + 0x10], 0
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, 2
sub eax, dword [ebp - 0x274]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x4034be
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x4034be
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x274], 0
movzx eax, byte [ebp - 0x288]
mov word [ebp - 0x28c], ax
jne 0x4033f3
lea eax, [ebp - 0x28c]
mov dword [esp + 0x14], 1
mov dword [esp + 8], esi
mov dword [esp + 4], 8
mov dword [esp], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x268]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
jne 0x4033f3
dec dword [ebp - 0x268]
mov word [ebp - 0x28c], 0xfffd
je 0x4033f3
dec dword [ebp - 0x2a4]
mov dword [esp + 0xc], 1
mov eax, dword [ebp - 0x2a4]
mov dword [esp + 8], 0
mov dword [esp], edi
neg eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x40331e
mov eax, ebx
or eax, dword [ebp - 0x274]
je 0x4033d6
lea eax, [ebp - 0x28c]
mov dword [esp + 8], 2
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00407d61
sub esp, 0xc
test eax, eax
jne 0x4033f3
jmp 0x4034be
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.00407ded
test eax, eax
push esi
push esi
jns 0x4033b0
xor ebx, ebx
jmp 0x4034be
cmp dword [ebp - 0x274], 0
je 0x40341c
movzx eax, word [ebp - 0x28c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407f88
push ecx
push ecx
jmp 0x403960
cmp word [ebp - 0x2a0], 0xa
mov eax, dword [ebp - 0x28c]
je 0x403436
cmp word [ebp - 0x2a0], 0xd
jne 0x403482
cmp word [ebp - 0x2a0], ax
je 0x40344b
cmp ax, 0xa
je 0x403475
cmp ax, 0xd
je 0x403475
mov eax, dword [ebp - 0x2a4]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp], edi
neg eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x4034be
mov ecx, dword [ebp - 0x29c]
mov word [ecx + ebx*2], ax
inc ebx
jmp 0x4034be
mov ecx, dword [ebp - 0x29c]
inc ebx
mov word [ecx + ebx*2 - 2], ax
mov eax, dword [ebp - 0x28c]
test ax, ax
mov word [ebp - 0x2a0], ax
je 0x4034be
cmp dword [ebp - 0x2a8], 0x1fff
mov eax, 0x1fff
cmovle eax, dword [ebp - 0x2a8]
cmp ebx, eax
jl 0x4032a3
mov eax, dword [ebp - 0x29c]
test ebx, ebx
mov word [eax + ebx*2], 0
jmp 0x401c30
cmp word [esi], 0
je case.0x4016e9.65
mov eax, 2
mov ebx, dword [ebp - 0x274]
call fcn.0040146e
mov dword [esp], esi
mov edi, eax
call fcn.00407fad
push edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp dword [ebp - 0x27c], 0
js case.0x4016e9.65
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407f88
jmp 0x4038fd
mov dword [esp], esi
call fcn.00407fad
test eax, eax
push esi
je case.0x4016e9.65
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402188
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407fad
test eax, eax
push ebx
je 0x4035b5
lea edx, [ebp - 0x268]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
push ecx
push ecx
je 0x4035b5
jmp 0x4035d8
mov dword [esp], 2
call fcn.00401418
lea edx, [ebp - 0x268]
push edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
push edx
push edx
jne 0x4035c4
mov eax, dword [ebp - 0x29c]
mov word [eax], 0
mov word [esi], 0
mov edi, 1
jmp 0x40395a
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407f88
push ebx
push ebx
lea eax, [ebp - 0x23c]
mov dword [esp], esi
mov dword [esp + 4], eax
jmp 0x403807
mov dword [esp], 0xfffffff0
call fcn.00401418
push edx
mov esi, eax
mov dword [esp], eax
call fcn.00407a9a
test eax, eax
push ecx
jne 0x403613
mov dword [esp], 0xffffffed
call fcn.00401418
push eax
mov dword [esp], esi
call fcn.00407bf5
push edi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call fcn.00407c94
sub esp, 0xc
mov dword [ebp - 0x29c], eax
inc eax
jne 0x403659
mov dword [esp], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0xffffffef
push ebx
jmp 0x4037b5
mov eax, dword [0x473c8c]
mov dword [esp], 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2a0], eax
mov dword [esp + 4], eax
call edi
test eax, eax
push ecx
mov ebx, eax
push ecx
mov edx, 0xfffffd66
je 0x40378a
mov dword [esp], 0
call fcn.00403bcf
push eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00403ba7
push eax
push eax
mov eax, dword [ebp - 0x278]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call edi
test eax, eax
push edx
mov edi, eax
push edx
je 0x403736
mov eax, dword [ebp - 0x278]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call fcn.00403c01
mov edx, edi
sub esp, 0x10
cmp byte [edx], 0
je 0x40372c
mov ecx, dword [edx]
lea eax, [edx + 8]
mov dword [esp + 4], eax
mov dword [ebp - 0x2a4], eax
mov dword [esp + 8], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x2a8], ecx
add eax, ebx
mov dword [esp], eax
call fcn.00407bd6
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x2a8]
sub esp, 0xc
lea edx, [eax + ecx]
jmp 0x4036ed
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.00407da7
sub esp, 0xc
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00403c01
sub esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x2a0]
push eax
test edx, edx
js 0x403640
mov eax, 0xfffffff3
xor edi, edi
mov dword [esp], eax
call fcn.0040165d
push eax
jmp 0x40395a
xor eax, eax
call fcn.0040146e
cmp eax, dword [0x473c4c]
mov esi, eax
jae 0x4035ba
imul ebx, eax, 0x4018
mov eax, dword [ebp - 0x278]
add ebx, dword [0x473c48]
test eax, eax
js 0x403811
mov eax, dword [ebx + eax*4]
jne 0x40351f
mov eax, dword [ebp - 0x29c]
add ebx, 0x18
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00408063
jmp 0x4038fd
not eax
test eax, eax
mov dword [ebp - 0x278], eax
je 0x40382f
mov eax, 1
call fcn.0040146e
mov dword [ebp - 0x27c], eax
jmp 0x40384d
mov eax, dword [ebp - 0x270]
mov dword [esp + 4], eax
lea eax, [ebx + 0x18]
mov dword [esp], eax
call fcn.004081cb
push edi
push edi
or dword [ebx + 8], 0x100
mov eax, dword [ebp - 0x278]
mov edx, dword [ebp - 0x27c]
mov dword [ebx + eax*4], edx
cmp dword [ebp - 0x274], 0
je case.0x4016e9.65
mov dword [esp], esi
call fcn.00401234
jmp 0x402188
xor eax, eax
call fcn.0040146e
cmp eax, 0x1f
ja 0x4035ba
cmp dword [ebp - 0x274], 0
je 0x4038c9
cmp dword [ebp - 0x278], 0
je 0x4038b7
mov dword [esp], eax
call fcn.00401349
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00401299
jmp 0x4038fd
mov dword [esp], 0
call fcn.00401393
push edx
jmp 0x40351f
cmp dword [ebp - 0x278], 0
mov edx, dword [0x473c00]
lea eax, [eax + 0x24]
je 0x4038e7
mov ecx, dword [ebp - 0x27c]
mov dword [edx + eax*4 + 4], ecx
jmp case.0x4016e9.65
mov eax, dword [edx + eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call fcn.004081cb
push eax
push eax
jmp case.0x4016e9.65
and ebx, dword [0x448d40]
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0xb
mov dword [esp], eax
mov dword [esp + 8], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
cmp dword [ebp - 0x280], 0
je case.0x4016e9.65
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
xor edi, edi
add dword [0x473bc0], edi
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4