Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x10c
push 0
push 0x411378
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x41137c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x411378], eax
call section..text
call fcn.0040df60
call fcn.0040dd4c
call fcn.0040c253
call fcn.0040bd83
call fcn.0040b730
call fcn.0040b3b9
call fcn.0040b1c0
call fcn.0040b1a2
call fcn.0040b119
call fcn.0040a881
call fcn.004098b0
call fcn.00408ac1
call fcn.00408786
call fcn.00408301
call fcn.00407f79
push dword [0x411470]
call fcn.004087a5
push 7
push 0x410234
lea eax, [0x411470]
push eax
push 8
call fcn.004086f4
push 0x411468
push 0x410244
push 7
push 0x401
push 8
call fcn.0040dc4d
mov eax, 0x200
push eax
lea eax, [0x411480]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040c272
push dword [0x411478]
call fcn.004087a5
push 7
push 0x41023c
lea eax, [0x411478]
push eax
push 8
call fcn.004086f4
mov edx, str.Continue_
lea ecx, [0x411390]
call fcn.00405068
mov edx, str.Error_
lea ecx, [0x411450]
call fcn.00405068
mov edx, 0x410025
lea ecx, [0x4113b4]
call fcn.00405068
mov edx, str.Cannot_allocate_the_memory.
lea ecx, [0x411404]
call fcn.00405068
mov edx, str.Wrong_password.
lea ecx, [0x411424]
call fcn.00405068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x411400]
call fcn.00405068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x411438]
call fcn.00405068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x411420]
call fcn.00405068
mov edx, str.Password
lea ecx, [0x41143c]
call fcn.00405068
mov edx, str.Please_enter_the_password.
lea ecx, [0x4113d4]
call fcn.00405068
call fcn.0040966f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011df
push 0x10
push dword [0x411438]
push dword [0x411450]
call fcn.00407fb0
jmp 0x4020bc
lea eax, [0x403274]
push eax
call fcn.00408510
call fcn.0040843f
mov dword [0x41142c], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4113e4], eax
mov edx, dword [0x411750]
push edx
push edx
call fcn.00408452
push 0x411428
call fcn.0040dfe0
push dword [0x411428]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov ebx, dword [0x41142c]
and ebx, ebx
jle 0x401342
mov dword [0x4113b8], 0
mov ebx, dword [0x41142c]
dec ebx
cmp ebx, dword [0x4113b8]
jl 0x4012c5
mov edx, dword [0x411750]
push edx
push edx
push dword [0x4113b8]
call fcn.004083f1
push 0x411414
call fcn.0040dfe0
push dword [0x411414]
mov edx, str._b2epass
pop ecx
call fcn.0040e060
je 0x401289
mov dword [0x4113ac], 1
jmp 0x4012b9
mov ebx, dword [0x4113ac]
cmp ebx, 1
jne 0x4012b9
mov edx, dword [0x411414]
push dword [0x411750]
call fcn.0040e090
push 0x411444
call fcn.0040dfe0
mov dword [0x4113ac], 0
inc dword [0x4113b8]
jno 0x40123e
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1f0
inc dword [0x411750]
mov edx, dword [0x4102fc]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x411750]
push eax
call fcn.0040b1f0
push 0x4113d8
call fcn.0040dfe0
mov edx, dword [0x411428]
push dword [0x411750]
call fcn.0040e090
mov edx, 0x41001f
call fcn.0040e090
mov edx, dword [0x4113d8]
call fcn.0040e090
push 0x4113d8
call fcn.0040dfe0
jmp 0x40135d
mov edx, dword [0x411428]
push dword [0x411750]
call fcn.0040e090
push 0x4113d8
call fcn.0040dfe0
push 0x410097
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401388
mov eax, dword [0x411384]
mov dword [0x41140c], eax
push dword [0x41140c]
call fcn.004033a0
jmp 0x4013a8
push 0x10
push dword [0x411400]
push dword [0x411450]
call fcn.00407fb0
push 1
jmp 0x4020c1
push str.NOPSX
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x4013e1
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411394]
push dword [0x411384]
call fcn.0040b240
push 0x4113fc
call fcn.0040dfe0
jmp 0x401401
push 0x10
push dword [0x411400]
push dword [0x411450]
call fcn.00407fb0
push 1
jmp 0x4020c1
push 0x41007e
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401435
mov eax, dword [0x411384]
mov dword [0x4113bc], eax
mov eax, dword [0x411394]
mov dword [0x411388], eax
mov eax, dword [0x4113bc]
mov dword [0x411434], eax
jmp 0x401455
push 0x10
push dword [0x411400]
push dword [0x411450]
call fcn.00407fb0
push 1
jmp 0x4020c1
push 0x410084
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401487
mov eax, dword [0x411384]
mov dword [0x4113c4], eax
mov eax, dword [0x411394]
mov dword [0x4113cc], eax
mov eax, dword [0x4113c4]
mov dword [0x411408], eax
push 0x410082
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x4014b9
mov eax, dword [0x411384]
mov dword [0x4113c0], eax
mov eax, dword [0x411394]
mov dword [0x41138c], eax
mov eax, dword [0x4113c0]
mov dword [0x411454], eax
push 0x410099
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401751
mov edx, dword [0x411444]
xor ecx, ecx
call fcn.0040e060
jne 0x401500
mov edx, dword [0x411444]
push dword [0x411750]
call fcn.0040e090
push 0x41141c
call fcn.0040dfe0
jmp 0x401674
push 0xc80001
push dword [0x41143c]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00409bc0
push dword [0x4113d4]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00408da3
push 0x20
push 0x41001e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00408f7c
push 0x4101ef
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00409289
push 4
push 0xd
push 0
call fcn.00409be3
push 2
call fcn.004092a9
call fcn.00409de7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4015e0
push dword [0x41144c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4020c1
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401628
call fcn.0040be4c
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401625
mov edx, dword [0x411750]
push edx
push edx
push 2
call fcn.004092e4
push 0x41141c
call fcn.0040dfe0
push 0
call fcn.00409783
add esp, 8
jmp 0x401674
pop eax
jmp 0x40166e
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40166e
call fcn.0040be5b
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40166d
mov edx, dword [0x411750]
push edx
push edx
push 2
call fcn.004092e4
push 0x41141c
call fcn.0040dfe0
push 0
call fcn.00409783
add esp, 8
jmp 0x401674
pop eax
pop eax
jmp 0x4015b6
mov edx, dword [0x411750]
push edx
push edx
push dword [0x41141c]
call fcn.004050d0
push eax
mov eax, dword [0x41141c]
push eax
call fcn.0040c830
inc dword [0x411750]
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411394]
push dword [0x411384]
call fcn.0040b240
pop edx
pop ecx
mov dword [0x411750], ecx
add ecx, dword [0x4102fc]
add edx, dword [0x4102fc]
call fcn.0040e060
jne 0x4016f8
push 0x10
push dword [0x411424]
push dword [0x411450]
call fcn.00407fb0
push dword [0x41144c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x4020c1
push 0x41009b
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401716
mov eax, dword [0x411384]
mov dword [0x411430], eax
push dword [0x41138c]
push dword [0x4113cc]
push dword [0x411388]
push dword [0x411430]
push dword [0x4113c0]
push dword [0x4113c4]
push dword [0x4113bc]
push dword [0x41141c]
push dword [0x4113e4]
call fcn.00403d16
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411388]
push dword [0x411434]
call fcn.0040b240
push 0x4113f8
call fcn.0040dfe0
mov edx, dword [0x411750]
push edx
push edx
push dword [0x4113cc]
push dword [0x411408]
call fcn.0040b240
push 0x4113a4
call fcn.0040dfe0
push 0x410080
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401920
mov edx, dword [0x411750]
push edx
push edx
push 0
call fcn.004083f1
inc dword [0x411750]
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411394]
push dword [0x411384]
call fcn.0040b240
pop edx
pop ecx
mov dword [0x411750], ecx
add ecx, dword [0x4102fc]
add edx, dword [0x4102fc]
call fcn.0040e060
je 0x40180d
mov ebx, dword [0x41142c]
cmp ebx, 1
jne 0x40180d
mov eax, 1
jmp 0x40180f
xor eax, eax
and eax, eax
je 0x401920
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
call fcn.0040b3c5
inc dword [0x411750]
push dword [0x411420]
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.00408023
push 0x4113a0
call fcn.0040dfe0
mov edx, dword [0x4113a0]
xor ecx, ecx
call fcn.0040e060
jne 0x4018ce
mov edx, dword [0x4113a0]
push dword [0x411750]
call fcn.0040e090
push 0x4113f4
call fcn.0040dfe0
push dword [0x4113f4]
call fcn.0040b405
mov edx, dword [0x4113a4]
xor ecx, ecx
call fcn.0040e060
jne 0x4018a0
push dword [0x4113a4]
call fcn.004034ce
push dword [0x4113fc]
push 1
call fcn.0040b8d0
and eax, eax
je 0x4018ce
push dword [0x4113f8]
push 1
call fcn.0040ba50
push 1
call fcn.0040b6b0
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
call fcn.00408452
mov edx, dword [0x4102fc]
add dword [esp], edx
call fcn.0040b417
mov edx, dword [0x4102fc]
add dword [esp], edx
call fcn.0040b405
pop dword [0x411750]
push dword [0x41144c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4020c1
push 0x41009d
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401a5c
push 0x400
call fcn.0040b2e0
mov dword [0x4113dc], eax
mov edx, dword [0x411750]
push edx
push edx
call fcn.0040b48d
push 0x41145c
call fcn.0040dfe0
push dword [0x4113dc]
push 0
push 0x41001e
push dword [0x41145c]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x411750]
push edx
push edx
push dword [0x4113dc]
call fcn.0040b1f0
push 0x411448
call fcn.0040dfe0
push dword [0x4113dc]
call fcn.0040b300
push dword [0x411448]
call fcn.0040b51c
push dword [0x411448]
call fcn.0040b52a
push dword [0x411448]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x411448]
push dword [0x411750]
call fcn.0040e090
mov edx, str.extd.exe
call fcn.0040e090
push 0x4113f0
call fcn.0040dfe0
push dword [0x4113f0]
push 0
call fcn.0040b8d0
push dword [0x411394]
push dword [0x411384]
push 0
call fcn.0040bad0
push 0
call fcn.0040b6b0
mov edx, dword [0x4113f0]
push dword [0x411750]
call fcn.0040e090
push 0x4113e8
call fcn.0040dfe0
push dword [0x4113e8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x4113e8]
push str.b2eextd
call fcn.004084ad
push str._call:extd
push str.extd
call fcn.004084ad
mov edx, dword [0x41144c]
push dword [0x411750]
call fcn.0040e090
mov edx, str.BDFI
call fcn.0040e090
mov edx, dword [0x4113fc]
call fcn.0040e090
push 0x4113fc
call fcn.0040dfe0
push dword [0x4113fc]
push 1
call fcn.0040b8d0
and eax, eax
je 0x401c3b
push str._shift__0
push 1
call fcn.0040bb30
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1f0
inc dword [0x411750]
mov edx, dword [0x4102fc]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x411750]
push eax
call fcn.0040b1f0
inc dword [0x411750]
push str.b2eargs
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x411750]
push dword [0x4113f8]
push 1
call fcn.0040bb30
push 0x41009d
push dword [0x4113e4]
call fcn.00403c03
and eax, eax
je 0x401c2f
mov edx, dword [0x411750]
push edx
push edx
mov ebp, 0x4102f9
mov ebx, ebp
mov ebp, 0x41024c
sub ebx, ebp
push ebx
mov ebp, 0x41024c
push ebp
call fcn.0040b240
push 0x4113c8
call fcn.0040dfe0
push dword [0x4113c8]
call fcn.004050d0
mov dword [0x4113e0], eax
push dword [0x4113e0]
call fcn.0040b2e0
mov dword [0x4113ec], eax
push dword [0x4113e0]
call fcn.0040b2e0
mov dword [0x4113d0], eax
push dword [0x4113c8]
push dword [0x4113ec]
call fcn.0040b320
mov dword [0x4113b8], 0
mov eax, dword [0x4113e0]
cmp eax, dword [0x4113b8]
jl 0x401bf6
mov ebx, dword [0x4113ec]
add ebx, dword [0x4113b8]
mov eax, ebx
call fcn.0040b350
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x4113d0]
add ebx, dword [0x4113b8]
mov eax, ebx
call fcn.0040b360
inc dword [0x4113b8]
jno 0x401bb5
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
push dword [0x4113d0]
call fcn.0040b1f0
inc dword [0x411750]
push 1
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.0040bb30
pop dword [0x411750]
push 1
call fcn.0040b6b0
jmp 0x401c76
push dword [0x4113fc]
call fcn.0040b51c
call fcn.00403fc3
push 0x10
push dword [0x411400]
push dword [0x411450]
call fcn.00407fb0
push dword [0x41144c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x4020c1
mov edx, dword [0x4113a4]
xor ecx, ecx
call fcn.0040e060
jne 0x401c90
push dword [0x4113a4]
call fcn.004034ce
push 0x400
call fcn.0040b2e0
mov dword [0x411440], eax
mov edx, dword [0x411750]
push edx
push edx
call fcn.0040b48d
push 0x41139c
call fcn.0040dfe0
push dword [0x411440]
push 0
push 0x41001e
push dword [0x41139c]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411440]
call fcn.0040b1f0
push 0x411458
call fcn.0040dfe0
mov edx, dword [0x411750]
push edx
push edx
push 0x800
call fcn.00405100
push 0x411410
call fcn.0040dfe0
push dword [0x411750]
push 0x800
push dword [0x411410]
mov edx, dword [0x411750]
push edx
push edx
call fcn.00408452
inc dword [0x411750]
mov edx, dword [0x4102fc]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x411750]
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
call fcn.00408452
inc dword [0x411750]
push str.b2eprogramname
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x411750]
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
call fcn.00408452
mov edx, dword [0x4102fc]
add dword [esp], edx
call fcn.0040b648
inc dword [0x411750]
push str.b2eprogramfilename
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x411750]
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
call fcn.00408452
mov edx, dword [0x4102fc]
add dword [esp], edx
call fcn.0040b417
inc dword [0x411750]
push str.b2eprogrampathname
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x411750]
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
push dword [0x411410]
call fcn.00405200
inc dword [0x411750]
push str.b2eprogramshortname
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x411750]
mov edx, dword [0x4113f4]
push dword [0x411750]
call fcn.0040e090
push 0x411464
call fcn.0040dfe0
push dword [0x411464]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x411464]
push 0x410086
call fcn.004084ad
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
mov eax, dword [0x411398]
cdq
push edx
push eax
call fcn.00405390
inc dword [0x411750]
push str.b2eincfilecount
mov edx, dword [0x4102fc]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x411750]
push dword [0x411458]
push str.b2etempfile
call fcn.004084ad
call fcn.00403bcf
and eax, eax
je 0x401edd
call fcn.0040966f
mov ebx, eax
cmp ebx, 0x41
je 0x401edd
mov eax, 1
jmp 0x401edf
xor eax, eax
and eax, eax
je 0x401f4c
mov edx, dword [0x411750]
push edx
push edx
push 0x800
call fcn.00405100
push 0x411460
call fcn.0040dfe0
push 0x800
push dword [0x411460]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [0x411460]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x411460]
push dword [0x411750]
call fcn.0040e090
mov edx, str.sysnative
call fcn.0040e090
push 0x411460
call fcn.0040dfe0
push dword [0x411460]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x401f83
mov edx, dword [0x411750]
push edx
push edx
push 0x800
call fcn.00405100
push 0x411460
call fcn.0040dfe0
push 0x800
push dword [0x411460]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [0x411460]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x4113fc]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x4113fc]
push dword [0x411750]
call fcn.0040e090
mov edx, 0x41001f
call fcn.0040e090
mov edx, dword [0x4113d8]
call fcn.0040e090
push 0x4113d8
call fcn.0040dfe0
push dword [0x4113d8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x411750]
push edx
push edx
mov edx, 0x4100dc
call fcn.0040e090
mov edx, dword [0x4113d8]
call fcn.0040e090
inc dword [0x411750]
push dword [0x4113f4]
mov edx, dword [0x411460]
push dword [0x411750]
call fcn.0040e090
mov edx, 0x41013d
call fcn.0040e090
mov edx, dword [0x4102fc]
add dword [esp], edx
mov edx, dword [0x4102fc]
add dword [esp + 8], edx
call fcn.004032be
pop dword [0x411750]
mov dword [0x4113b0], eax
call fcn.00403fc3
push dword [0x4113fc]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x4113fc]
call fcn.0040b51c
push dword [0x411458]
call fcn.0040b51c
push dword [0x4113f0]
call fcn.0040b51c
mov edx, dword [0x411750]
push edx
push edx
mov edx, dword [0x411750]
push edx
push edx
push dword [0x411750]
call fcn.00408452
mov edx, dword [0x4102fc]
add dword [esp], edx
call fcn.0040b417
mov edx, dword [0x4102fc]
add dword [esp], edx
call fcn.0040b405
pop dword [0x411750]
push dword [0x411448]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x41144c]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x4113b0]
jmp 0x4020c1
push 0
call 0x4020db
call fcn.0040dfb0
push dword [0x411378]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00408660
call fcn.00408b31
call fcn.00409899
call fcn.0040a90f
call fcn.0040b10d
call fcn.0040b65a
call fcn.0040b720
call fcn.0040c14e
call fcn.0040b1e0
ret