Function at 0x4013bc
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Enumerate files on windows
Get common file path
Get file size
Parse pe header
Persist via run registry key
Query or enumerate registry value
Read file on windows
Set file attributes
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcac
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0x668], 0
mov dword [0x410aac], 1
mov dword [ebp - 0x148], 0xc
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
push 0x100
push 0x410980
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x410980
push 0x410d40
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Temp
push 0x410d40
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x410d40
push 0x410e80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._vLetter
push 0x410e80
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x410e80
push 0x410840
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Files
push 0x410840
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x148]
push eax
push 0x410d40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x148]
push ecx
push 0x410e80
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [ebp - 0x148]
push edx
push 0x410840
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x40c09c
push 0x410e80
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40c0a0
push 0x410840
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x410840
lea eax, [ebp - 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Test.xyz
lea ecx, [ebp - 0x3ac]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [ebp - 0x3ac]
push edx
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0xca4], eax
cmp dword [ebp - 0xca4], 0xffffffff
jne 0x40154d
push str.Unable_to_create_directory_at_the_following_path____r_n
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x410840
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.Path_Error_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40273a
mov eax, dword [ebp - 0xca4]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004052f0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x520], eax
mov edx, dword [ebp - 0x520]
movsx eax, byte [edx]
cmp eax, 0x22
jne 0x401600
mov ecx, dword [ebp - 0x520]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x530], 0
jmp 0x4015b1
mov edx, dword [ebp - 0x530]
add edx, 1
mov dword [ebp - 0x530], edx
mov eax, dword [ebp - 0x530]
cmp eax, dword [ebp - 0x52c]
jg 0x4015fe
mov ecx, dword [ebp - 0x520]
add ecx, dword [ebp - 0x530]
mov edx, dword [ebp - 0x530]
mov al, byte [ecx + 1]
mov byte [ebp + edx - 0x664], al
mov ecx, dword [ebp - 0x530]
movsx edx, byte [ebp + ecx - 0x664]
cmp edx, 0x22
jne 0x4015fc
mov eax, dword [ebp - 0x530]
mov byte [ebp + eax - 0x664], 0
jmp 0x4015a2
jmp 0x401614
mov ecx, dword [ebp - 0x520]
push ecx
lea edx, [ebp - 0x664]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x664]
push eax
mov ecx, dword [ebp - 0x520]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0xa28], 0
mov dword [ebp - 0x530], 0
jmp 0x401660
mov eax, dword [ebp - 0x530]
add eax, 1
mov dword [ebp - 0x530], eax
mov ecx, dword [ebp - 0x530]
cmp ecx, dword [ebp - 0x52c]
jge 0x401690
mov edx, dword [ebp - 0x520]
add edx, dword [ebp - 0x530]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x40168e
mov ecx, dword [ebp - 0x530]
mov dword [ebp - 0xa28], ecx
jmp 0x401651
mov dword [ebp - 0x530], 0
jmp 0x4016ab
mov edx, dword [ebp - 0x530]
add edx, 1
mov dword [ebp - 0x530], edx
mov eax, dword [ebp - 0x530]
cmp eax, dword [ebp - 0x52c]
jge 0x401702
mov ecx, dword [ebp - 0x530]
add ecx, dword [ebp - 0xa28]
mov edx, dword [ebp - 0x520]
add edx, dword [ebp - 0x530]
mov eax, dword [ebp - 0x520]
mov cl, byte [eax + ecx + 1]
mov byte [edx], cl
mov edx, dword [ebp - 0x520]
add edx, dword [ebp - 0x530]
movsx eax, byte [edx]
cmp eax, 0x2e
jne 0x401700
mov ecx, dword [ebp - 0x520]
add ecx, dword [ebp - 0x530]
mov byte [ecx], 0
jmp 0x40169c
mov edx, dword [ebp - 0x520]
push edx
push 0x410700
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x410e80
push 0x410ac0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Copy.xyz
push 0x410ac0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push pe_nt_image_headers32
push 0x410ac0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x410ac0
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40197d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3b0]
push ecx
push 0x40c100
lea edx, [ebp - 0xa1c]
push edx
call fcn.00405280
add esp, 0xc
mov dword [ebp - 0x528], 0
mov dword [ebp - 0xca8], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x528], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3b0]
push ecx
push 0x40c104
lea edx, [ebp - 0x8f0]
push edx
call fcn.00405280
add esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0xc0000000
push 0x410ac0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xca8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
push eax
push 0x40c108
lea ecx, [ebp - 0x79c]
push ecx
call fcn.00405280
add esp, 0xc
cmp dword [ebp - 0x528], 0
je 0x401859
cmp dword [ebp - 0xca8], 0
je 0x401859
cmp dword [ebp - 0x528], 0xffffffff
je 0x401859
cmp dword [ebp - 0xca8], 0xffffffff
jne 0x4018e3
push 0x30
push str.Copy_File_Error_Number
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push str.CreateFile1_Error_Number
lea eax, [ebp - 0x8f0]
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push str.CreateFile2_Error_Number
lea ecx, [ebp - 0x79c]
push ecx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push 0x40c15c
lea edx, [ebp - 0x664]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push 0x40c168
push 0x410ac0
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40273a
push 0
mov eax, dword [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x524], eax
push 0
lea edx, [ebp - 0xcac]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x528]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0xcac]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x524]
push edx
mov eax, dword [ebp - 0xca8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xca8]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [ebp - 0x528]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xca8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x524]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push 0x410ac0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0xffffffff
jne 0x4019c7
push 0x30
push 0x40c174
push str.Unable_to_open_file_2
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40273a
mov dword [ebp - 0x7a4], 0
push 0
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
push str.
lea eax, [ebp - 0x7c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x530], 0
jmp 0x401a10
mov ecx, dword [ebp - 0x530]
add ecx, 1
mov dword [ebp - 0x530], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x10
cmp dword [ebp - 0x530], edx
jge 0x401c08
mov al, byte [ebp - 0x7c3]
mov byte [ebp - 0x7c4], al
mov cl, byte [ebp - 0x7c2]
mov byte [ebp - 0x7c3], cl
mov dl, byte [ebp - 0x7c1]
mov byte [ebp - 0x7c2], dl
mov al, byte [ebp - 0x7c0]
mov byte [ebp - 0x7c1], al
mov cl, byte [ebp - 0x7bf]
mov byte [ebp - 0x7c0], cl
mov dl, byte [ebp - 0x7be]
mov byte [ebp - 0x7bf], dl
mov al, byte [ebp - 0x7bd]
mov byte [ebp - 0x7be], al
mov cl, byte [ebp - 0x7bc]
mov byte [ebp - 0x7bd], cl
mov dl, byte [ebp - 0x7bb]
mov byte [ebp - 0x7bc], dl
mov al, byte [ebp - 0x7ba]
mov byte [ebp - 0x7bb], al
mov cl, byte [ebp - 0x7b9]
mov byte [ebp - 0x7ba], cl
mov dl, byte [ebp - 0x7b8]
mov byte [ebp - 0x7b9], dl
mov al, byte [ebp - 0x7b7]
mov byte [ebp - 0x7b8], al
mov cl, byte [ebp - 0x7b6]
mov byte [ebp - 0x7b7], cl
mov dl, byte [ebp - 0x7b5]
mov byte [ebp - 0x7b6], dl
push 0
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x7a0]
push ecx
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [ebp - 0x7a0]
mov byte [ebp - 0x7b5], al
movsx ecx, byte [ebp - 0x7c4]
cmp ecx, 0x4b
jne 0x401c03
movsx edx, byte [ebp - 0x7c3]
cmp edx, 0x4f
jne 0x401c03
movsx eax, byte [ebp - 0x7c2]
cmp eax, 0x4d
jne 0x401c03
movsx ecx, byte [ebp - 0x7c1]
cmp ecx, 0x50
jne 0x401c03
movsx edx, byte [ebp - 0x7c0]
cmp edx, 0x52
jne 0x401c03
movsx eax, byte [ebp - 0x7bf]
cmp eax, 0x45
jne 0x401c03
movsx ecx, byte [ebp - 0x7be]
cmp ecx, 0x53
jne 0x401c03
movsx edx, byte [ebp - 0x7bd]
cmp edx, 0x53
jne 0x401c03
movsx eax, byte [ebp - 0x7bc]
cmp eax, 0x45
jne 0x401c03
movsx ecx, byte [ebp - 0x7bb]
cmp ecx, 0x44
jne 0x401c03
movsx edx, byte [ebp - 0x7ba]
cmp edx, 0x46
jne 0x401c03
movsx eax, byte [ebp - 0x7b9]
cmp eax, 0x49
jne 0x401c03
movsx ecx, byte [ebp - 0x7b8]
cmp ecx, 0x4c
jne 0x401c03
movsx edx, byte [ebp - 0x7b7]
cmp edx, 0x45
jne 0x401c03
movsx eax, byte [ebp - 0x7b6]
cmp eax, 0x5a
jne 0x401c03
movsx ecx, byte [ebp - 0x7b5]
cmp ecx, 0x3a
jne 0x401c03
mov dword [ebp - 0x7a4], 1
mov edx, dword [ebp - 0x530]
add edx, 1
mov dword [ebp - 0x4fc], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x530], eax
jmp 0x401a01
cmp dword [ebp - 0x7a4], 0
jne 0x401c8d
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
mov edx, dword [0x4103c0]
push edx
push 0x410fc0
call fcn.00401238
add esp, 0xc
mov dword [ebp - 0x530], 0
jmp 0x401c4f
mov eax, dword [ebp - 0x530]
add eax, 1
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x64
jge 0x401c6f
push 0x410fc0
call fcn.00401318
add esp, 4
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401c40
push 0x30
push 0x40c1ac
push str.No_Compressed_Files_Found
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40273a
push 0
lea ecx, [ebp - 0x4f0]
push ecx
push 1
lea edx, [ebp - 0xa20]
push edx
mov eax, dword [ebp - 0x4f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xa20]
and ecx, 0xff
test ecx, ecx
jne 0x401d37
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
mov eax, dword [0x4103c0]
push eax
push 0x410fc0
call fcn.00401238
add esp, 0xc
mov dword [ebp - 0x530], 0
jmp 0x401cf9
mov ecx, dword [ebp - 0x530]
add ecx, 1
mov dword [ebp - 0x530], ecx
cmp dword [ebp - 0x530], 0x64
jge 0x401d19
push 0x410fc0
call fcn.00401318
add esp, 4
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401cea
push 0x30
push str.File_Error_
push str.Compressed_Files_Not_Found
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40273a
push 0
lea edx, [ebp - 0x4f0]
push edx
push 1
push 0x410aac
mov eax, dword [ebp - 0x4f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [0x410aac], 0
jne 0x401e4a
lea ecx, [ebp - 0x668]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401de2
mov dword [ebp - 0x14c], 0xff
lea edx, [ebp - 0x14c]
push edx
lea eax, [ebp - 0xb54]
push eax
push 0
push 0
push str.Desktop
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0xb54]
push edx
push 0x410c00
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40c248
push 0x410c00
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401df2
push 0x40c24c
push 0x410c00
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x410700
push 0x410c00
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x148]
push ecx
push 0x410c00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x3b8], eax
push 0x40c250
push 0x410c00
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x410c00
push 0x410840
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x410c00
push 0x410e80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0x410aac], 0
je 0x401f3d
push 0x410e80
lea edx, [ebp - 0x4e4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40c254
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x4e4]
push ecx
call fcn.004052f0
add esp, 4
push 0x410840
lea edx, [ebp - 0x4e4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40c260
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xc9c]
push ecx
lea edx, [ebp - 0x4e4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0xffffffff
je 0x401f30
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jle 0x401f18
push 0x410840
lea ecx, [ebp - 0x4e4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0xc70]
push edx
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x4e4]
push ecx
call fcn.004052f0
add esp, 4
lea edx, [ebp - 0xc9c]
push edx
mov eax, dword [ebp - 0xb5c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401ed1
mov ecx, dword [ebp - 0xb5c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0xa20]
and edx, 0xff
imul edx, edx, 3
push edx
mov eax, dword [0x4103c0]
push eax
push 0x410fc0
call fcn.00401238
add esp, 0xc
mov dword [ebp - 0x530], 0
jmp 0x401f7b
mov ecx, dword [ebp - 0x530]
add ecx, 1
mov dword [ebp - 0x530], ecx
mov edx, dword [ebp - 0xa20]
and edx, 0xff
cmp dword [ebp - 0x530], edx
jge 0x402676
push 0
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0xca0]
push ecx
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x4f0]
push eax
mov ecx, dword [ebp - 0xca0]
and ecx, 0xff
push ecx
lea edx, [ebp - 0x280]
push edx
mov eax, dword [ebp - 0x4f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xca0]
and ecx, 0xff
mov byte [ebp + ecx - 0x280], 0
push 0
lea edx, [ebp - 0x4f0]
push edx
push 4
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x4f0]
push edx
push 4
lea eax, [ebp - 0x66c]
push eax
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x4f0]
push edx
push 4
lea eax, [ebp - 0x3b4]
push eax
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x4f0]
push edx
push 4
lea eax, [ebp - 0xb58]
push eax
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x40c264
lea edx, [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402096
push 0x410e80
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020a8
push 0x410840
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0xffffffff
je 0x40218a
lea edx, [ebp - 0x538]
push edx
push 0
push 0
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ecx, dword [ebp - 0x538]
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0x534]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xb58]
jbe 0x402152
push 0x410fc0
call fcn.00401318
add esp, 4
push 0x410fc0
call fcn.00401318
add esp, 4
jmp 0x402664
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xb58]
jne 0x40218a
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x3b4]
jbe 0x40218a
push 0x410fc0
call fcn.00401318
add esp, 4
push 0x410fc0
call fcn.00401318
add esp, 4
jmp 0x402664
mov ecx, dword [ebp - 0x154]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0
jne 0x402208
push str.There_is_not_enough_memory_for_compressed_file:
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.INSUFFICIENT_MEMORY
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x410fc0
call fcn.00401318
add esp, 4
push 0x410fc0
call fcn.00401318
add esp, 4
jmp 0x402664
push 0
lea eax, [ebp - 0x4f0]
push eax
mov ecx, dword [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x4ec]
push edx
mov eax, dword [ebp - 0x4f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x4f0]
cmp ecx, dword [ebp - 0x154]
jae 0x402367
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
push str.Error_reading_compressed_file:
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40c2d8
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0x154]
push eax
push 0x40c2dc
lea ecx, [ebp - 0x51c]
push ecx
call fcn.00405280
add esp, 0xc
lea edx, [ebp - 0x51c]
push edx
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40c2e0
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp - 0x4f0]
push edx
push 0x40c2e4
lea eax, [ebp - 0x51c]
push eax
call fcn.00405280
add esp, 0xc
lea ecx, [ebp - 0x51c]
push ecx
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40c2e8
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0xc]
push ecx
push 0x40c2ec
lea edx, [ebp - 0x51c]
push edx
call fcn.00405280
add esp, 0xc
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.File_Read_Error
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x4f8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4ec]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40273a
mov edx, dword [ebp - 0x66c]
add edx, 0x3e8
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xa24], eax
cmp dword [ebp - 0xa24], 0
jne 0x4023f8
push str.There_is_not_enough_memory_to_expand_file:
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x280]
push ecx
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.INSUFFICIENT_MEMORY_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x4ec]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x410fc0
call fcn.00401318
add esp, 4
push 0x410fc0
call fcn.00401318
add esp, 4
jmp 0x402664
push 0x410fc0
call fcn.00401318
add esp, 4
mov edx, dword [ebp - 0x66c]
mov dword [ebp - 0x4f4], edx
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x4ec]
push ecx
lea edx, [ebp - 0x4f4]
push edx
mov eax, dword [ebp - 0xa24]
push eax
call fcn.00402740
add esp, 0x10
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0
je 0x402506
push str.ZLib_uncompress_file_error:
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x4e8], 0xfffffffc
jne 0x402489
push str.__Z_MEM_ERROR
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x4e8], 0xfffffffb
jne 0x4024a4
push str.__Z_BUF_ERROR
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x4e8], 0xfffffffd
jne 0x4024bf
push str.__Z_DATA_ERROR
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.ZLib_Error_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x4ec]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x410fc0
call fcn.00401318
add esp, 4
jmp 0x402664
push 0x410fc0
call fcn.00401318
add esp, 4
push 0x40c3a0
lea ecx, [ebp - 0x280]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40253d
push 0x410e80
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40254f
push 0x410840
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x280]
push ecx
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0xffffffff
jne 0x4025d2
push str.Unable_to_create_expanded_file:
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.Create_File_Error_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
lea edx, [ebp - 0x4f0]
push edx
mov eax, dword [ebp - 0x4f4]
push eax
mov ecx, dword [ebp - 0xa24]
push ecx
mov edx, dword [ebp - 0x670]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0xb58]
mov dword [ebp - 0x534], ecx
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x538]
push ecx
mov edx, dword [ebp - 0x670]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0x4ec]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 0xa24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x410fc0
call fcn.00401318
add esp, 4
jmp 0x401f6c
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x410aac], 0
je 0x402707
push 0x410e80
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Install.exe
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x402705
push str.Unable_to_run_the_application
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x30
push str.Install_Error_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40273a
push str.Explorer.exe
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x410e80
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret