Function at 0x419f69
Capabilities:
Delete file
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444a72
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x490
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x3c]
call fcn.00404430
mov dword [ebp - 4], 0
mov byte [ebp - 0x40], 1
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x1c], 1
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x3fc]
push eax
push 0x470ea0
lea ecx, [ebp - 0x90]
call fcn.00408de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x400]
push ecx
push 0x470ea4
lea ecx, [ebp - 0x74]
call fcn.0040be10
mov byte [ebp - 4], 2
lea edx, [ebp - 0x404]
push edx
push 0x470ea8
lea ecx, [ebp - 0x64]
call fcn.0040be10
mov byte [ebp - 4], 3
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 4
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041ac50
add esp, 4
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.004266b4
add esp, 0xc
push 0x29
push 0x28
lea edx, [ebp - 0x48]
push edx
push 0x46ac18
mov eax, dword [ebp - 0x50]
push eax
call fcn.00420e10
add esp, 4
push eax
call fcn.00425c10
add esp, 0x14
and eax, 0xff
test eax, eax
je 0x41a0d9
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00429d80
add esp, 4
push eax
push 0x470e2c
mov edx, dword [ebp - 0x48]
push edx
call fcn.0041ec89
add esp, 0xc
and eax, 0xff
test eax, eax
je 0x41a0c4
mov eax, dword [0x470e2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [0x470e2c]
push ecx
push str.__WinMain__szWorkingFolder_from_service____s_
call fcn.004288c1
add esp, 8
jmp 0x41a0d5
mov edx, dword [ebp - 0x48]
push edx
push str.__WinMain__Error_hex2char___s__
call fcn.004288c1
add esp, 8
mov byte [ebp - 0x14], 1
cmp dword [0x470e2c], 0
jne 0x41a106
push 1
push 0
push 0x470e2c
call fcn.00421c98
add esp, 0xc
mov eax, dword [0x470e2c]
push eax
push str.__WinMain__szWorkingFolder____s_
call fcn.004288c1
add esp, 8
push 1
lea ecx, [ebp - 0x290]
push ecx
push 0
push 0
call fcn.0041c5a0
add esp, 0x10
lea edx, [ebp - 0x290]
push edx
push str.______s
call fcn.004288c1
add esp, 8
mov eax, dword [ebp - 0x50]
push eax
push str.__WinMain__szCmdLine___s_
call fcn.004288c1
add esp, 8
push 0
push 0x417840
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0x417840
push 0xa
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea eax, [ebp - 0x3c]
push eax
push 0x46acb4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00423054
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.00404410
test eax, eax
jne 0x41a1a1
push str.__WinMain__Error_extracting_params
call fcn.004288c1
add esp, 4
jmp 0x41aa59
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x44]
push eax
push 0x470e38
push 0x470e34
push 0x470e30
push 0x470e28
mov ecx, dword [ebp - 0x50]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.004182b0
add esp, 0x30
mov eax, dword [0x470e38]
push eax
mov ecx, dword [0x470e34]
push ecx
mov edx, dword [0x470e30]
push edx
mov eax, dword [0x470e28]
push eax
push str.__WinMain__Params_Loaded:_szLang__s__szURL__s__szCode__s__szOwner__s_
call fcn.004288c1
add esp, 0x14
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push str.__WinMain__Params_Loaded:_szScript__s__szTmp__s_
call fcn.004288c1
add esp, 0xc
mov eax, dword [ebp - 0x14]
and eax, 0xff
push eax
mov ecx, dword [ebp - 0x30]
and ecx, 0xff
push ecx
mov edx, dword [ebp - 0x24]
and edx, 0xff
push edx
mov eax, dword [ebp - 0x40]
and eax, 0xff
push eax
push str.__WinMain__Params_Loaded:_bSelfDelete__i__bPrintScript__i__bElevation__i__bFromService__i_
call fcn.004288c1
add esp, 0x14
lea ecx, [ebp - 0x90]
push ecx
call fcn.00418bde
add esp, 4
cmp dword [ebp - 0x44], 0
je 0x41a41d
mov edx, dword [ebp - 0x30]
and edx, 0xff
test edx, edx
je 0x41a3e9
mov eax, dword [ebp - 0x14]
and eax, 0xff
test eax, eax
jne 0x41a3e9
call fcn.004210d1
cmp eax, 0x50
jl 0x41a3e9
call fcn.00422890
test eax, eax
je 0x41a3e9
push 0x46adb8
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00420816
add esp, 8
push 0x46adc4
call fcn.004288c1
add esp, 4
mov dword [ebp - 0x324], 0
push 0
lea edx, [ebp - 0x324]
push edx
call fcn.00422201
add esp, 8
push 1
push 3
lea ecx, [ebp - 0x31c]
call fcn.004049c0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x31c]
test eax, eax
je 0x41a305
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x46c], ecx
jmp 0x41a30f
mov dword [ebp - 0x46c], 0
push 0x46addc
mov edx, dword [ebp - 0x324]
push edx
mov eax, dword [ebp - 0x46c]
push eax
call fcn.00407180
add esp, 8
push eax
call fcn.00407180
add esp, 8
push 0x46ade8
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00404ae0
mov dword [ebp - 0x470], eax
mov edx, dword [ebp - 0x470]
mov dword [ebp - 0x474], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x474]
call fcn.00404530
push eax
call fcn.0042aa7b
add esp, 8
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x414]
call fcn.004044d0
cmp dword [ebp - 0x320], 0
je 0x41a3b0
push 0x46adec
call fcn.004288c1
add esp, 4
mov eax, dword [ebp - 0x320]
push eax
call fcn.0042a937
add esp, 4
jmp 0x41a3bd
push 0x46ae1c
call fcn.004288c1
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x31c]
call fcn.00404300
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004189c9
add esp, 0x10
jmp 0x41aa7c
push str.__WinMain__Script_already_exist.
call fcn.004288c1
add esp, 4
mov byte [ebp - 0x18], 1
mov edx, dword [ebp - 0x14]
and edx, 0xff
test edx, edx
je 0x41a418
push str.__WinMain__As_were_comming_from_service_execution__bselfDelete_needs_to_be_false
call fcn.004288c1
add esp, 4
mov byte [ebp - 0x40], 0
jmp 0x41a6b9
push str.__WinMain__Getting_script...
call fcn.004288c1
add esp, 4
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00418ca3
add esp, 0x20
mov edx, dword [ebp - 0x44]
push edx
push str.__WinMain__script_:__s
call fcn.004288c1
add esp, 8
cmp dword [ebp - 0x48], 0
je 0x41a477
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x478], eax
jmp 0x41a481
mov dword [ebp - 0x478], 0x470eac
mov ecx, dword [ebp - 0x478]
push ecx
push str.__WinMain__error_:__s
call fcn.004288c1
add esp, 8
mov edx, dword [ebp - 0x28]
push edx
push str.__WinMain__szRCMode_:__s
call fcn.004288c1
add esp, 8
mov eax, dword [ebp - 0x54]
push eax
push str.__WinMain__szTicket_:__s
call fcn.004288c1
add esp, 8
cmp dword [ebp - 0x28], 0
je 0x41a6b9
push 0x46af88
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0042a4e0
add esp, 8
test eax, eax
jne 0x41a63d
call fcn.004210d1
cmp eax, 0x50
jl 0x41a63d
call fcn.00422890
test eax, eax
je 0x41a63d
push 0x46af8c
mov edx, dword [ebp - 0x44]
push edx
call fcn.00420816
add esp, 8
push str.__WinMain__Elevating...
call fcn.004288c1
add esp, 4
mov dword [ebp - 0x3b8], 0
push 0
lea eax, [ebp - 0x3b8]
push eax
call fcn.00422201
add esp, 8
push 1
push 3
lea ecx, [ebp - 0x3b0]
call fcn.004049c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3b0]
test ecx, ecx
je 0x41a559
lea edx, [ebp - 0x3a8]
mov dword [ebp - 0x47c], edx
jmp 0x41a563
mov dword [ebp - 0x47c], 0
push str.RC2SA.cfg
mov eax, dword [ebp - 0x3b8]
push eax
mov ecx, dword [ebp - 0x47c]
push ecx
call fcn.00407180
add esp, 8
push eax
call fcn.00407180
add esp, 8
push 0x46afbc
lea edx, [ebp - 0x424]
push edx
lea ecx, [ebp - 0x3b0]
call fcn.00404ae0
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x484], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x484]
call fcn.00404530
push eax
call fcn.0042aa7b
add esp, 8
mov dword [ebp - 0x3b4], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x424]
call fcn.004044d0
cmp dword [ebp - 0x3b4], 0
je 0x41a604
push str._WinMain__File_RC2SA.cfg_created_successfully
call fcn.004288c1
add esp, 4
mov ecx, dword [ebp - 0x3b4]
push ecx
call fcn.0042a937
add esp, 4
jmp 0x41a611
push str._WinMain__Could_not_create_file_to_notify_RR_that_RCMode2__OSC_WVISTA__CurrentUser__LocalAdministrator
call fcn.004288c1
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3b0]
call fcn.00404300
mov edx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004189c9
add esp, 0x10
jmp 0x41aa7c
call fcn.00422890
test eax, eax
je 0x41a652
mov dword [ebp - 0x488], 0x470eb0
jmp 0x41a65c
mov dword [ebp - 0x488], str.NOT
call fcn.004210d1
cmp eax, 0x50
jl 0x41a672
mov dword [ebp - 0x48c], str.WVista_or_Greater
jmp 0x41a67c
mov dword [ebp - 0x48c], str.XP_or_Smaller
cmp dword [ebp - 0x28], 0
je 0x41a68d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x490], eax
jmp 0x41a697
mov dword [ebp - 0x490], str.NO_RCmode
mov ecx, dword [ebp - 0x488]
push ecx
mov edx, dword [ebp - 0x48c]
push edx
mov eax, dword [ebp - 0x490]
push eax
push str._WinMain__No_Elevation_required:_RCMode:__s__OS:__s__User_is__sAdmin
call fcn.004288c1
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
and ecx, 0xff
test ecx, ecx
je 0x41aa59
cmp dword [0x470e30], 0
je 0x41aa4c
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3bc], 0
push 0x46b0dc
call fcn.004288c1
add esp, 4
push 0x29
push 0x28
lea edx, [ebp - 0x3bc]
push edx
push str.proxy
mov eax, dword [ebp - 0x50]
push eax
call fcn.00420e10
add esp, 4
push eax
call fcn.00425c10
add esp, 0x14
push 0x29
push 0x28
lea ecx, [ebp - 0x3c0]
push ecx
push str.auth
mov edx, dword [ebp - 0x50]
push edx
call fcn.00420e10
add esp, 4
push eax
call fcn.00425c10
add esp, 0x14
push str.__WinMain__Extracting_proxy_data_from_command_line...
call fcn.004288c1
add esp, 4
cmp dword [ebp - 0x3bc], 0
je 0x41a926
mov eax, dword [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x90]
call fcn.00404510
lea ecx, [ebp - 0x3bc]
push ecx
call fcn.004267ad
add esp, 4
cmp dword [ebp - 0x3c0], 0
je 0x41a8f3
mov edx, dword [ebp - 0x3c0]
push edx
call fcn.00429d80
add esp, 4
test eax, eax
jbe 0x41a8f3
mov dword [ebp - 0x3c4], 0
lea eax, [ebp - 0x3c4]
push eax
mov ecx, dword [ebp - 0x3c0]
push ecx
call fcn.0041eba3
add esp, 8
cmp dword [ebp - 0x3c4], 0
je 0x41a8e4
lea edx, [ebp - 0x428]
push edx
mov eax, dword [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x3d4]
call fcn.0040be10
mov byte [ebp - 4], 9
push 0
push 0x46b15c
lea ecx, [ebp - 0x3d4]
call fcn.0040ff80
mov dword [ebp - 0x3d8], eax
mov ecx, dword [ebp - 0x3d8]
cmp ecx, dword [0x44744c]
je 0x41a8bc
mov edx, dword [ebp - 0x3d8]
push edx
push 0
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x3d4]
call fcn.0040ffb0
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x498], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x498]
push edx
lea ecx, [ebp - 0x74]
call fcn.0040be60
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x438]
call fcn.0040be40
mov eax, dword [0x44744c]
push eax
mov ecx, dword [ebp - 0x3d8]
add ecx, 1
push ecx
lea edx, [ebp - 0x448]
push edx
lea ecx, [ebp - 0x3d4]
call fcn.0040ffb0
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x4a0]
push ecx
lea ecx, [ebp - 0x64]
call fcn.0040be60
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x448]
call fcn.0040be40
jmp 0x41a8d5
lea ecx, [ebp - 0x3d4]
call fcn.0040bea0
push eax
push str._GetProxyAuth__could_not_decrypt_auth___ws_
call fcn.004288c1
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3d4]
call fcn.0040be40
lea edx, [ebp - 0x3c4]
push edx
call fcn.004267d7
add esp, 4
lea ecx, [ebp - 0x64]
call fcn.0040bea0
push eax
lea ecx, [ebp - 0x74]
call fcn.0040bea0
push eax
lea ecx, [ebp - 0x90]
call fcn.00404530
push eax
mov eax, dword [0x470e30]
push eax
push str.__WinMain__szURL___s__proxy___s__auth_ws:_ws
call fcn.004288c1
add esp, 0x14
jmp 0x41a933
push str.__WinMain__No_proxy_data_in_command_line...
call fcn.004288c1
add esp, 4
cmp dword [ebp - 0x44], 0
je 0x41aa3d
lea ecx, [ebp - 0x44c]
push ecx
push 0x470eb4
lea ecx, [ebp - 0x3e8]
call fcn.00408de0
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3f8]
call fcn.00408de0
mov byte [ebp - 4], 0xd
push str.__WinMain__Executing_script...
call fcn.004288c1
add esp, 4
lea ecx, [ebp - 0x464]
push ecx
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x460]
call fcn.00408de0
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3e8]
push ecx
mov dl, byte [ebp - 0x24]
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x460]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00419724
add esp, 0x28
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x460]
call fcn.004044d0
lea ecx, [ebp - 0x3e8]
call fcn.00404560
test eax, eax
jbe 0x41aa1d
lea ecx, [ebp - 0x3e8]
call fcn.00404530
push eax
push str.__WinMain__ShowQuest__s_
call fcn.004288c1
add esp, 8
lea ecx, [ebp - 0x3e8]
call fcn.00404530
push eax
call fcn.00419e81
add esp, 4
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3f8]
call fcn.004044d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3e8]
call fcn.004044d0
jmp 0x41aa4a
push str.__WinMain_Could_not_retrieve_script
call fcn.004288c1
add esp, 4
jmp 0x41aa59
push str.__WinMain_szURL_Error...
call fcn.004288c1
add esp, 4
push str.__WinMain__Deleting_files...
call fcn.004288c1
add esp, 4
push 0x46b288
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.scrRC.tmp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.__WinMain__Cleanning_up
call fcn.004288c1
add esp, 4
push 0x470e28
call fcn.004267ad
add esp, 4
push 0x470e30
call fcn.004267ad
add esp, 4
push 0x470e34
call fcn.004267ad
add esp, 4
push 0x470e38
call fcn.004267ad
add esp, 4
lea ecx, [ebp - 0x44]
push ecx
call fcn.004267ad
add esp, 4
lea edx, [ebp - 0x50]
push edx
call fcn.004267ad
add esp, 4
lea eax, [ebp - 0x4c]
push eax
call fcn.004267ad
add esp, 4
lea ecx, [ebp - 0x54]
push ecx
call fcn.004267ad
add esp, 4
lea edx, [ebp - 0x48]
push edx
call fcn.004267ad
add esp, 4
mov dword [ebp - 0x78], 0
jmp 0x41ab0b
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xc
jge 0x41ab26
mov ecx, dword [ebp - 0x78]
lea edx, [ecx*4 + 0x470e48]
push edx
call fcn.004267ad
add esp, 4
jmp 0x41ab02
cmp dword [0x470e44], 0
je 0x41ab3b
mov eax, dword [0x470e44]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x470e44], 0
mov ecx, dword [ebp - 0x40]
and ecx, 0xff
test ecx, ecx
je 0x41ab6e
push str.__WinMain_SelfDelete
call fcn.004288c1
add esp, 4
mov edx, dword [0x470e2c]
push edx
call fcn.0041797a
add esp, 4
push 0x470e2c
call fcn.004267ad
add esp, 4
push 0x46b2c8
call fcn.004288c1
add esp, 4
jmp 0x41aba4
mov dword [ebp - 4], 3
mov dword [ebp - 0x468], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.0040be40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.0040be40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.004044d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00404480
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10