Function at 0x406d60
Capabilities:
Copy file
Create directory
Create process on windows
Get common file path
Get file version info
Get installed programs
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xab0
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 0x10]
push eax
call fcn.00402a40
add esp, 4
mov dword [ebp - 0x9f8], 0
mov dword [ebp - 0xa98], 0
push 0x104
push 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.0040bfd0
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x498]
push edx
call fcn.0040bfd0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x59c]
push eax
call fcn.0040bfd0
add esp, 0xc
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0x9d0], 0
mov dword [ebp - 0x9d8], 1
mov dword [ebp - 0xa44], 1
mov dword [ebp - 0x9d4], 1
mov dword [ebp - 0xa1c], 0
mov dword [ebp - 0x9c8], 0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
mov byte [ebp - 0x12], cl
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov word [ebp - 8], dx
mov dword [ebp - 0xaa0], 0
mov dword [ebp - 0x9e0], 0
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0xa00], ecx
cmp dword [ebp - 0xa00], 0x104
jae 0x406e6a
jmp 0x406e6f
call fcn.0040b0c7
mov edx, dword [ebp - 0xa00]
mov byte [ebp + edx - 0x124], 0
mov dword [ebp - 0xa38], 5
mov dword [ebp - 0xa48], 0
lea eax, [ebp - 0x20]
push eax
call fcn.00411b23
add esp, 4
lea ecx, [ebp - 0x10]
push ecx
call fcn.00411a59
add esp, 4
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x10]
push eax
push str._s__s
push 0x42c1d4
call fcn.004012e0
add esp, 0x10
push 0
mov ecx, dword [0x42beb8]
push ecx
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x9c4]
call fcn.004032d0
push 0x104
push 0x42c1f8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x421590
push 0x42c1f8
call fcn.00401320
add esp, 8
mov dword [ebp - 0xa04], eax
cmp dword [ebp - 0xa04], 0
je 0x406f1e
mov ecx, dword [ebp - 0xa04]
mov byte [ecx], 0
jmp 0x406f30
push 0x421cb0
push 0x42c1f8
call fcn.0040ff00
add esp, 8
cmp dword [ebp + 0x14], 0
je 0x406f40
mov dword [ebp - 0x9d8], 1
cmp dword [ebp + 0x10], 0
je 0x407197
mov edx, dword [ebp + 0x10]
push edx
call fcn.00412e61
add esp, 4
push str._nogui
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x406f8c
push str._gui
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401320
add esp, 8
test eax, eax
jne 0x406f8c
mov dword [ebp - 0xa08], 0
jmp 0x406f96
mov dword [ebp - 0xa08], 1
mov edx, dword [ebp - 0xa08]
mov dword [ebp - 0x9d8], edx
push str._noserial
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x406fd8
push str._serial
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401320
add esp, 8
test eax, eax
jne 0x406fd8
mov dword [ebp - 0xa0c], 0
jmp 0x406fe2
mov dword [ebp - 0xa0c], 1
mov edx, dword [ebp - 0xa0c]
mov dword [ebp - 0x9d4], edx
push str._calledfromstub
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x40700f
mov dword [ebp - 0xa10], 1
jmp 0x407019
mov dword [ebp - 0xa10], 0
mov ecx, dword [ebp - 0xa10]
mov dword [0x42c304], ecx
push str._ofpid
mov edx, dword [ebp + 0x10]
push edx
call fcn.00401320
add esp, 8
test eax, eax
je 0x407046
mov dword [ebp - 0xa14], 1
jmp 0x407050
mov dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0xa1c], eax
push str._jumpurl
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401320
add esp, 8
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 0
je 0x407197
mov esi, dword [ebp - 0x9c8]
sub esi, dword [ebp + 0x10]
push str._jumpurl
call fcn.00410000
add esp, 4
add esi, eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.00410000
add esp, 4
cmp esi, eax
jae 0x407197
push str._jumpurl
call fcn.00410000
add esp, 4
mov ecx, dword [ebp - 0x9c8]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x9c8], edx
mov eax, dword [ebp - 0x9c8]
movsx ecx, byte [eax]
cmp ecx, 0x7e
jne 0x40716e
push 0x5c
call fcn.0041176d
mov edx, 4
imul ecx, edx, 0
mov edx, dword [eax]
mov eax, dword [edx + ecx]
push eax
call fcn.00406300
add esp, 8
test eax, eax
je 0x40715f
push 0x5c
call fcn.0041176d
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [eax]
mov ecx, dword [eax + edx]
push ecx
call fcn.00406300
add esp, 8
mov esi, eax
call fcn.0041176d
mov edx, 4
imul ecx, edx, 0
mov edx, dword [eax]
sub esi, dword [edx + ecx]
add esi, 1
mov dword [ebp - 0x9e0], esi
mov eax, dword [ebp - 0x9e0]
push eax
call fcn.0041176d
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [eax]
mov ecx, dword [eax + edx]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.00411630
add esp, 0xc
mov eax, dword [ebp - 0x9c8]
add eax, 1
mov dword [ebp - 0x9c8], eax
mov ecx, 0x104
sub ecx, dword [ebp - 0x9e0]
push ecx
mov edx, dword [ebp - 0x9c8]
push edx
mov eax, dword [ebp - 0x9e0]
lea ecx, [ebp + eax - 0x228]
push ecx
call fcn.00411630
add esp, 0xc
push str.uninstall
call fcn.0041176d
mov edx, 4
imul ecx, edx, 0
mov edx, dword [eax]
mov eax, dword [edx + ecx]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x4071c7
mov dword [ebp - 0xa18], 1
jmp 0x4071d1
mov dword [ebp - 0xa18], 0
mov ecx, dword [ebp - 0xa18]
mov dword [ebp - 0x9d0], ecx
cmp dword [ebp - 0x9d0], 0
je 0x407428
cmp dword [ebp - 0xa1c], 0
je 0x4073ea
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0x9fc], 0xa
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0x7a4]
mov dword [ebp - 0x9cc], ecx
mov dword [ebp - 0xab0], 4
push 0x104
lea edx, [ebp - 0x7a4]
push edx
push 0x35
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0xaa4], 0
jmp 0x40725d
mov ecx, dword [ebp - 0x9cc]
add ecx, 1
mov dword [ebp - 0x9cc], ecx
mov edx, dword [ebp - 0x9cc]
movsx eax, byte [edx]
test eax, eax
je 0x4072ca
mov ecx, dword [ebp - 0x9cc]
movsx edx, byte [ecx]
cmp edx, 0x30
jl 0x4072b0
mov eax, dword [ebp - 0x9cc]
movsx ecx, byte [eax]
cmp ecx, 0x39
jg 0x4072b0
mov edx, dword [ebp - 0x9e8]
imul edx, dword [ebp - 0x9fc]
mov eax, dword [ebp - 0x9cc]
movsx ecx, byte [eax]
lea edx, [edx + ecx - 0x30]
mov dword [ebp - 0x9e8], edx
mov dword [ebp - 0x9fc], 0xa
mov eax, dword [ebp - 0x9cc]
movsx ecx, byte [eax]
cmp ecx, 0x3a
jne 0x4072c8
mov dword [ebp - 0x9fc], 6
jmp 0x40724e
call fcn.00405540
test eax, eax
jne 0x4073c5
call fcn.00403f20
test eax, eax
je 0x4072e5
call fcn.00406020
call fcn.00405540
test eax, eax
jne 0x4073c0
push str.OFNUM
call fcn.0040ab50
add esp, 4
mov dword [ebp - 0xa90], eax
mov edx, dword [ebp - 0xa90]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x407318
jmp 0x407322
mov dword [ebp - 0x9f8], 1
cmp dword [ebp - 0x9f8], 0
jne 0x407335
mov dword [ebp - 0x9e4], 0xc8
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xa88], eax
mov ecx, dword [ebp - 0x9e4]
sub ecx, 1
mov dword [ebp - 0x9e4], ecx
cmp dword [ebp - 0xa88], 0
je 0x40738a
mov edx, dword [ebp - 0x9e4]
push edx
push 0x421d10
lea eax, [ebp - 0x25c]
push eax
call fcn.004012e0
add esp, 0xc
lea ecx, [ebp - 0x25c]
push ecx
push str.OFNUM
call fcn.0040ae90
add esp, 8
jmp 0x4073af
call fcn.00405d80
mov dword [ebp - 0xa50], 4
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa50]
jmp 0x407d9a
imul edx, dword [ebp - 0x9e8], 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4072ca
call fcn.00405d80
mov dword [ebp - 0xa54], 0
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa54]
jmp 0x407d9a
push 1
push 0x421d14
push str.This_clears_the_Onflow_Player_from_your_system._nMake_sure_to_close_all_BROWSERS_and_n_Windows_Explorer__prior_to_running_this_program.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x407423
mov dword [ebp - 0xa58], 1
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa58]
jmp 0x407d9a
jmp 0x4075d3
cmp dword [0x42c304], 0
jne 0x4075d3
push 0x104
lea eax, [ebp - 0x6a0]
push eax
push 0x11a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x42c1f8
lea edx, [ebp - 0x394]
push edx
call fcn.0040ff00
add esp, 8
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x394]
push ecx
call fcn.0040ff10
add esp, 8
lea edx, [ebp - 0x394]
push edx
call fcn.00410bc3
add esp, 4
lea eax, [ebp - 0x394]
push eax
call fcn.00412ef4
add esp, 4
push 0x104
lea ecx, [ebp - 0x6a0]
push ecx
push 0x119
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x42c1f8
lea eax, [ebp - 0x394]
push eax
call fcn.0040ff00
add esp, 8
lea ecx, [ebp - 0x69c]
push ecx
lea edx, [ebp - 0x394]
push edx
call fcn.0040ff10
add esp, 8
push 0
lea eax, [ebp - 0x394]
push eax
call fcn.0041176d
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [eax]
mov ecx, dword [eax + edx]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0xaa8]
push edx
lea eax, [ebp - 0xa24]
push eax
push 0
push 0xf003f
push 0
push 0x421437
push 0
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionUninstallOnflow]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x9f0], eax
cmp dword [ebp - 0x9f0], 0
jne 0x4075d3
mov dword [ebp - 0xa20], str.Onflow_Player
mov edx, dword [ebp - 0xa20]
push edx
call fcn.00410000
add esp, 4
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
push eax
mov ecx, dword [ebp - 0xa20]
push ecx
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 0xa24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x9f0], eax
lea eax, [ebp - 0x394]
push eax
call fcn.00410000
add esp, 4
mov dword [ebp - 0x9ec], eax
mov ecx, dword [ebp - 0x9ec]
push ecx
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0x394]
push ecx
push 1
push 0
push str.UninstallString
mov edx, dword [ebp - 0xa24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x9f0], eax
push 0x104
lea eax, [ebp - 0x59c]
push eax
push 9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x421dd4
lea edx, [ebp - 0x59c]
push edx
call fcn.00401320
add esp, 8
test eax, eax
je 0x40760d
mov dword [ebp - 0x9d8], 1
push str.nogui
lea eax, [ebp - 0x59c]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x40762f
mov dword [ebp - 0x9d8], 0
push 0x104
lea ecx, [ebp - 0x498]
push ecx
push 0xa
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push str.serial
lea eax, [ebp - 0x498]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x407669
mov dword [ebp - 0x9d4], 1
push str.noserial
lea ecx, [ebp - 0x498]
push ecx
call fcn.00401320
add esp, 8
test eax, eax
je 0x40768b
mov dword [ebp - 0x9d4], 0
lea edx, [ebp - 0x228]
test edx, edx
je 0x4076a8
lea eax, [ebp - 0x228]
push eax
call fcn.00410000
add esp, 4
test eax, eax
jne 0x4076c9
cmp dword [0x42c304], 0
jne 0x4076c9
push 0x104
lea ecx, [ebp - 0x228]
push ecx
push 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0xa28], 0
mov dword [ebp - 0x9f4], 1
mov dword [ebp - 0xa5c], 0x421590
lea eax, [ebp - 0xa28]
push eax
call fcn.0041176d
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [eax]
mov ecx, dword [eax + edx]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xa2c], eax
mov edx, dword [ebp - 0xa2c]
add edx, 8
push edx
call fcn.00401160
add esp, 4
mov dword [0x42beb8], eax
mov eax, dword [0x42beb8]
push eax
mov ecx, dword [ebp - 0xa2c]
push ecx
mov edx, dword [ebp - 0xa28]
push edx
call fcn.0041176d
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [eax]
mov ecx, dword [eax + edx]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x9f4], eax
lea edx, [ebp - 0xaac]
push edx
push 0x42c3c8
mov eax, dword [ebp - 0xa5c]
push eax
mov ecx, dword [0x42beb8]
push ecx
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 0x9f4], eax
cmp dword [ebp - 0x9f4], 0
je 0x4077b4
mov edx, dword [0x42c3c8]
mov ax, word [edx + 0xa]
mov word [0x42a098], ax
mov ecx, dword [0x42c3c8]
mov dx, word [ecx + 8]
mov word [0x42bebc], dx
mov eax, dword [0x42c3c8]
mov cx, word [eax + 0xe]
mov word [0x42bfc4], cx
push 0x104
push 0x42bec0
push 6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push 0x42bfc8
push 7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push 0x42c0d0
push 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x421df4
call fcn.00410000
add esp, 4
add eax, 0x42bec0
push eax
call fcn.004112cf
add esp, 4
mov dword [0x42c300], eax
push 0x42c0d7
call fcn.004112cf
add esp, 4
mov word [0x42c0cc], ax
push 0x2e
push 0x42c0d0
call fcn.004062e0
add esp, 8
test eax, eax
je 0x40785d
push 0x2e
push 0x42c0d0
call fcn.004062e0
add esp, 8
add eax, 1
push eax
call fcn.004112cf
add esp, 4
mov word [0x42c1f4], ax
push 0x2e
push 0x2e
push 0x42c0d0
call fcn.004062e0
add esp, 8
add eax, 1
push eax
call fcn.004062e0
add esp, 8
test eax, eax
je 0x4078ad
push 0x2e
push 0x2e
push 0x42c0d0
call fcn.004062e0
add esp, 8
add eax, 1
push eax
call fcn.004062e0
add esp, 8
add eax, 1
push eax
call fcn.004112cf
add esp, 4
mov word [0x42c2fc], ax
cmp dword [ebp - 0x9d8], 0
je 0x407991
cmp dword [ebp - 0x9d0], 0
jne 0x407991
lea edx, [ebp - 0x124]
push edx
call fcn.00405060
add esp, 4
test eax, eax
jne 0x4078fa
mov dword [ebp - 0xa60], 0x104
mov eax, dword [ebp - 0xa60]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40792c
push 0x5c
lea edx, [ebp - 0x124]
push edx
call fcn.00406300
add esp, 8
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
je 0x40792c
push str.Plugins
mov eax, dword [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x9b0]
push edx
call fcn.0040ff00
add esp, 8
lea ecx, [ebp - 0x9c4]
call fcn.004038e0
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0xa48], 1
jne 0x407971
cmp dword [ebp - 0x9b4], 0
jne 0x40796f
mov dword [ebp - 0xa44], 0
jmp 0x407991
mov dword [ebp - 0xa64], 1
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa64]
jmp 0x407d9a
lea eax, [ebp - 0xa94]
push eax
lea ecx, [ebp - 0xa6c]
push ecx
push 0
push 0xf003f
push 0
push 0x421437
push 0
mov edx, dword [str.SoftwareOnflow]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0xa68], eax
cmp dword [ebp - 0xa68], 0
jne 0x407ac6
mov dword [ebp - 0x9dc], 0
mov eax, dword [0x42c300]
mov dword [ebp - 0xa30], eax
push str.OFMID
call fcn.0040ab50
add esp, 4
mov dword [ebp - 0x9dc], eax
mov ecx, dword [ebp - 0x9dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x407a3e
mov edx, dword [0x42c300]
push edx
push 0x421e10
lea eax, [ebp - 0x290]
push eax
call fcn.004012e0
add esp, 0xc
lea ecx, [ebp - 0x290]
push ecx
push str.OFMID
call fcn.0040ae90
add esp, 8
jmp 0x407a53
mov edx, dword [ebp - 0x9dc]
push edx
call fcn.004112cf
add esp, 4
mov dword [ebp - 0xa30], eax
push str.OFPID
call fcn.0040ab50
add esp, 4
mov dword [ebp - 0x9dc], eax
mov eax, dword [ebp - 0x9dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x407a81
mov dword [ebp - 0x9d4], 0
mov ecx, dword [ebp - 0xa6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
je 0x407a9d
mov eax, dword [ebp - 0xa30]
mov dword [0x42c300], eax
cmp dword [ebp - 0x9f8], 0
je 0x407ac6
mov dword [ebp - 0xa70], 0xffffffff
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa70]
jmp 0x407d9a
cmp dword [ebp - 0x9d0], 0
je 0x407aee
mov ecx, dword [ebp - 0x9d0]
push ecx
call fcn.00404700
add esp, 4
test eax, eax
je 0x407ae7
call fcn.00406320
push 0
call fcn.00410fe6
cmp dword [ebp - 0xa44], 0
je 0x407b6b
mov edx, dword [ebp - 0x9d0]
push edx
call fcn.00404700
add esp, 4
test eax, eax
je 0x407b17
call fcn.00404630
mov dword [ebp - 0xa38], eax
jmp 0x407b66
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0xa40], ecx
cmp dword [ebp - 0xa40], 0x104
jae 0x407b33
jmp 0x407b38
call fcn.0040b0c7
mov edx, dword [ebp - 0xa40]
mov byte [ebp + edx - 0x228], 0
mov dword [ebp - 0xa74], 0xffffffff
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa74]
jmp 0x407d9a
jmp 0x407c65
lea eax, [ebp - 0x9b0]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x124]
push edx
call fcn.00410000
add esp, 4
cmp eax, 1
jbe 0x407bea
lea eax, [ebp - 0x124]
push eax
call fcn.00410000
add esp, 4
movsx ecx, byte [ebp + eax - 0x125]
cmp ecx, 0x5c
jne 0x407bea
lea edx, [ebp - 0x124]
push edx
call fcn.00410000
add esp, 4
sub eax, 1
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0x104
jae 0x407bd5
jmp 0x407bda
call fcn.0040b0c7
mov eax, dword [ebp - 0xa3c]
mov byte [ebp + eax - 0x124], 0
jmp 0x407b7f
push 0
lea ecx, [ebp - 0x124]
push ecx
push str.User_Defined
push str.ALL
call fcn.004044c0
add esp, 0x10
test eax, eax
je 0x407c16
call fcn.00404630
mov dword [ebp - 0xa38], eax
jmp 0x407c65
mov edx, 1
imul eax, edx, 0
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 0x104
jae 0x407c32
jmp 0x407c37
call fcn.0040b0c7
mov ecx, dword [ebp - 0xa34]
mov byte [ebp + ecx - 0x228], 0
mov dword [ebp - 0xa78], 0xffffffff
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa78]
jmp 0x407d9a
cmp dword [0x42c318], 0
je 0x407c9e
cmp dword [ebp - 0x9d4], 0
je 0x407c9e
cmp dword [0x42c304], 0
jne 0x407c9e
call fcn.00405540
test eax, eax
jne 0x407c9e
call fcn.00403f20
test eax, eax
je 0x407c9e
mov edx, dword [ebp + 8]
push edx
call fcn.00403b70
add esp, 4
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x228]
test edx, edx
je 0x407d0a
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x228]
cmp edx, 0x20
je 0x407d0a
cmp dword [0x42c304], 0
jne 0x407d0a
push 5
push 0
push 0
lea eax, [ebp - 0x228]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0xa7c], 0
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa7c]
jmp 0x407d9a
cmp dword [0x42c318], 0
je 0x407d25
cmp dword [ebp - 0x9d4], 0
je 0x407d25
cmp dword [0x42c304], 0
je 0x407d42
mov dword [ebp - 0xa8c], 0
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa8c]
jmp 0x407d9a
mov dword [ebp - 0xa80], 0xfffffffe
lea ecx, [ebp - 0x9c4]
call fcn.00402260
mov eax, dword [ebp - 0xa80]
jmp 0x407d9a
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret 0x10