Function at 0x4016cb
Capabilities:
Accept command line arguments
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create directory
Create process on windows
Get common file path
Get disk information
Log keystrokes via polling
Read .ini file
Set current directory
Set registry value
Terminate process

Disassembly:
mov eax, 0x41d30
call fcn.0040a140
push ebx
push ebp
push esi
push edi
push 1
pop edi
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4016ee
mov dword [0x47d4cc], edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrA]
mov ebp, eax
push 0x40d868
push ebp
mov dword [esp + 0x18], ebp
call ebx
test eax, eax
je 0x401712
mov dword [0x47ce94], edi
push str._menu
push ebp
call ebx
test eax, eax
je 0x401753
push 0
push str.fenrirMainWindow
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4025b7
push 0x205
push edi
push 0x1000
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4025b7
push str._key
push ebp
call ebx
xor esi, esi
test eax, eax
je 0x4017a7
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._key
push ebp
stosb byte es:[edi], al
call ebx
push eax
lea eax, [esp + 0x164]
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
push eax
push 0x47ce9c
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x40d850
push ebp
call ebx
test eax, eax
je 0x401840
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40d850
push ebp
stosb byte es:[edi], al
call ebx
push eax
lea eax, [esp + 0x164]
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
push eax
push 0x47ef40
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push esi
push str.fenrirMainWindow
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
mov dword [esp + 0x14], eax
je 0x401840
mov edi, 0x47ef40
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x4a
mov dword [esp + 0x2c], 0x64
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, str._restart
push edi
push ebp
call ebx
push edi
push ebp
call ebx
test eax, eax
jne 0x401910
push str._cmd
push ebp
call ebx
test eax, eax
jne 0x401910
push str._cmdtarget
push ebp
call ebx
test eax, eax
jne 0x401910
push str.fenrirMutex
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
test eax, eax
je 0x4025b7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40191e
push esi
push str.fenrirMainWindow
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
cmp edi, esi
je 0x4025b7
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call fcn.00408577
mov dword [esp], str._key
push ebp
call ebx
test eax, eax
je 0x4025b7
mov ebx, 0x208
push ebx
call fcn.00408d7b
mov dword [esp], 0x47ce9c
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 0xc
push 5
push edi
call esi
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call ebp
push ebx
push ebx
push 0xb1
push 5
push edi
call esi
push eax
call ebp
jmp 0x4025b7
push str.fenrirMutex
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 0x80e80
call fcn.00409db6
pop ecx
mov ebp, 0x208
push ebp
push 0x47e224
push esi
mov dword [0x47eed4], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edi, 0x47dc0c
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push edi
push str._sdatapath
push 0x47de14
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov ebp, 0x47e42c
push str._sdata_fenrir.ini
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str._sdata_scan.ini
push 0x47e01c
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str._scmd
push 0x47e634
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str._sdata
push 0x47e83c
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str._sdata
push 0x47ea44
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x48
push edi
push str._sdatainstant.ini
push 0x47ec4c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x40d7bc
push dword [esp + 0x14]
call ebx
mov edx, eax
cmp edx, esi
je 0x401a57
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x160]
push edx
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
mov edi, 0x47de14
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401a52
push edi
lea eax, [esp + 0x164]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push esi
push str.fenrir
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, 0x47dc0c
push 0x40d78c
push dword [esp + 0x14]
call ebx
mov edx, eax
cmp edx, esi
je 0x401aec
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x160]
push edx
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
mov edi, 0x47ec4c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401ae7
push edi
lea eax, [esp + 0x164]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push esi
push str.fenrir
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4025b7
mov edi, 0x47dc0c
push 0x40d780
push dword [esp + 0x14]
call ebx
mov edx, eax
cmp edx, esi
je 0x401b75
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x160]
push edx
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
mov edi, 0x47e01c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401b70
push edi
lea eax, [esp + 0x164]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push esi
push str.fenrir
jmp 0x401ada
mov edi, 0x47dc0c
push 0x40d774
push dword [esp + 0x14]
call ebx
mov edx, eax
cmp edx, esi
je 0x401bf9
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x160]
push edx
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401bf4
push ebp
lea eax, [esp + 0x164]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push esi
push str.fenrir
jmp 0x401ada
mov edi, 0x47dc0c
push 0x40d768
push dword [esp + 0x14]
call ebx
mov edx, eax
cmp edx, esi
je 0x401c82
and byte [esp + 0x160], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x160]
push edx
push eax
call fcn.00407f2b
pop ecx
lea eax, [esp + 0x164]
pop ecx
mov edi, 0x47e634
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x401c7d
push edi
lea eax, [esp + 0x164]
push 0x40d730
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push esi
push str.fenrir
jmp 0x401ada
mov edi, 0x47dc0c
push 0x40d72c
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x401cd2
push 0x40d72c
push dword [esp + 0x14]
call ebx
mov cl, byte [eax + 3]
add eax, 3
test cl, cl
je 0x401cbf
lea edx, [esp + 0x120]
cmp cl, 0x20
je 0x401cbf
mov cl, byte [eax]
mov byte [edx], cl
mov cl, byte [eax + 1]
inc edx
inc eax
test cl, cl
jne 0x401cad
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [0x40d078], eax
push 0x40d728
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x401d22
push 0x40d728
push dword [esp + 0x14]
call ebx
mov cl, byte [eax + 3]
add eax, 3
test cl, cl
je 0x401d0f
lea edx, [esp + 0x120]
cmp cl, 0x20
je 0x401d0f
mov cl, byte [eax]
mov byte [edx], cl
mov cl, byte [eax + 1]
inc edx
inc eax
test cl, cl
jne 0x401cfd
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [0x40d07c], eax
push str._cmdx
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x401d72
push str._cmdx
push dword [esp + 0x14]
call ebx
mov cl, byte [eax + 6]
add eax, 6
test cl, cl
je 0x401d5f
lea edx, [esp + 0x120]
cmp cl, 0x20
je 0x401d5f
mov cl, byte [eax]
mov byte [edx], cl
mov cl, byte [eax + 1]
inc edx
inc eax
test cl, cl
jne 0x401d4d
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [0x40d078], eax
push str._cmdy
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x401dc2
push str._cmdy
push dword [esp + 0x14]
call ebx
mov cl, byte [eax + 6]
add eax, 6
test cl, cl
je 0x401daf
lea edx, [esp + 0x120]
cmp cl, 0x20
je 0x401daf
mov cl, byte [eax]
mov byte [edx], cl
mov cl, byte [eax + 1]
inc edx
inc eax
test cl, cl
jne 0x401d9d
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [0x40d07c], eax
call fcn.0040998b
push eax
mov dword [0x47ee60], eax
call fcn.004085cf
call fcn.00401085
mov dword [esp], str._cmd
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x401e5c
push str._cmd
push dword [esp + 0x14]
call ebx
mov edi, 0x47d0a4
push eax
push edi
call fcn.00407f2b
pop ecx
pop ecx
push str._cmdfile
push dword [esp + 0x14]
call ebx
cmp eax, esi
je 0x401e1d
push eax
push 0x47d2ac
call fcn.00407f2b
pop ecx
pop ecx
push edi
call fcn.00407e5e
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesA]
push esi
push dword [esp + 0x41d48]
push esi
push esi
push esi
push esi
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push esi
push 0x40dd00
push str.STATIC
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x47ef28], eax
call fcn.004078fe
jmp 0x4025b7
push str._cmdtarget
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x401e75
push str._cmdtarget
jmp 0x401ded
push edi
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
push str._cmd
push dword [esp + 0x14]
call ebx
test eax, eax
jne 0x401ea1
mov edi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push esi
push str.data
call edi
push esi
push 0x40d6f8
call edi
push 0x47e634
lea eax, [esp + 0x164]
push str._s4space.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401ed8
mov dword [0x47d4e0], 1
push 0x47ee80
call fcn.00407dba
pop ecx
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov ebx, str.MAIN
jne 0x4020f3
and byte [esp + 0x570], al
mov ecx, 0x1f3
lea edi, [esp + 0x571]
mov esi, str.SearchMethod1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0xf0]
push 5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop ecx
mov esi, str.SearchMethodInDir2
lea edi, [esp + 0x390]
push 6
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.PriorityStockCounts500
lea edi, [esp + 0x42c]
push 5
rep movsd dword es:[edi], dword [esi]
mov esi, str.HashSize100001
lea edi, [esp + 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.MaxListItemCounts200
lea edi, [esp + 0x3fc]
push 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.ListIcon1
lea edi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.FitWindowSize0
lea edi, [esp + 0x114]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.NoCaption0
lea edi, [esp + 0xd8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.AllowChangeSizeMainWindow0
lea edi, [esp + 0x444]
push 5
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.HideEditAfterExec1
lea edi, [esp + 0x37c]
push 6
rep movsd dword es:[edi], dword [esi]
mov esi, str.TrayIcon1
lea edi, [esp + 0xb0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.ShowStartUp1
lea edi, [esp + 0xe4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
mov esi, str.BackGroundColor4194304
lea edi, [esp + 0x414]
rep movsd dword es:[edi], dword [esi]
mov esi, str.FontColor12632256
lea edi, [esp + 0x368]
mov eax, 0xf0
mov edx, 0x190
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x368]
mov ecx, 0x320
push eax
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x38c]
push eax
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0xec]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x40]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x128]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x458]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x3c0]
push eax
lea eax, [esp + 0x124]
movsw word es:[edi], word [esi]
push eax
lea eax, [esp + 0x5a8]
push str.HotKeyMain240_r_nHotKeySub0_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s_r_n_s
push eax
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], 0xc8
mov dword [esp + 0x74], ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], 0x1b8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x40
lea eax, [esp + 0x570]
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileSectionA]
mov esi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStructA]
push ebp
lea eax, [esp + 0x30]
push 0x10
push eax
push str.MainWindowRect
push ebx
call esi
push ebp
lea eax, [esp + 0x40]
push 0x10
push eax
push str.ListWindowRect
push ebx
call esi
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
push ebp
push 0xf0
push str.HotKeyMain
push ebx
call edi
push ebp
push 1
push str.SearchMethod
push ebx
mov word [0x47f14c], ax
call edi
push ebp
push 2
push str.SearchMethodInDir
push ebx
mov dword [0x47ef1c], eax
call edi
push ebp
push 0x3e8
push str.PriorityStockCounts
push ebx
mov dword [0x47eee4], eax
call edi
push ebp
push 0x186a1
push str.HashSize
push ebx
mov dword [0x47d9cc], eax
call edi
push ebp
push 0x3e8
push str.MaxListItemCounts
push ebx
mov dword [0x47eef4], eax
call edi
push ebp
push 1
push str.ListIcon
push ebx
mov dword [0x47ee5c], eax
call edi
push ebp
push 1
push str.EditIcon
push ebx
mov dword [0x47d9d0], eax
call edi
push ebp
push esi
push str.EditIconDelay
push ebx
mov dword [0x40d080], eax
call edi
push ebp
push esi
push str.FitWindowSize
push ebx
mov dword [0x47d4e8], eax
call edi
push ebp
push esi
push str.NoCaption
push ebx
mov dword [0x47f170], eax
call edi
push ebp
push esi
push str.AllowChangeSizeMainWindow
push ebx
mov dword [0x47d744], eax
call edi
push ebp
push 1
push str.HideEditAfterExec
push ebx
mov dword [0x47ef18], eax
call edi
push ebp
mov dword [0x47eeec], eax
push 1
push str.TrayIcon
push ebx
call edi
push ebp
push 1
push str.ShowStartUp
push ebx
mov dword [0x47ef14], eax
call edi
push ebp
push esi
push str.UseDummyIcon
push ebx
mov dword [0x47d764], eax
call edi
push ebp
push esi
push str.BackGroundColor
push ebx
mov dword [0x47cdf0], eax
call edi
push ebp
push 0xc0c0c0
push str.FontColor
push ebx
mov dword [0x47d9d8], eax
call edi
push ebp
push esi
push str.AddIconIndex
push ebx
mov dword [0x47ef38], eax
call edi
push ebp
push esi
push str.ClientEdge
push ebx
mov dword [0x47cdf8], eax
call edi
push ebp
push esi
push str.AutoRegistrationMode
push ebx
mov dword [0x47f150], eax
call edi
push ebp
push esi
push str.HideKillFocus
push ebx
mov dword [0x47ef10], eax
call edi
push ebp
push esi
push str.CheckPathExist
push ebx
mov dword [0x47eed0], eax
call edi
push ebp
push esi
push str.ImeOffAlways
push ebx
mov dword [0x47eecc], eax
call edi
push ebp
push 0x827
push str.KeyMoveToDir
push ebx
mov dword [0x47d4e4], eax
call edi
push ebp
push 0x825
push str.KeyMoveToParentDir
push ebx
mov word [0x47f178], ax
call edi
push ebp
push 0x826
push str.KeyListCursorUp
push ebx
mov word [0x47ee70], ax
call edi
push ebp
push 0x828
push str.KeyListCursorDown
push ebx
mov word [0x47ef2c], ax
call edi
push ebp
push 1
push str.SingleSel
push ebx
mov word [0x47eee8], ax
call edi
push ebp
push esi
push str.MigemoMode
push ebx
mov dword [0x40d084], eax
call edi
push ebp
push 8
push 0x47f160
push 0x40dd00
push str.MigemoStrings
push ebx
mov dword [0x47d6f4], eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push ebp
push 0x208
push 0x47d4ec
push 0x40dd00
push str.MigemoDictPath
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push ebp
push 3
push str.MigemoStartLen
push ebx
call edi
push ebp
push esi
push str.ListStringsPlacement
push ebx
mov dword [0x47d748], eax
call edi
push ebp
push 1
push str.CompactPath
push ebx
mov dword [0x47ef34], eax
call edi
push ebp
push esi
push str.NoHideAtFilerMode
push ebx
mov dword [0x47d6f8], eax
call edi
push ebp
push 1
push str.ToggleWindowShowHide
push ebx
mov dword [0x47d6fc], eax
call edi
push ebp
push esi
push str.AutoHide
push ebx
mov dword [0x40d088], eax
call edi
push ebp
push 1
push str.ChangePrioriyOfDirectoryBrowsed
push ebx
mov dword [0x47d700], eax
call edi
push ebp
push 0x16
push str.InputHistoryMax
push ebx
mov dword [0x47d760], eax
call edi
mov dword [0x40d090], eax
push ebp
push 3
push str.InputHistoryMinLen
push ebx
call edi
push ebp
push 0x16
push str.ExecuteHistoryMax
push ebx
mov dword [0x40d094], eax
call edi
push ebp
push 1
push str.HideAfterExec
push ebx
mov dword [0x40d098], eax
call edi
push ebp
push 1
push str.ClearWorkingSet
push ebx
mov dword [0x47f158], eax
call edi
push ebp
push esi
push str.LoopListCursor
push ebx
mov dword [0x47eef0], eax
call edi
push ebp
push 0x10
push 0x47d750
push str.MainWindowRect
push ebx
mov dword [0x47d9e0], eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStructA]
push ebp
push 0x10
push 0x47ef00
push str.ListWindowRect
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStructA]
push ebp
push 0x3c
push 0x47ee80
push str.LOGFONT
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStructA]
push ebp
push esi
push str.MainWindowHeightAdd
push ebx
call edi
push ebp
push esi
push str.SearchDelay
push ebx
mov dword [0x47d74c], eax
call edi
mov dword [0x47d9d4], eax
mov ax, word [0x47ef2c]
push eax
call fcn.00408cd5
test eax, eax
pop ecx
je 0x402462
mov dword [0x40d084], 1
mov ax, word [0x47eee8]
push eax
call fcn.00408cd5
test eax, eax
pop ecx
je 0x40247d
mov dword [0x40d084], 1
push 0x47ce00
mov dword [0x47ce00], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [0x47d6f4], esi
je 0x4024ad
call fcn.004084ba
test eax, eax
je 0x4024ad
mov dword [0x40e3b0], 1
push dword [0x47d9d8]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, 0x7f00
mov dword [0x47ee54], eax
mov ebp, dword [esp + 0x41d44]
push edi
push esi
mov dword [esp + 0x84], 0x30
mov dword [esp + 0x88], 3
mov dword [esp + 0x8c], 0x402e83
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], ebp
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
push esi
mov dword [esp + 0x9c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x9c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ebx, str.fenrirMainWindow
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x4025b7
push edi
push esi
mov dword [esp + 0x54], 0x30
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0x4042ab
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], ebp
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
push esi
mov dword [esp + 0x6c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x6c], 5
mov dword [esp + 0x70], esi
mov dword [esp + 0x68], eax
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x78], str.fenrirListWindow
mov dword [esp + 0x7c], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x4025be
xor eax, eax
jmp 0x402e76
cmp dword [0x47d744], esi
je 0x4025e0
mov eax, dword [0x47d74c]
mov edx, 0x82040000
sub eax, dword [0x47ee80]
add eax, 0xe
mov dword [0x47ee58], eax
jmp 0x402613
mov eax, dword [0x47d75c]
push 0x33
sub eax, dword [0x47d754]
mov dword [0x47ee58], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xe
mov edx, 0x2cf0000
pop ecx
sub ecx, dword [0x47ee80]
add eax, ecx
add eax, dword [0x47d74c]
mov dword [0x47ee58], eax
mov ecx, dword [0x47f150]
cmp ecx, esi
je 0x402625
add eax, 6
mov dword [0x47ee58], eax
push esi
mov edi, dword [0x47d758]
push dword [esp + 0x41d48]
and edx, 0xfffcffff
neg ecx
push esi
push esi
push eax
mov eax, dword [0x47d750]
sbb ecx, ecx
sub edi, eax
push edi
mov ebp, 0x200
push dword [0x47d754]
and ecx, ebp
add ecx, 0x188
push eax
push edx
push str.fenrir
push ebx
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExA]
push ecx
call ebx
push esi
push eax
mov dword [esp + 0x1c], eax
mov dword [0x47ef28], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor edi, edi
mov dword [esp + 0x10], eax
push 0x401
push edi
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc edi
cmp edi, 5
jle 0x402683
mov edi, dword [0x47f150]
lea eax, [esp + 0x460]
neg edi
sbb edi, edi
push eax
push dword [0x47ef28]
and edi, ebp
add edi, 0x88
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x47ef0c]
mov eax, dword [0x47ef04]
push esi
mov edx, dword [0x47ef08]
push dword [esp + 0x41d48]
sub ecx, eax
push esi
push esi
push ecx
mov ecx, dword [0x47ef00]
sub edx, ecx
push edx
push eax
push ecx
push 0x82040000
push 0x40dd00
push str.fenrirListWindow
push edi
call ebx
push esi
push esi
push 3
mov dword [0x47eee0], eax
push dword [0x47ef28]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x47ee80
call fcn.00407d77
cmp dword [0x47d764], esi
pop ecx
je 0x40275d
push dword [esp + 0x41d50]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x47ef28]
call fcn.00408577
mov dword [esp], str.fenrir
push dword [0x47ef28]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x40276a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push 0x47e01c
mov dword [0x47ef30], 0x10
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatA]
test eax, eax
jne 0x402844
mov esi, str._.exe_r_n
lea edi, [esp + 0x570]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xfd
xor eax, eax
lea edi, [esp + 0x57a]
and byte [esp + 0x470], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x26
xor eax, eax
pop ecx
lea edi, [esp + 0x471]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x470]
push eax
call fcn.00406408
cmp byte [esp + 0x474], 0
pop ecx
je 0x402819
lea eax, [esp + 0x470]
lea esi, [esp + 0x470]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
jne 0x40280f
push 0x40d010
push esi
call ebx
lea eax, [esp + 0x570]
push esi
push eax
call ebx
add esi, 6
mov eax, esi
cmp byte [esi], 0
jne 0x4027f0
lea eax, [esp + 0x570]
push str._C:Documents_and_SettingsOwnerLocal_Settings
push eax
call ebx
lea eax, [esp + 0x570]
push eax
push 0x47e01c
call fcn.0040644e
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
pop ecx
pop ecx
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov ebp, 0x47e634
lea eax, [esp + 0x160]
push ebp
push eax
call ebx
lea eax, [esp + 0x160]
push str.0enter.txt
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [esp + 0x160]
push eax
call edi
test eax, eax
jne 0x4028a1
lea eax, [esp + 0x570]
push str.__.extension__r_n_MenuTextCommandLineWorkingDirectorynShow_r_n___r_n_r_n_.__r_nShellExecute__P__r_n__r_n
push eax
call ebx
lea eax, [esp + 0x570]
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040644e
pop ecx
pop ecx
lea eax, [esp + 0x160]
push ebp
push eax
call ebx
lea eax, [esp + 0x160]
push str.4enter.txt
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [esp + 0x160]
push eax
call edi
test eax, eax
jne 0x4028f3
lea eax, [esp + 0x570]
push str.__.extension__r_n_MenuTextCommandLineWorkingDirectorynShow_r_n___r_n_r_n_.__r_nParentDirectory__D__r_n__r_n
push eax
call ebx
lea eax, [esp + 0x570]
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040644e
pop ecx
pop ecx
lea eax, [esp + 0x160]
push ebp
push eax
call ebx
lea eax, [esp + 0x160]
push str.0wclick.txt
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [esp + 0x160]
push eax
call edi
test eax, eax
jne 0x402945
lea eax, [esp + 0x570]
push str.__.extension__r_n_MenuTextCommandLineWorkingDirectorynShow_r_n___r_n_r_n_.__r_nShellExecute__P__r_n__r_n
push eax
call ebx
lea eax, [esp + 0x570]
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040644e
pop ecx
pop ecx
lea eax, [esp + 0x160]
push ebp
push eax
call ebx
lea eax, [esp + 0x160]
push str.0rclick.txt
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [esp + 0x160]
push eax
call edi
test eax, eax
jne 0x402997
lea eax, [esp + 0x570]
push str.__.extension__r_n_MenuTextCommandLineWorkingDirectorynShow_r_n___r_n_r_n_.__r_nParentDirectory__D__r_n__r_n
push eax
call ebx
lea eax, [esp + 0x570]
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040644e
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ebp, 0x47de14
mov dword [esp + 0x10], eax
push ebp
call edi
test eax, eax
jne 0x402caa
push str._restart
push dword [esp + 0x14]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
jne 0x402caa
push 4
push str.fenrir
push 0x40d0d0
push dword [0x47ef28]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4029ec
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ax, word [0x40d0cc]
push 0x3f
mov word [esp + 0x474], ax
pop ecx
xor eax, eax
lea edi, [esp + 0x472]
rep stosd dword es:[edi], eax
and byte [esp + 0x21540], 0
mov edx, 0x81ff
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [esp + 0x21541]
and byte [esp + 0xd40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [esp + 0xd41]
and byte [esp + 0x570], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x571]
push 0x47e01c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004012e6
mov edi, eax
lea eax, [esp + 0xd44]
mov dword [esp], 0x40d010
push eax
push edi
mov dword [esp + 0x20], edi
call fcn.00408e55
lea eax, [esp + 0x2154c]
push 0x3b
push eax
push edi
call fcn.00408dac
push 0x20800
mov ebp, 0x40e3b4
push esi
push ebp
call fcn.0040a0e0
add esp, 0x24
cmp byte [esp + 0xf48], 0
je 0x402ae3
mov dword [esp + 0x10], ebp
lea eax, [esp + 0xf48]
lea edi, [esp + 0xf48]
mov ebp, 0x208
cmp byte [eax], 0x2d
jne 0x402ad8
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], ebp
lea ecx, [edi + 1]
push ecx
push eax
call ebx
add edi, ebp
mov eax, edi
cmp byte [edi], 0
jne 0x402ac4
jmp 0x402ae8
mov ebp, 0x208
cmp byte [esp + 0xf48], 0
je 0x402b66
lea edi, [esp + 0xf48]
lea eax, [esp + 0xf48]
mov dword [esp + 0x10], edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x402b59
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
cmp byte [esp + 0x21540], 0
je 0x402b59
lea eax, [esp + 0x21540]
lea edi, [esp + 0x21540]
push eax
lea eax, [esp + 0x474]
push eax
call ebx
lea eax, [esp + 0x470]
push eax
push dword [esp + 0x14]
call fcn.00405cee
add edi, ebp
pop ecx
pop ecx
mov eax, edi
cmp byte [edi], 0
jne 0x402b2e
mov edi, dword [esp + 0x10]
add edi, ebp
mov dword [esp + 0x10], edi
mov eax, edi
cmp byte [edi], 0
jne 0x402b04
push dword [0x42ebc0]
call fcn.004077b9
mov dword [0x42ebc0], eax
mov eax, dword [0x42ebb8]
pop ecx
shl eax, 2
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push esi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_Beep]
mov eax, dword [0x42ebc0]
cmp eax, esi
je 0x402bb2
mov ecx, edi
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [eax + 0xc]
add ecx, 4
cmp eax, esi
jne 0x402ba4
push 0x406496
push 4
push dword [0x42ebb8]
push edi
call fcn.00409f12
mov ecx, dword [0x42ebb8]
add esp, 0x10
xor eax, eax
cmp ecx, esi
jle 0x402bec
lea edi, [edi + ecx*4 - 4]
mov ebp, ecx
push esi
push dword [edi]
push eax
call fcn.0040155b
add esp, 0xc
sub edi, 4
dec ebp
jne 0x402bda
push 0x47de14
push eax
mov dword [0x42ebc0], eax
call fcn.004015f4
push dword [0x42ebc0]
call fcn.004014c9
push eax
push str.Completed._Total_d
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push dword [esp + 0x14]
push dword [0x47ef28]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
lea eax, [esp + 0x574]
push eax
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrA]
lea eax, [esp + 0x570]
push str._key
push eax
call edi
cmp eax, esi
je 0x402c62
mov byte [eax], 0x41
lea eax, [esp + 0x570]
push str._restart
push eax
call edi
test eax, eax
jne 0x402c88
lea eax, [esp + 0x570]
push str.__restart
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x47dc0c
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea eax, [esp + 0x570]
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x47eebc
push ebp
call fcn.00408d21
mov ebp, eax
push 0x47ee68
push ebp
call fcn.004013b6
push ebp
mov dword [0x42ebbc], eax
call fcn.00408d95
push 0xffffffffffffffff
push dword [0x42ebbc]
call fcn.004014da
add esp, 0x1c
mov dword [0x47d718], eax
push 0x40d850
push dword [esp + 0x14]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x402d0a
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x47ef40
call fcn.00408934
pop ecx
cmp dword [0x47ef14], esi
je 0x402dc2
push 0x47e83c
lea eax, [esp + 0x164]
push str._s_tray.ico
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call edi
test eax, eax
jne 0x402d53
lea eax, [esp + 0x160]
push 0x208
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x160]
push esi
push eax
mov dword [esp + 0x3ac], 0x58
push dword [esp + 0x41d4c]
call dword [sym.imp.SHELL32.dll_ExtractIconA]
push str.fenrir
mov dword [esp + 0x3bc], eax
mov eax, dword [0x47ef28]
mov dword [esp + 0x3ac], eax
lea eax, [esp + 0x3c0]
push eax
call ebx
lea eax, [esp + 0x3a4]
mov dword [esp + 0x3ac], esi
push eax
push esi
mov dword [esp + 0x3b8], 7
mov dword [esp + 0x3bc], 0x1000
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ebp, 0x40dd00
mov edi, 0x47ce9c
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x402e01
push edi
push dword [0x47d9dc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 0x208
push eax
push eax
push 0xb1
push dword [0x47d9dc]
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push edi
call ebx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
mov ax, word [0x47f14c]
push eax
call fcn.00406f2d
add esp, 0xc
push dword [esp + 0x18]
push dword [esp + 0x20]
push esi
push dword [0x47ef28]
call dword [sym.imp.USER32.dll_RegisterHotKey]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push esi
push esi
lea eax, [esp + 0xc0]
push esi
push eax
call edi
test eax, eax
je 0x402e6f
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [esp + 0xc0]
push esi
push eax
jmp 0x402e40
mov eax, dword [esp + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41d30
ret 0x10