Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x18c
push 0
push 0x4134ac
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4134b0], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4134ac], eax
call section..text
mov eax, 0x41230a
mov dword [0x4134ec], eax
call fcn.0040f3e0
call fcn.0040f1cc
call fcn.0040d6d3
call fcn.0040d203
call fcn.0040cbb0
call fcn.0040c839
call fcn.0040c580
call fcn.0040c561
call fcn.0040c4d8
call fcn.0040bc40
call fcn.0040ac6f
call fcn.00409ea1
call fcn.00409b66
call fcn.004097ee
call fcn.00408361
call fcn.00407fd9
push dword [0x413624]
call fcn.00409b85
push 7
push 0x412060
lea eax, [0x413624]
push eax
push 8
call fcn.00409ad4
push 0x41361c
push 0x412070
push 7
push 0x401
push 8
call fcn.0040f0cd
mov eax, 0x200
push eax
lea eax, [0x413634]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040d6f2
push dword [0x41362c]
call fcn.00409b85
push 7
push 0x412068
lea eax, [0x41362c]
push eax
push 8
call fcn.00409ad4
mov edx, 0x412021
lea ecx, [0x4135b4]
call fcn.00405068
mov ebp, 0x41230a
mov ebx, ebp
mov ebp, 0x412125
sub ebx, ebp
mov dword [0x41359c], ebx
mov ebp, 0x412125
mov dword [0x4135a0], ebp
push dword [0x41359c]
call fcn.0040c5f0
mov dword [0x41356c], eax
mov dword [0x413500], 0
mov eax, dword [0x41359c]
cmp eax, dword [0x413500]
jl 0x4011b1
mov ebx, dword [0x4135a0]
add ebx, dword [0x413500]
mov eax, ebx
call fcn.0040c610
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x41356c]
add ebx, dword [0x413500]
mov eax, ebx
call fcn.0040c620
inc dword [0x413500]
jno 0x401170
mov edx, dword [0x413b10]
push edx
push edx
mov ebx, dword [0x41359c]
add ebx, 0xfffffff8
push ebx
mov ebx, dword [0x41356c]
add ebx, 4
push ebx
call fcn.0040c630
push 0x4134d8
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push dword [0x4134d8]
call fcn.004050d0
push 0x4134d8
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 1
push dword [0x4134d8]
call fcn.004051b0
push 0x41352c
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 2
push dword [0x4134d8]
call fcn.004051b0
push 0x4135a8
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 3
push dword [0x4134d8]
call fcn.004051b0
push 0x413524
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 4
push dword [0x4134d8]
call fcn.004051b0
push 0x413614
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 5
push dword [0x4134d8]
call fcn.004051b0
push 0x413530
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 6
push dword [0x4134d8]
call fcn.004051b0
push 0x4135cc
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 7
push dword [0x4134d8]
call fcn.004051b0
push 0x4134e0
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 8
push dword [0x4134d8]
call fcn.004051b0
push 0x413548
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 9
push dword [0x4134d8]
call fcn.004051b0
push 0x4135f8
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0xa
push dword [0x4134d8]
call fcn.004051b0
push 0x4134f4
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0xb
push dword [0x4134d8]
call fcn.004051b0
push 0x413608
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0xc
push dword [0x4134d8]
call fcn.004051b0
push 0x4135bc
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0xd
push dword [0x4134d8]
call fcn.004051b0
push 0x413550
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0xe
push dword [0x4134d8]
call fcn.004051b0
push 0x41358c
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0xf
push dword [0x4134d8]
call fcn.004051b0
push 0x4134c4
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x10
push dword [0x4134d8]
call fcn.004051b0
push 0x4135f4
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x11
push dword [0x4134d8]
call fcn.004051b0
push 0x4134fc
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x12
push dword [0x4134d8]
call fcn.004051b0
push 0x413584
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x13
push dword [0x4134d8]
call fcn.004051b0
push 0x4135c0
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x14
push dword [0x4134d8]
call fcn.004051b0
push 0x413580
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x15
push dword [0x4134d8]
call fcn.004051b0
push 0x4135d8
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x16
push dword [0x4134d8]
call fcn.004051b0
push 0x4135b8
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x17
push dword [0x4134d8]
call fcn.004051b0
push 0x4135e0
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x18
push dword [0x4134d8]
call fcn.004051b0
push 0x413538
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x19
push dword [0x4134d8]
call fcn.004051b0
push 0x413540
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x1a
push dword [0x4134d8]
call fcn.004051b0
push 0x4135dc
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b4]
push 0x1b
push dword [0x4134d8]
call fcn.004051b0
push 0x41357c
call fcn.0040f460
call fcn.0040aa4f
mov ebx, eax
cmp ebx, 0x32
jge 0x40165e
push 0x10
push dword [0x4135d8]
push dword [0x4135f4]
call fcn.00408010
jmp 0x40282c
mov eax, 0x41230a
mov dword [0x4134ec], eax
mov eax, dword [0x4134ec]
mov eax, dword [eax]
mov dword [0x413500], eax
add dword [0x4134ec], 4
mov eax, dword [0x4134ec]
mov eax, dword [eax]
mov dword [0x413504], eax
add dword [0x4134ec], 4
mov eax, dword [0x4134ec]
mov eax, dword [eax]
mov dword [0x413508], eax
add dword [0x4134ec], 4
mov eax, dword [0x4134ec]
mov eax, dword [eax]
mov dword [0x41350c], eax
add dword [0x4134ec], 4
mov eax, dword [0x4134ec]
mov eax, dword [eax]
mov dword [0x413510], eax
add dword [0x4134ec], 4
push 0x14
call fcn.0040c5f0
mov dword [0x413520], eax
push dword [0x413500]
mov eax, dword [0x413520]
call fcn.0040c690
push dword [0x413504]
mov ebx, dword [0x413520]
add ebx, 4
mov eax, ebx
call fcn.0040c690
push dword [0x413508]
mov ebx, dword [0x413520]
add ebx, 8
mov eax, ebx
call fcn.0040c690
push dword [0x41350c]
mov ebx, dword [0x413520]
add ebx, 0xc
mov eax, ebx
call fcn.0040c690
push dword [0x413510]
mov ebx, dword [0x413520]
add ebx, 0x10
mov eax, ebx
call fcn.0040c690
mov edx, dword [0x413b10]
push edx
push edx
push 0x14
push dword [0x413520]
call fcn.0040dcb0
push 0x41360c
call fcn.0040f460
call fcn.00408f0d
push 1
lea eax, [0x4032be]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
lea eax, [0x403274]
push eax
call fcn.004098f0
call fcn.0040849f
mov dword [0x4135c8], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x413558], eax
mov edx, dword [0x413b10]
push edx
push edx
call fcn.004084b2
push 0x4135c4
call fcn.0040f460
push dword [0x4135c4]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov ebx, dword [0x4135c8]
and ebx, ebx
jle 0x4018da
mov dword [0x413500], 0
mov ebx, dword [0x4135c8]
dec ebx
cmp ebx, dword [0x413500]
jl 0x40185d
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413500]
call fcn.00408451
push 0x4135a4
call fcn.0040f460
push dword [0x4135a4]
mov edx, dword [0x413530]
pop ecx
call fcn.0040f4e0
je 0x401821
mov dword [0x4134f0], 1
jmp 0x401851
mov ebx, dword [0x4134f0]
cmp ebx, 1
jne 0x401851
mov edx, dword [0x4135a4]
push dword [0x413b10]
call fcn.0040f510
push 0x4135e8
call fcn.0040f460
mov dword [0x4134f0], 0
inc dword [0x413500]
jno 0x4017d5
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040c6a0
inc dword [0x413b10]
mov edx, dword [0x412320]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x413b10]
push eax
call fcn.0040c6a0
push 0x413544
call fcn.0040f460
mov edx, dword [0x4135c4]
push dword [0x413b10]
call fcn.0040f510
mov edx, str.__BFINOPSX
call fcn.0040f510
mov edx, dword [0x413544]
call fcn.0040f510
push 0x413544
call fcn.0040f460
jmp 0x4018f5
mov edx, dword [0x4135c4]
push dword [0x413b10]
call fcn.0040f510
push 0x413544
call fcn.0040f460
push 0x41202f
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401920
mov eax, dword [0x4134b8]
mov dword [0x413594], eax
push dword [0x413594]
call fcn.00403392
jmp 0x401940
push 0x10
push dword [0x413580]
push dword [0x4135f4]
call fcn.00408010
push 1
jmp 0x402831
push 0x41202d
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401979
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4134cc]
push dword [0x4134b8]
call fcn.0040c630
push 0x413578
call fcn.0040f460
jmp 0x401999
push 0x10
push dword [0x413580]
push dword [0x4135f4]
call fcn.00408010
push 1
jmp 0x402831
push 0x412027
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x4019cd
mov eax, dword [0x4134b8]
mov dword [0x413504], eax
mov eax, dword [0x4134cc]
mov dword [0x4134bc], eax
mov eax, dword [0x413504]
mov dword [0x4135d4], eax
jmp 0x4019ed
push 0x10
push dword [0x413580]
push dword [0x4135f4]
call fcn.00408010
push 1
jmp 0x402831
push 0x41202b
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401a1f
mov eax, dword [0x4134b8]
mov dword [0x413518], eax
mov eax, dword [0x4134cc]
mov dword [0x413528], eax
mov eax, dword [0x413518]
mov dword [0x413590], eax
push 0x412029
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401a51
mov eax, dword [0x4134b8]
mov dword [0x413514], eax
mov eax, dword [0x4134cc]
mov dword [0x4134c0], eax
mov eax, dword [0x413514]
mov dword [0x4135fc], eax
push 0x412031
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401ce9
mov edx, dword [0x4135e8]
xor ecx, ecx
call fcn.0040f4e0
jne 0x401a98
mov edx, dword [0x4135e8]
push dword [0x413b10]
call fcn.0040f510
push 0x4135b0
call fcn.0040f460
jmp 0x401c0c
push 0xc80001
push dword [0x4135e0]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.0040af7f
push dword [0x413538]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.0040a183
push 0x20
push 0x41201e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.0040a35c
push 0x41204e
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.0040a669
push 4
push 0xd
push 0
call fcn.0040afa2
push 2
call fcn.0040a689
call fcn.0040b1a6
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401b78
push dword [0x4135f0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402831
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401bc0
call fcn.0040d2cc
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401bbd
mov edx, dword [0x413b10]
push edx
push edx
push 2
call fcn.0040a6c4
push 0x4135b0
call fcn.0040f460
push 0
call fcn.0040ab42
add esp, 8
jmp 0x401c0c
pop eax
jmp 0x401c06
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401c06
call fcn.0040d2db
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401c05
mov edx, dword [0x413b10]
push edx
push edx
push 2
call fcn.0040a6c4
push 0x4135b0
call fcn.0040f460
push 0
call fcn.0040ab42
add esp, 8
jmp 0x401c0c
pop eax
pop eax
jmp 0x401b4e
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135b0]
call fcn.004052c0
push eax
mov eax, dword [0x4135b0]
push eax
call fcn.0040dcb0
inc dword [0x413b10]
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4134cc]
push dword [0x4134b8]
call fcn.0040c630
pop edx
pop ecx
mov dword [0x413b10], ecx
add ecx, dword [0x412320]
add edx, dword [0x412320]
call fcn.0040f4e0
jne 0x401c90
push 0x10
push dword [0x4135c0]
push dword [0x4135f4]
call fcn.00408010
push dword [0x4135f0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x402831
push 0x412033
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401cae
mov eax, dword [0x4134b8]
mov dword [0x4135d0], eax
push dword [0x4134c0]
push dword [0x413528]
push dword [0x4134bc]
push dword [0x4135d0]
push dword [0x413514]
push dword [0x413518]
push dword [0x413504]
push dword [0x4135b0]
push dword [0x413558]
call fcn.00403e01
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4134bc]
push dword [0x4135d4]
call fcn.0040c630
push 0x413574
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413528]
push dword [0x413590]
call fcn.0040c630
push 0x4134e4
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push 0
call fcn.00408451
inc dword [0x413b10]
mov edx, dword [0x41357c]
pop ecx
mov dword [0x413b10], ecx
add ecx, dword [0x412320]
call fcn.0040f4e0
je 0x401d73
mov ebx, dword [0x4135c8]
cmp ebx, 1
jne 0x401d73
mov eax, 1
jmp 0x401d75
xor eax, eax
and eax, eax
je 0x401e86
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
call fcn.0040c845
inc dword [0x413b10]
push dword [0x4135b8]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.00408083
push 0x4134dc
call fcn.0040f460
mov edx, dword [0x4134dc]
xor ecx, ecx
call fcn.0040f4e0
jne 0x401e34
mov edx, dword [0x4134dc]
push dword [0x413b10]
call fcn.0040f510
push 0x413570
call fcn.0040f460
push dword [0x413570]
call fcn.0040c885
mov edx, dword [0x4134e4]
xor ecx, ecx
call fcn.0040f4e0
jne 0x401e06
push dword [0x4134e4]
call fcn.004034c0
push dword [0x413578]
push 1
call fcn.0040cd50
and eax, eax
je 0x401e34
push dword [0x413574]
push 1
call fcn.0040ced0
push 1
call fcn.0040cb30
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
call fcn.004084b2
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.0040c897
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.0040c885
pop dword [0x413b10]
push dword [0x4135f0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402831
push 0x412035
push dword [0x413558]
call fcn.00403bf6
and eax, eax
je 0x401fda
push 0x400
call fcn.0040c5f0
mov dword [0x41354c], eax
mov edx, dword [0x413b10]
push edx
push edx
call fcn.0040c90d
push 0x413604
call fcn.0040f460
push dword [0x41354c]
push 0
push 0x41201e
push dword [0x413604]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x41354c]
call fcn.0040c6a0
push 0x4135ec
call fcn.0040f460
push dword [0x41354c]
call fcn.0040c6f0
push dword [0x4135ec]
call fcn.0040c99c
push dword [0x4135ec]
call fcn.0040c9aa
push dword [0x4135ec]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x4135ec]
push dword [0x413b10]
call fcn.0040f510
mov edx, dword [0x4135a8]
call fcn.0040f510
mov edx, str..exe
call fcn.0040f510
push 0x413568
call fcn.0040f460
push dword [0x413568]
push 0
call fcn.0040cd50
push dword [0x4134cc]
push dword [0x4134b8]
push 0
call fcn.0040cf50
push 0
call fcn.0040cb30
mov edx, dword [0x413568]
push dword [0x413b10]
call fcn.0040f510
push 0x413560
call fcn.0040f460
push dword [0x413560]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x413560]
push dword [0x41352c]
call fcn.0040850d
push dword [0x413524]
push dword [0x4135a8]
call fcn.0040850d
mov dword [0x4134c8], 1
mov edx, dword [0x4135f0]
push dword [0x413b10]
call fcn.0040f510
mov edx, 0x412025
call fcn.0040f510
mov edx, dword [0x413578]
call fcn.0040f510
push 0x413578
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x4134e8
call fcn.0040f460
push dword [0x413b10]
push dword [0x4134e8]
push 0
push 0x41201e
mov edx, dword [0x4135f0]
push dword [0x413b10]
call fcn.0040f510
mov edx, 0x412025
call fcn.0040f510
inc dword [0x413b10]
mov edx, dword [0x412320]
add dword [esp], edx
call sub.KERNEL32.dll_GetTempFileNameA
pop dword [0x413b10]
push dword [0x4134e8]
call fcn.0040c99c
push str..bat
push dword [0x4134e8]
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov edx, dword [0x4134e8]
push dword [0x413b10]
call fcn.0040f510
push 0x413578
call fcn.0040f460
push dword [0x413578]
push 1
call fcn.0040cd50
and eax, eax
je 0x40224f
push dword [0x41358c]
push 1
call fcn.0040cfb0
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040c6a0
inc dword [0x413b10]
mov edx, dword [0x412320]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x413b10]
push eax
call fcn.0040c6a0
inc dword [0x413b10]
push dword [0x4135cc]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413b10]
push dword [0x413574]
push 1
call fcn.0040cfb0
mov ebx, dword [0x4134c8]
cmp ebx, 1
jne 0x402243
mov edx, dword [0x413b10]
push edx
push edx
mov ebp, 0x412125
mov ebx, ebp
mov ebp, 0x412078
sub ebx, ebp
push ebx
mov ebp, 0x412078
push ebp
call fcn.0040c630
push 0x41351c
call fcn.0040f460
push dword [0x41351c]
call fcn.004052c0
mov dword [0x413554], eax
push dword [0x413554]
call fcn.0040c5f0
mov dword [0x413564], eax
push dword [0x413554]
call fcn.0040c5f0
mov dword [0x413534], eax
push dword [0x41351c]
push dword [0x413564]
call fcn.0040c710
mov dword [0x413500], 0
mov eax, dword [0x413554]
cmp eax, dword [0x413500]
jl 0x40220a
mov ebx, dword [0x413564]
add ebx, dword [0x413500]
mov eax, ebx
call fcn.0040c610
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x413534]
add ebx, dword [0x413500]
mov eax, ebx
call fcn.0040c620
inc dword [0x413500]
jno 0x4021c9
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
push dword [0x413534]
call fcn.0040c6a0
inc dword [0x413b10]
push 1
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040cfb0
pop dword [0x413b10]
push 1
call fcn.0040cb30
jmp 0x40228a
push dword [0x413578]
call fcn.0040c99c
call fcn.004040ae
push 0x10
push dword [0x413580]
push dword [0x4135f4]
call fcn.00408010
push dword [0x4135f0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x402831
mov edx, dword [0x4134e4]
xor ecx, ecx
call fcn.0040f4e0
jne 0x4022a4
push dword [0x4134e4]
call fcn.004034c0
push 0x400
call fcn.0040c5f0
mov dword [0x4135e4], eax
mov edx, dword [0x413b10]
push edx
push edx
call fcn.0040c90d
push 0x4134d4
call fcn.0040f460
push dword [0x4135e4]
push 0
push 0x41201e
push dword [0x4134d4]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x4135e4]
call fcn.0040c6a0
push 0x413600
call fcn.0040f460
mov edx, dword [0x413b10]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413598
call fcn.0040f460
push dword [0x413b10]
push 0x800
push dword [0x413598]
mov edx, dword [0x413b10]
push edx
push edx
call fcn.004084b2
inc dword [0x413b10]
mov edx, dword [0x412320]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x413b10]
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
call fcn.004084b2
inc dword [0x413b10]
push dword [0x4134e0]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413b10]
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
call fcn.004084b2
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.0040cac8
inc dword [0x413b10]
push dword [0x413548]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413b10]
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
call fcn.004084b2
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.0040c897
inc dword [0x413b10]
push dword [0x4135f8]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413b10]
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
push dword [0x413598]
call fcn.00405190
inc dword [0x413b10]
push dword [0x4134f4]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413b10]
mov edx, dword [0x413570]
push dword [0x413b10]
call fcn.0040f510
push 0x413618
call fcn.0040f460
push dword [0x413618]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x413618]
push dword [0x413608]
call fcn.0040850d
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
mov eax, dword [0x4134d0]
cdq
push edx
push eax
call fcn.004054a0
inc dword [0x413b10]
push dword [0x4135bc]
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.0040850d
pop dword [0x413b10]
push dword [0x413600]
push dword [0x413550]
call fcn.0040850d
call fcn.00403bc2
and eax, eax
je 0x4024f8
call fcn.0040aa4f
mov ebx, eax
cmp ebx, 0x41
je 0x4024f8
mov eax, 1
jmp 0x4024fa
xor eax, eax
and eax, eax
je 0x402670
mov edx, dword [0x413b10]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413610
call fcn.0040f460
push 0x800
push dword [0x413610]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [0x413610]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x413610]
push dword [0x413b10]
call fcn.0040f510
mov edx, 0x412037
call fcn.0040f510
push 0x413610
call fcn.0040f460
push dword [0x413610]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x413610]
push dword [0x413b10]
call fcn.0040f510
mov edx, dword [0x413540]
call fcn.0040f510
push 0x41353c
call fcn.0040f460
mov edx, dword [0x413610]
push dword [0x413b10]
call fcn.0040f510
mov edx, dword [0x413540]
call fcn.0040f510
mov edx, str..exe
call fcn.0040f510
push 0x41355c
call fcn.0040f460
push dword [0x41353c]
push 0
call fcn.0040ce20
and eax, eax
je 0x4025e9
mov dword [0x413500], 1
push 0
call fcn.0040cb30
jmp 0x4025f3
mov dword [0x413500], 0
push dword [0x41355c]
push 0
call fcn.0040ce20
and eax, eax
je 0x40261d
mov dword [0x413504], 1
push 0
call fcn.0040cb30
jmp 0x402627
mov dword [0x413504], 0
mov ebx, dword [0x413500]
add ebx, dword [0x413504]
and ebx, ebx
jne 0x40266e
mov edx, dword [0x413b10]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413610
call fcn.0040f460
push 0x800
push dword [0x413610]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [0x413610]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x4026a7
mov edx, dword [0x413b10]
push edx
push edx
push 0x800
call fcn.004052f0
push 0x413610
call fcn.0040f460
push 0x800
push dword [0x413610]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [0x413610]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x413578]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x413578]
push dword [0x413b10]
call fcn.0040f510
mov edx, str.__BFINOPSX
call fcn.0040f510
mov edx, dword [0x413544]
call fcn.0040f510
push 0x413544
call fcn.0040f460
push dword [0x413544]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x413b10]
push 0x45
push dword [0x413570]
mov edx, dword [0x4135dc]
push dword [0x413b10]
call fcn.0040f510
mov edx, str.__BFINOPSX
call fcn.0040f510
mov edx, dword [0x413544]
call fcn.0040f510
inc dword [0x413b10]
mov edx, dword [0x413610]
push dword [0x413b10]
call fcn.0040f510
mov edx, dword [0x413540]
call fcn.0040f510
mov edx, dword [0x412320]
add dword [esp], edx
mov edx, dword [0x412320]
add dword [esp + 4], edx
call fcn.00408989
pop dword [0x413b10]
mov dword [0x413588], eax
push dword [0x413588]
call fcn.004089a3
push dword [0x413588]
call fcn.004089b4
mov dword [0x4134f8], eax
push dword [0x413588]
call fcn.004089d2
push 0
lea eax, [0x4032be]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.004040ae
push dword [0x413578]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x413578]
call fcn.0040c99c
push dword [0x413600]
call fcn.0040c99c
push dword [0x413568]
call fcn.0040c99c
mov edx, dword [0x413b10]
push edx
push edx
mov edx, dword [0x413b10]
push edx
push edx
push dword [0x413b10]
call fcn.004084b2
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.0040c897
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.0040c885
pop dword [0x413b10]
push dword [0x4135ec]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x4135f0]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x4134f8]
jmp 0x402831
push 0
call 0x40284b
call fcn.0040f430
push dword [0x4134ac]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00409802
call fcn.00409a40
call fcn.00409f11
call fcn.0040ac58
call fcn.0040bcce
call fcn.0040c4cc
call fcn.0040cada
call fcn.0040cba0
call fcn.0040d5ce
call fcn.0040c5a0
ret