Function at 0x40165a
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x174]
sub esp, 0x1bc
mov eax, dword [0x42bca4]
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x170]
mov ecx, eax
mov esi, edx
shl ecx, 0xa
shl esi, 0xa
mov dword [ebp - 0x194], ecx
add ecx, section..ndata
mov dword [ebp - 0x18c], ecx
lea ecx, [ebp - 0x170]
mov dword [0x41283c], ecx
mov ecx, dword [ebp - 0x174]
sub ecx, 2
cmp ecx, 0x41
ja case.0x4016cd.65
lea ebx, [esi + section..ndata]
jmp dword [ecx*4 + 0x40b004]
mov dword [esp + 4], 0
mov dword [esp], edx
jmp 0x401cc4
inc dword [0x42c4c0]
cmp dword [ebp - 0x190], 0
mov edx, 0x7fffffff
je case.0x4016cd.2
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push ebx
mov edx, 0x7fffffff
jmp case.0x4016cd.2
mov dword [esp], edx
call fcn.0040161a
push edx
dec eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403845
mov edx, eax
push ecx
push ecx
jmp case.0x4016cd.2
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.00406d87
jmp 0x4037d4
mov dword [esp], 0
call fcn.00401456
test eax, eax
push edi
mov edx, 1
cmovle eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40219b
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x40219b
cmp dword [ebp - 0x168], 0
jne 0x4017b7
mov eax, dword [edx*4 + 0x42bbe0]
mov dword [esp], 1
mov dword [ebp - 0x18c], edx
mov dword [edx*4 + 0x42bba0], eax
call fcn.00401456
mov edx, dword [ebp - 0x18c]
push esi
jmp 0x4017be
mov eax, dword [edx*4 + 0x42bba0]
mov dword [edx*4 + 0x42bbe0], eax
jmp case.0x4016cd.65
mov ecx, dword [ebp - 0x168]
xor edx, edx
mov eax, dword [ecx*4 + 0x42bbe0]
test eax, eax
sete dl
and eax, dword [ebp - 0x164]
mov edx, dword [ebp + edx*4 - 0x170]
mov dword [ecx*4 + 0x42bbe0], eax
jmp case.0x4016cd.2
mov eax, dword [eax*4 + 0x42bbe0]
jmp 0x402530
mov edx, dword [0x42c4c4]
test edx, edx
je 0x40181c
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
mov eax, dword [0x42c4c8]
test eax, eax
je case.0x4016cd.65
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x40256d
mov dword [esp], 0xfffffff0
call fcn.00401400
mov edx, dword [ebp - 0x16c]
push ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401aff
mov dword [esp], 0xfffffff0
call fcn.00401400
push edi
mov ebx, eax
xor edi, edi
mov dword [esp], eax
call fcn.004076f1
push edx
test eax, eax
je 0x401905
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call fcn.00407660
push esi
push esi
mov esi, eax
mov al, byte [eax]
mov byte [esi], 0
test al, al
mov byte [ebp - 0x18c], al
jne 0x4018c6
cmp dword [ebp - 0x168], 0
je 0x4018c6
call fcn.004080a7
test eax, eax
je 0x4018c6
mov dword [esp], ebx
call fcn.0040746c
test eax, eax
push ecx
je 0x401902
jmp 0x4018d3
mov dword [esp], ebx
call fcn.00407507
test eax, eax
push edx
je 0x4018f0
cmp eax, 0xb7
je 0x4018dd
inc edi
jmp 0x4018f0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
push ecx
cmp eax, 1
adc edi, 0
mov cl, byte [ebp - 0x18c]
lea eax, [esi + 1]
mov byte [esi], cl
test cl, cl
jmp 0x40187c
mov byte [esi], 0
cmp dword [ebp - 0x16c], 0
je 0x401942
mov dword [esp], 0xffffffe6
call fcn.0040163b
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x434800
call fcn.00407a72
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 1
push edx
adc edi, 0
jmp 0x403831
mov dword [esp], 0xfffffff5
jmp 0x403672
mov dword [esp], 0
call fcn.00401400
push ecx
mov dword [esp], eax
call fcn.00407edf
jmp 0x40234f
mov dword [esp], 0xffffffd0
call fcn.00401400
push edx
mov ebx, eax
mov dword [esp], 0xffffffdf
call fcn.00401400
push ecx
mov esi, eax
mov dword [esp], 0x13
call fcn.00401400
push edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
push edx
push edx
je 0x4019b2
mov dword [esp], 0xffffffe3
jmp 0x402bcc
cmp dword [ebp - 0x168], 0
je 0x402a3c
mov dword [esp], ebx
call fcn.00407edf
test eax, eax
push edi
je 0x402a3c
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004080cd
push ebx
push ebx
mov dword [esp], 0xffffffe4
jmp 0x402bcc
mov dword [esp], 0
call fcn.00401400
mov ebx, eax
push ecx
lea eax, [ebp - 0x158]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], 0x400
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x401a5c
mov eax, dword [ebp - 0x158]
xor edi, edi
cmp ebx, eax
jae 0x401a6e
cmp byte [eax], 0
je 0x401a6e
mov dword [esp], ebx
call fcn.00407edf
test eax, eax
push edx
je 0x401a5c
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call fcn.00407a72
push eax
push eax
jmp 0x401a6e
mov eax, dword [ebp - 0x194]
mov edi, 1
mov byte [eax + section..ndata], 0
cmp dword [ebp - 0x168], 0
jne 0x403831
mov eax, dword [ebp - 0x18c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 0xc
jmp 0x403831
mov dword [esp], 0xffffffff
call fcn.00401400
lea edx, [ebp - 0x158]
push edi
xor edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
sub esp, 0x18
test eax, eax
jmp 0x402dab
mov dword [esp], 0xffffffef
call fcn.00401400
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407890
push edx
push edx
jmp 0x402d2d
mov dword [esp], 0x31
call fcn.00401400
push ebx
mov ebx, dword [ebp - 0x170]
mov esi, eax
mov dword [esp], eax
call fcn.004076c3
and ebx, 7
test eax, eax
push edi
je 0x401b3d
mov dword [esp + 4], esi
mov dword [esp], 0x412840
call fcn.00407a72
jmp 0x401b68
mov dword [esp + 4], 0x434800
mov dword [esp], 0x412840
call fcn.00407a72
push edx
push edx
mov dword [esp], eax
call fcn.00407aae
push ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407aa4
push edi
push edi
mov dword [esp], 0x412840
call fcn.00407af3
cmp ebx, 2
push eax
jle 0x401bba
mov dword [esp], 0x412840
call fcn.00407edf
mov edx, eax
xor eax, eax
push ecx
test edx, edx
je 0x401ba9
lea eax, [ebp - 0x164]
add edx, 0x14
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push edx
push edx
sub ebx, 3
or ebx, 0x80000000
test ebx, eax
sete bl
movzx ebx, bl
test ebx, ebx
jne 0x401bd2
mov dword [esp], 0x412840
call fcn.00407802
mov eax, 2
push edi
jmp 0x401bdb
xor eax, eax
cmp ebx, 1
setne al
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x412840
call fcn.00407834
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
jne 0x401cce
test ebx, ebx
je 0x401c27
mov dword [esp + 4], esi
mov dword [esp], 0xffffffe2
call fcn.00406d87
push ecx
push ecx
cmp ebx, 2
sete al
movzx eax, al
mov edi, eax
jmp 0x403831
mov dword [esp + 4], section..ndata
mov dword [esp], 0x413040
call fcn.00407a72
push eax
push eax
mov dword [esp + 4], 0x412840
mov dword [esp], section..ndata
call fcn.00407a72
push eax
push eax
mov eax, dword [ebp - 0x15c]
mov dword [esp], 0x412c40
mov dword [esp + 4], eax
call fcn.00407bc2
push eax
push eax
mov dword [esp + 4], 0x413040
mov dword [esp], section..ndata
call fcn.00407a72
push eax
push eax
mov eax, dword [ebp - 0x170]
mov dword [esp], 0x412c40
sar eax, 3
mov dword [esp + 4], eax
call fcn.004075f2
cmp eax, 4
push edx
push edx
je 0x401bbe
cmp eax, 5
jne 0x401cb5
inc dword [0x42bbe8]
jmp 0x403837
mov dword [esp + 4], 0x412840
mov dword [esp], 0xfffffffa
call fcn.00406d87
jmp 0x402127
mov dword [esp + 4], esi
mov dword [esp], 0xffffffea
call fcn.00406d87
push eax
push eax
mov eax, dword [ebp - 0x168]
inc dword [0x42bc14]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00403af7
dec dword [0x42bc14]
sub esp, 0x10
cmp dword [ebp - 0x164], 0xffffffff
mov ebx, eax
jne 0x401d25
cmp dword [ebp - 0x160], 0xffffffff
je 0x401d47
lea eax, [ebp - 0x164]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
push eax
jns case.0x4016cd.65
cmp ebx, 0xfffffffe
jne 0x401d86
mov dword [esp + 4], 0xffffffe9
mov dword [esp], 0x412840
call fcn.00407bc2
push edi
push edi
mov dword [esp + 4], esi
mov dword [esp], 0x412840
call fcn.00407aa4
jmp 0x401d9a
mov dword [esp + 4], 0xffffffee
mov dword [esp], 0x412840
call fcn.00407bc2
push ebx
push ebx
mov dword [esp + 4], 0x200010
mov dword [esp], 0x412840
jmp 0x402122
mov dword [esp], 0
jmp 0x401e0c
mov dword [esp], 0x31
call fcn.00401400
push edx
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004075f2
test eax, eax
push ecx
push ecx
je 0x402a3c
cmp eax, dword [ebp - 0x168]
je 0x401fe1
cmp eax, dword [ebp - 0x160]
jne case.0x4016cd.65
mov edx, dword [ebp - 0x15c]
jmp case.0x4016cd.2
mov dword [esp], 0xfffffff0
call fcn.00401400
mov edx, dword [ebp - 0x16c]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00408374
jmp 0x4037d4
mov dword [esp], 1
call fcn.00401400
push esi
mov dword [esp], eax
call fcn.00407a9a
jmp 0x40252f
mov dword [esp], 2
call fcn.00401456
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.00401456
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 1
call fcn.00401400
cmp dword [ebp - 0x168], 0
push ecx
mov ecx, eax
mov byte [esi + section..ndata], 0
mov edx, dword [ebp - 0x18c]
je 0x401e92
test edi, edi
je case.0x4016cd.65
mov dword [esp], ecx
mov dword [ebp - 0x190], edx
mov dword [ebp - 0x18c], ecx
call fcn.00407a9a
push edx
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x18c]
test edx, edx
jns 0x401ebf
add edx, eax
js case.0x4016cd.65
cmp eax, edx
mov dword [esp], ebx
cmovg eax, edx
add ecx, eax
mov dword [esp + 4], ecx
call fcn.00407a72
test edi, edi
push ecx
push ecx
je case.0x4016cd.65
jns 0x401eeb
mov dword [esp], ebx
call fcn.00407a9a
add edi, eax
push edx
js 0x401ef9
cmp edi, 0x3ff
jg case.0x4016cd.65
jmp 0x401efb
xor edi, edi
mov byte [edi + esi + section..ndata], 0
jmp case.0x4016cd.65
mov dword [esp], 0x20
call fcn.00401400
push ebx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401400
cmp dword [ebp - 0x160], 0
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x401f3c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x401f42
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push ecx
push ecx
jne 0x401fe1
jmp 0x40235f
mov dword [esp], 1
call fcn.00401400
push edx
mov edi, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
test eax, eax
jne 0x401f8a
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x401fac
cmp dword [ebp - 0x168], 0
jne 0x401f97
xor edi, edi
jmp 0x401fac
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push edi
push edi
je 0x401f7c
jmp 0x401f93
mov byte [ebx + 0x3ff], 0
jmp 0x403831
mov dword [esp], 0
call fcn.00401456
push ebx
mov ebx, eax
mov dword [esp], 1
call fcn.00401456
cmp dword [ebp - 0x15c], 0
push esi
jne 0x401ffd
cmp ebx, eax
jge 0x401fec
mov edx, dword [ebp - 0x164]
jmp case.0x4016cd.2
jle 0x40235f
mov edx, dword [ebp - 0x160]
jmp case.0x4016cd.2
cmp ebx, eax
jb 0x401fe1
ja 0x401ff2
jmp 0x40235f
mov dword [esp], 1
xor edi, edi
call fcn.00401456
push edx
mov esi, eax
mov dword [esp], 2
call fcn.00401456
cmp dword [ebp - 0x164], 0xc
push ecx
mov ecx, eax
ja case.default.0x402037
mov eax, dword [ebp - 0x164]
jmp dword [eax*4 + 0x40b10c]
add esi, ecx
jmp 0x40209a
sub esi, ecx
jmp 0x40209a
imul esi, ecx
jmp 0x40209a
test ecx, ecx
je 0x40209e
mov eax, esi
cdq
idiv ecx
jmp 0x402071
or esi, ecx
jmp 0x40209a
and esi, ecx
jmp 0x40209a
xor esi, ecx
jmp 0x40209a
test esi, esi
sete al
jmp 0x40206e
or esi, ecx
setne al
movzx eax, al
mov esi, eax
jmp 0x40209a
test esi, esi
setne al
xor edx, edx
test ecx, ecx
setne dl
mov esi, edx
and esi, eax
jmp 0x40209a
test ecx, ecx
je 0x40209e
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x40209a
shl esi, cl
jmp 0x40209a
sar esi, cl
xor edi, edi
jmp case.default.0x402037
xor esi, esi
mov edi, 1
mov dword [esp + 4], esi
jmp 0x40232a
mov dword [esp], 1
call fcn.00401400
push ecx
mov esi, eax
mov dword [esp], 2
call fcn.00401456
push edi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp case.0x4016cd.65
mov edx, dword [ebp - 0x168]
mov esi, dword [0x413c40]
test edx, edx
je 0x40216e
mov eax, edx
dec eax
test esi, esi
je 0x402101
test eax, eax
mov esi, dword [esi]
jne 0x4020f2
test esi, esi
jne 0x40212e
mov dword [esp + 4], 0xffffffe8
mov dword [esp], 0
call fcn.00407bc2
push edx
push edx
mov dword [esp + 4], 0x200010
mov dword [esp], eax
call fcn.004075f2
push eax
push eax
jmp 0x40170a
add esi, 4
mov dword [esp], 0x412840
mov dword [esp + 4], esi
call fcn.00407a72
push eax
push eax
mov eax, dword [0x413c40]
mov dword [esp], esi
add eax, 4
mov dword [esp + 4], eax
call fcn.00407a72
push eax
push eax
mov eax, dword [0x413c40]
mov dword [esp + 4], 0x412840
add eax, 4
jmp 0x4036bd
test eax, eax
je 0x4021a1
test esi, esi
je 0x402a3c
lea eax, [esi + 4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407a72
push edi
push edi
mov eax, dword [esi]
mov dword [esp], esi
mov dword [0x413c40], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
jmp case.0x4016cd.65
mov dword [esp + 4], 0x404
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x170]
push edx
push edx
mov dword [esp + 4], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.00407bc2
mov eax, dword [0x413c40]
push ecx
push ecx
mov dword [ebx], eax
mov dword [0x413c40], ebx
jmp case.0x4016cd.65
mov dword [esp], 3
call fcn.00401456
push ecx
mov esi, eax
mov dword [esp], 4
call fcn.00401456
test byte [ebp - 0x15c], 1
push edi
mov edi, eax
je 0x402219
mov dword [esp], 0x33
call fcn.00401400
push edx
mov esi, eax
test byte [ebp - 0x15c], 2
je 0x402231
mov dword [esp], 0x44
call fcn.00401400
push edi
mov edi, eax
cmp dword [ebp - 0x174], 0x21
mov dword [esp], 1
jne 0x4022c6
call fcn.00401456
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 2
call fcn.00401456
mov edx, dword [ebp - 0x15c]
push ecx
sar edx, 2
je 0x4022a9
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x158]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
sub esp, 0x1c
test eax, eax
sete al
movzx eax, al
mov edi, eax
jmp 0x402313
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x402308
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x12
call fcn.00401400
push ecx
xor ecx, ecx
cmp byte [eax], 0
mov edx, dword [ebp - 0x18c]
cmove eax, ecx
cmp byte [edx], 0
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], esi
cmove edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_FindWindowExA]
sub esp, 0x10
mov dword [ebp - 0x158], eax
xor edi, edi
cmp dword [ebp - 0x170], 0
js 0x403831
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040799f
push esi
push esi
jmp 0x403831
mov dword [esp], 0
call fcn.00401456
push ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
push ecx
je 0x40235f
mov edx, dword [ebp - 0x16c]
jmp case.0x4016cd.2
mov edx, dword [ebp - 0x168]
jmp case.0x4016cd.2
mov dword [esp], 2
call fcn.00401456
push esi
mov esi, eax
mov dword [esp], 1
call fcn.00401456
push edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push edx
push edx
jmp 0x402530
add eax, dword [0x42bc68]
mov dword [esp], 0
mov ebx, eax
call fcn.00401456
push ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x40382c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edx
lea eax, [ebp - 0x158]
push edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x168]
mov edi, dword [ebp - 0x14c]
push ecx
push ecx
imul edi, eax
mov dword [esp], 0
imul eax, dword [ebp - 0x150]
mov ebx, eax
call fcn.00401400
push edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadImageA]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x172
mov dword [esp], esi
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
test eax, eax
je case.0x4016cd.65
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x40219b
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push edi
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edx
push edx
mov esi, eax
mov dword [esp], 2
call fcn.00401456
push ecx
mov dword [esp + 4], esi
mov dword [esp + 8], 0x48
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esp, 0xc
neg eax
mov dword [esp], 3
mov dword [0x412800], eax
call fcn.00401456
mov dword [0x412810], eax
mov eax, dword [ebp - 0x160]
push esi
mov byte [0x412817], 1
mov dl, al
mov dword [esp], 0x41281c
and edx, 1
mov byte [0x412814], dl
mov dl, al
and eax, 4
mov byte [0x412816], al
mov eax, dword [ebp - 0x16c]
and edx, 2
mov byte [0x412815], dl
mov dword [esp + 4], eax
call fcn.00407bc2
push edi
push edi
mov dword [esp], 0x412800
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040799f
jmp 0x4037d4
mov dword [esp], 0
call fcn.00401456
push edx
mov ebx, eax
mov dword [esp], 1
call fcn.00401456
cmp dword [ebp - 0x164], 0
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x402578
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4037d4
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4037d4
mov dword [esp], 0
call fcn.00401400
push esi
mov edi, eax
mov dword [esp], 0x31
call fcn.00401400
push edx
mov esi, eax
mov dword [esp], 0x22
call fcn.00401400
push ecx
mov ebx, eax
mov dword [esp], 0x15
call fcn.00401400
push eax
mov dword [esp], 0xffffffec
call fcn.0040163b
push eax
xor eax, eax
cmp byte [ebx], 0
mov edx, dword [ebp - 0x164]
cmove ebx, eax
cmp byte [edi], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x434800
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
cmovne eax, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
cmp eax, 0x20
setle al
jmp 0x401c1d
mov dword [esp], 0
call fcn.00401400
push edx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0xffffffeb
call fcn.00406d87
push ecx
push ecx
mov dword [esp], ebx
call fcn.00407535
test eax, eax
push ebx
mov ebx, eax
je 0x402a3c
cmp dword [ebp - 0x168], 0
je 0x4026b3
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], 0x64
mov dword [esp], ebx
call esi
cmp eax, 0x102
push edi
push edi
jne 0x40267b
mov dword [esp], 0xf
call fcn.00408604
push eax
jmp 0x402656
lea eax, [ebp - 0x158]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x16c], 0
push esi
push esi
js 0x4026b7
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.0040799f
push ecx
push ecx
xor edi, edi
jmp 0x4026c5
xor eax, eax
cmp dword [ebp - 0x158], 0
setne al
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403677
mov dword [esp], 2
call fcn.00401400
push edi
mov dword [esp], eax
call fcn.00407edf
test eax, eax
push edx
mov edi, eax
je 0x40270e
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040799f
push esi
push esi
mov eax, dword [edi + 0x18]
jmp 0x402530
mov eax, dword [ebp - 0x194]
mov byte [esi + section..ndata], 0
mov byte [eax + section..ndata], 0
jmp 0x402a3c
mov dword [esp], 0xffffffee
call fcn.00401400
push edi
mov dword [ebp - 0x190], eax
mov dword [esp], 0xc
call fcn.00408055
mov ecx, dword [ebp - 0x190]
push edx
lea edx, [ebp - 0x17c]
mov dword [esp + 4], edx
mov dword [esp], ecx
call eax
mov edi, eax
mov eax, dword [ebp - 0x194]
push ecx
test edi, edi
mov byte [esi + section..ndata], 0
push ecx
mov byte [eax + section..ndata], 0
je 0x402a3c
mov dword [esp + 4], edi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
push esi
push esi
mov esi, eax
je 0x402a3c
mov dword [esp], 0xd
call fcn.00408055
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], 0xe
call fcn.00408055
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x190]
push ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x194]
sub esp, 0x10
test eax, eax
jne 0x4027ec
mov edi, 1
jmp 0x40284e
lea eax, [ebp - 0x158]
mov dword [esp + 4], 0x40b000
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x178]
mov dword [esp + 8], eax
call dword [ebp - 0x198]
sub esp, 0x10
test eax, eax
je 0x4027e5
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040799f
mov eax, dword [ebp - 0x178]
push edi
push edi
xor edi, edi
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.0040799f
push eax
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403677
cmp dword [0x42bc18], 0
js 0x40297c
mov dword [esp], 0xfffffff0
call fcn.00401400
push ebx
mov edi, eax
mov dword [esp], 1
call fcn.00401400
cmp dword [ebp - 0x160], 0
push esi
mov esi, eax
jne 0x4028b8
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x402970
jmp 0x4028c8
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push ecx
mov ebx, eax
je 0x402890
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push edx
mov edi, eax
push edx
je 0x40292d
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4028fe
mov dword [esp], eax
call fcn.0040163b
push eax
call edi
test eax, eax
setne al
movzx eax, al
mov edi, eax
jmp 0x402944
mov eax, dword [ebp - 0x190]
mov dword [esp + 0x10], 0x40a000
mov dword [esp + 0xc], 0x413c40
mov dword [esp + 8], 0x42f000
mov dword [esp + 4], 0x400
mov dword [esp], eax
call edi
xor edi, edi
jmp 0x402944
mov dword [esp + 4], esi
mov dword [esp], 0xfffffff7
call fcn.00406d87
push edi
push edi
mov edi, 1
cmp dword [ebp - 0x164], 0
jne 0x403831
mov dword [esp], ebx
call fcn.004047e3
test eax, eax
push esi
je 0x403831
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x403677
mov dword [esp], 0xfffffff6
jmp 0x402a36
mov dword [esp], 0xffffffe7
jmp 0x402a36
mov dword [esp], 0xfffffff0
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdf
call fcn.00401400
push ecx
mov edi, eax
mov dword [esp], 2
call fcn.00401400
push ebx
mov dword [ebp - 0x190], eax
mov dword [esp], 0xffffffcd
call fcn.00401400
push esi
mov esi, eax
mov dword [esp], 0x45
call fcn.00401400
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], edi
call fcn.004076c3
test eax, eax
push ecx
jne 0x4029f9
mov dword [esp], 0x21
call fcn.00401400
push eax
lea eax, [ebp - 0x178]
mov dword [esp + 0xc], 0x4108d4
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40c5b4
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jns 0x402a46
mov dword [esp], 0xfffffff0
call fcn.0040163b
push ebx
mov edi, 1
jmp 0x403831
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40ff94
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov ebx, eax
js 0x402bae
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x50]
mov ebx, eax
mov eax, dword [ebp - 0x178]
push edx
push edx
mov edx, dword [eax]
mov dword [esp + 4], 0x434800
mov dword [esp], eax
call dword [edx + 0x24]
mov eax, dword [ebp - 0x160]
push ecx
push ecx
movzx eax, ah
test eax, eax
je 0x402ac1
mov edx, dword [ebp - 0x178]
mov ecx, dword [edx]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x3c]
push eax
push eax
mov eax, dword [ebp - 0x178]
movzx ecx, word [ebp - 0x15e]
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x34]
push eax
push eax
cmp byte [esi], 0
je 0x402b01
mov eax, dword [ebp - 0x178]
movzx ecx, byte [ebp - 0x160]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x190]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x178]
push edi
mov ecx, dword [ebp - 0x194]
push edi
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x1c]
test ebx, ebx
push eax
push eax
js 0x402b9f
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x14], 0x400
mov ebx, 0x80004005
mov dword [esp + 0x10], 0x412000
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
je 0x402b9f
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x412000
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
test ebx, ebx
push ecx
js 0x402a2f
mov dword [esp], 0xfffffff4
call fcn.0040163b
jmp 0x40219b
mov dword [esp], 0
call fcn.00401400
push edi
mov ebx, eax
mov dword [esp], 0x11
call fcn.00401400
push edx
mov esi, eax
mov dword [esp], 0x23
call fcn.00401400
push ecx
mov edi, eax
mov dword [esp], ebx
call fcn.00407edf
test eax, eax
push edx
je 0x402c8d
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [ebp - 0x154], 2
mov dword [ebp - 0x158], eax
call fcn.00407a9a
push edx
mov byte [ebx + eax + 1], 0
mov dword [esp], esi
call fcn.00407a9a
push ecx
mov byte [esi + eax + 1], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x150], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x13e], edi
xor edi, edi
mov word [ebp - 0x148], ax
call fcn.00406d87
lea eax, [ebp - 0x158]
push ebx
push ebx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
push esi
je 0x403831
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00406d87
push edi
push edi
jmp 0x402a3c
cmp edx, 0xbadf00d
jne 0x402101
inc dword [0x42bbf4]
jmp case.0x4016cd.65
xor esi, esi
test edx, edx
je 0x402cd4
mov dword [esp], 0
call fcn.00401400
push esi
mov esi, eax
xor edi, edi
cmp dword [ebp - 0x16c], 0
je 0x402cee
mov dword [esp], 0x11
call fcn.00401400
push ebx
mov edi, eax
xor ebx, ebx
cmp dword [ebp - 0x160], 0
je 0x402d08
mov dword [esp], 0x22
call fcn.00401400
push ecx
mov ebx, eax
mov dword [esp], 0xffffffcd
call fcn.00401400
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
sub esp, 0x10
test eax, eax
jmp 0x401c1a
mov dword [esp], 1
mov dword [ebp - 0x158], 0x7e4e21
call fcn.00401400
push ecx
mov edi, eax
mov dword [esp], 0x12
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdd
call fcn.00401400
push ecx
mov edx, dword [ebp - 0x18c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x158]
mov dword [esp], edi
mov dword [esp + 0x10], 0x3ff
mov dword [esp + 0xc], ebx
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x158]
sub esp, 0x18
cmp dword [esi + section..ndata], eax
jne 0x403831
jmp 0x40345f
cmp dword [ebp - 0x160], 0
jne 0x402e00
mov dword [esp], 2
call fcn.004015b0
test eax, eax
push edx
mov ebx, eax
je 0x402a3c
mov dword [esp], 0x33
call fcn.00401400
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push edi
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x402e41
mov dword [esp], 0x22
call fcn.00401400
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x16c]
push ebx
and ecx, 2
test edx, edx
jne 0x402e2c
mov ebx, dword [0x42bbe4]
lea edx, [ebx - 0x7fffffff]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00401482
sub esp, 0xc
mov esi, eax
test esi, esi
setne al
jmp 0x401c1d
test edx, edx
mov edi, edx
jne 0x402e5c
mov eax, dword [0x42bbe4]
lea edi, [eax - 0x7fffffff]
mov dword [esp], 2
mov ebx, dword [ebp - 0x160]
mov esi, dword [ebp - 0x15c]
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x11
call fcn.00401400
push ecx
lea ecx, [ebp - 0x158]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x42bc10]
mov dword [esp], edi
mov dword [esp + 0x20], 0
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
or ecx, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x403831
cmp ebx, 1
jne 0x402f06
mov dword [esp], 0x23
call fcn.00401400
push ebx
mov dword [esp], 0x413040
call fcn.00407a9a
inc eax
push edi
jmp 0x402f54
cmp ebx, 4
jne 0x402f24
mov dword [esp], 3
call fcn.00401456
mov dword [0x413040], eax
push ecx
mov eax, 4
jmp 0x402f54
xor eax, eax
cmp ebx, 3
jne 0x402f54
mov eax, dword [ebp - 0x164]
mov dword [esp + 0xc], 0xc00
mov dword [esp + 8], 0x413040
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403af7
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x10], 0x413040
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
setne al
movzx eax, al
mov edi, eax
mov eax, dword [ebp - 0x158]
jmp 0x40307b
mov dword [esp], 0x20019
call fcn.004015b0
push edi
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x33
call fcn.00401400
cmp dword [ebp - 0x18c], 0
push edx
mov byte [esi + section..ndata], 0
je 0x402a3c
lea edx, [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x178], 0x3ff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x158]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x40302a
mov eax, dword [ebp - 0x158]
cmp eax, 4
je 0x403038
cmp eax, 1
je 0x403038
cmp eax, 2
je 0x403061
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x403075
cmp eax, 4
jne 0x403061
xor eax, eax
cmp dword [ebp - 0x160], 0
mov dword [esp], ebx
sete al
mov edi, eax
mov eax, dword [esi + section..ndata]
mov dword [esp + 4], eax
call fcn.0040799f
push ecx
push ecx
jmp 0x403075
mov eax, dword [ebp - 0x178]
mov edi, dword [ebp - 0x160]
mov byte [esi + eax + section..ndata], 0
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403677
mov dword [esp], 0x20019
call fcn.004015b0
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.00401456
test edi, edi
push edx
mov byte [esi + section..ndata], 0
je 0x402a3c
cmp dword [ebp - 0x160], 0
mov dword [ebp - 0x158], 0x3ff
je 0x4030e5
mov dword [esp + 0xc], 0x3ff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
sub esp, 0x10
jmp 0x40312b
lea edx, [ebp - 0x158]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
sub esp, 0x20
test eax, eax
jne 0x402a3c
mov byte [ebx + 0x3ff], 0
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40219b
cmp byte [esi + section..ndata], 0
je case.0x4016cd.65
mov dword [esp], ebx
call fcn.004079c4
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40219b
mov dword [esp], 0xffffffed
call fcn.00401400
mov edx, dword [ebp - 0x168]
push edi
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x16c]
mov dword [esp + 4], edx
call fcn.00407834
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402530
jmp 0x40345f
cmp dword [ebp - 0x168], 0
je 0x4031c0
mov dword [esp], 1
call fcn.00401456
mov byte [0x412c40], al
push ecx
mov ecx, 1
jmp 0x4031d8
mov dword [esp], 0x11
call fcn.00401400
push edi
mov dword [esp], eax
call fcn.00407a9a
push edx
mov ecx, eax
cmp byte [esi + section..ndata], 0
mov edi, 1
je 0x403831
mov dword [esp], ebx
mov dword [ebp - 0x18c], ecx
call fcn.004079c4
mov ecx, dword [ebp - 0x18c]
push ebx
lea edx, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x412c40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
jmp 0x402d2d
mov dword [esp], 2
xor edi, edi
call fcn.00401456
test eax, eax
push ecx
mov dword [ebp - 0x190], eax
jle 0x403831
cmp byte [esi + section..ndata], 0
je 0x403360
mov dword [esp], ebx
xor ebx, ebx
call fcn.004079c4
lea ecx, [ebp - 0x178]
push edx
mov esi, eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [ebp - 0x198], ecx
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403360
cmp dword [ebp - 0x158], 1
jne 0x403360
cmp dword [ebp - 0x164], 0
mov ecx, dword [ebp - 0x198]
je 0x4032df
movzx eax, byte [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.0040799f
push esi
push esi
jmp 0x403837
cmp bl, 0xd
mov al, byte [ebp - 0x178]
je 0x4032ef
cmp bl, 0xa
jne 0x403331
cmp al, bl
je 0x4032fb
cmp al, 0xd
je 0x403321
cmp al, 0xa
je 0x403321
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x403360
mov ecx, dword [ebp - 0x194]
mov byte [edi + ecx + section..ndata], al
inc edi
jmp 0x403360
mov bl, al
mov eax, dword [ebp - 0x18c]
inc edi
test bl, bl
mov byte [eax + edi - 1], bl
je 0x403360
cmp dword [ebp - 0x190], 0x3ff
mov eax, 0x3ff
cmovle eax, dword [ebp - 0x190]
cmp eax, edi
jg 0x40326b
mov eax, dword [ebp - 0x194]
test edi, edi
mov byte [edi + eax + section..ndata], 0
jmp 0x401c1a
cmp byte [esi + section..ndata], 0
je case.0x4016cd.65
mov dword [esp], 2
mov edi, dword [ebp - 0x164]
call fcn.00401456
push ecx
mov esi, eax
mov dword [esp], ebx
call fcn.004079c4
push ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp dword [ebp - 0x16c], 0
jns 0x4036cd
jmp case.0x4016cd.65
cmp byte [esi + section..ndata], 0
je case.0x4016cd.65
mov dword [esp], ebx
call fcn.004079c4
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40219b
mov eax, dword [ebp - 0x194]
cmp byte [eax + section..ndata], 0
je 0x40345f
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.004079c4
lea edx, [ebp - 0x158]
push ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
push edi
push edi
je 0x40345f
jmp 0x40347f
mov dword [esp], 2
call fcn.00401400
lea edx, [ebp - 0x158]
push edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
push edx
push edx
jne 0x40346b
mov eax, dword [ebp - 0x194]
mov byte [eax + section..ndata], 0
mov byte [esi + section..ndata], 0
jmp 0x402a3c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.0040799f
push esi
push esi
lea eax, [ebp - 0x12c]
mov dword [esp], ebx
mov dword [esp + 4], eax
jmp 0x4036c0
mov dword [esp], 0xfffffff0
call fcn.00401400
push edx
mov esi, eax
mov dword [esp], eax
call fcn.004076c3
test eax, eax
push ecx
jne 0x4034ba
mov dword [esp], 0xffffffed
call fcn.00401400
push eax
mov dword [esp], esi
call fcn.00407802
push edi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call fcn.00407834
sub esp, 0xc
mov dword [ebp - 0x18c], eax
inc eax
jne 0x403500
mov dword [esp], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xffffffef
push ebx
jmp 0x40366f
mov eax, dword [0x42bc8c]
mov dword [esp], 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x190], eax
mov dword [esp + 4], eax
call edi
test eax, eax
push ecx
mov ebx, eax
push ecx
mov edx, 0xfffffd66
je 0x403644
mov dword [esp], 0
call fcn.00403ac5
push eax
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00403a7d
push eax
push eax
mov eax, dword [ebp - 0x168]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call edi
test eax, eax
push edx
mov edi, eax
push edx
je 0x4035dd
mov eax, dword [ebp - 0x168]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call fcn.00403af7
mov eax, edi
sub esp, 0x10
cmp byte [eax], 0
je 0x4035d3
mov ecx, dword [eax]
lea edx, [eax + 8]
mov dword [esp + 4], edx
mov dword [ebp - 0x194], edx
mov dword [esp + 8], ecx
mov dword [ebp - 0x198], ecx
mov ecx, dword [eax + 4]
add ecx, ebx
mov dword [esp], ecx
call fcn.004077df
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x198]
sub esp, 0xc
lea eax, [edx + ecx]
jmp 0x403594
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00403af7
sub esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x190], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x190]
push edi
test edx, edx
js 0x4034e7
mov eax, 0xfffffff3
xor edi, edi
mov dword [esp], eax
call fcn.0040163b
push ebx
jmp 0x403831
mov dword [esp], 0
call fcn.00401456
cmp dword [0x42bc4c], eax
push ecx
mov ebx, eax
jbe 0x402a3c
imul esi, eax, 0x418
mov eax, dword [ebp - 0x168]
add esi, dword [0x42bc48]
test eax, eax
js 0x4036df
jne 0x4036ca
mov eax, dword [ebp - 0x18c]
add esi, 0x18
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407a72
jmp 0x4037d4
mov eax, dword [esi + eax*4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
jmp 0x402537
not eax
test eax, eax
mov dword [ebp - 0x168], eax
je 0x403700
mov dword [esp], 1
call fcn.00401456
mov dword [ebp - 0x16c], eax
push edx
jmp 0x40371e
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], eax
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.00407bc2
push edi
push edi
or dword [esi + 8], 0x100
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x16c]
mov dword [esi + eax*4], edx
cmp dword [ebp - 0x164], 0
je case.0x4016cd.65
mov dword [esp], ebx
call fcn.0040121c
jmp 0x40219b
mov dword [esp], 0
call fcn.00401456
cmp eax, 0x1f
push ebx
ja 0x402a3c
cmp dword [ebp - 0x164], 0
je 0x4037a0
cmp dword [ebp - 0x168], 0
je 0x40378e
mov dword [esp], eax
call fcn.00401332
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00401282
jmp 0x4037d4
mov dword [esp], 0
call fcn.0040137c
push edx
jmp 0x4036cd
cmp dword [ebp - 0x168], 0
mov edx, dword [0x42bc20]
lea eax, [eax + 0x24]
je 0x4037be
mov ecx, dword [ebp - 0x16c]
mov dword [edx + eax*4 + 4], ecx
jmp case.0x4016cd.65
mov eax, dword [edx + eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407bc2
push eax
push eax
jmp case.0x4016cd.65
and edx, dword [0x428140]
mov eax, dword [ebp - 0x190]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0xb
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
cmp dword [ebp - 0x170], 0
je case.0x4016cd.65
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
xor edi, edi
add dword [0x42bbe8], edi
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 4