Function at 0x401890
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x19c], eax
push ebx
push ebp
mov ebp, dword [0x4415a4]
push esi
push edi
mov esi, ecx
mov ecx, 7
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x24]
mov dword [0x426500], edx
mov edx, dword [esp + 0x20]
mov edi, eax
mov ebx, ecx
shl edi, 0xa
shl ebx, 0xa
add edx, 0xfffffffe
add edi, section..ndata
add ebx, section..ndata
mov dword [esp + 0x14], 0
cmp edx, 0x41
ja case.0x4018fb.65
jmp dword [edx*4 + 0x403454]
xor ecx, ecx
call fcn.00407330
mov eax, 0x7fffffff
jmp case.0x4018fb.2
inc dword [0x440d6c]
test ebp, ebp
je 0x401925
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 0x7fffffff
jmp case.0x4018fb.2
call fcn.00401600
dec eax
push 0
push eax
call fcn.00401620
jmp case.0x4018fb.2
xor ecx, ecx
call fcn.00407330
jmp case.0x4018fb.65
xor ecx, ecx
call fcn.004016e0
cmp eax, 1
jg 0x40195f
mov eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4018fb.65
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x4018fb.65
cmp dword [esp + 0x2c], 0
jne 0x4019a6
mov ecx, dword [eax*4 + 0x4436a0]
mov dword [eax*4 + 0x443660], ecx
mov ecx, 1
call fcn.004016e0
mov edx, dword [esp + 0x24]
mov dword [edx*4 + 0x4436a0], eax
jmp case.0x4018fb.65
mov ecx, dword [eax*4 + 0x443660]
mov dword [eax*4 + 0x4436a0], ecx
jmp case.0x4018fb.65
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx*4 + 0x4436a0]
xor eax, eax
test ecx, ecx
sete al
and ecx, dword [esp + 0x30]
mov dword [edx*4 + 0x4436a0], ecx
mov eax, dword [esp + eax*4 + 0x24]
jmp case.0x4018fb.2
mov ecx, dword [ecx*4 + 0x4436a0]
push ecx
push 0x4209cc
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
mov edx, dword [0x440d78]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test edx, edx
je 0x401a13
push ecx
push edx
call esi
mov eax, dword [esp + 0x24]
mov ecx, dword [0x440d64]
test ecx, ecx
je case.0x4018fb.65
push eax
push ecx
call esi
jmp case.0x4018fb.65
push eax
push 0x426908
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
mov edx, dword [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
push eax
push 0x426908
call fcn.00408330
mov edi, eax
push edi
call fcn.00408610
call fcn.00407d50
mov esi, eax
test esi, esi
je 0x401abe
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov bl, 0x5c
mov eax, esi
call fcn.00407cd0
mov esi, eax
mov bl, byte [esi]
push 0
push edi
mov byte [esi], 0
call ebp
test eax, eax
jne 0x401ab7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401ab3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x401ab7
inc dword [esp + 0x14]
mov byte [esi], bl
inc esi
test bl, bl
jne 0x401a82
cmp dword [esp + 0x28], 0
mov ecx, 0x426908
je 0x401afd
mov eax, 0xffffffe6
call fcn.00407330
push 0x400
push edi
push 0x449800
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne case.0x4018fb.65
inc dword [esp + 0x14]
jmp case.0x4018fb.65
mov eax, 0xfffffff5
call fcn.00407330
jmp case.0x4018fb.65
push eax
push 0x426508
call fcn.00408330
call fcn.004086f0
test eax, eax
je 0x402052
mov eax, dword [esp + 0x28]
jmp case.0x4018fb.2
push eax
push 0x427108
call fcn.00408330
mov ebx, eax
push ebx
call fcn.00408610
mov eax, dword [0x426500]
mov ecx, dword [eax + 4]
push ecx
push 0x426d08
call fcn.00408330
mov edi, eax
push edi
call fcn.00408610
mov edx, dword [0x426500]
mov eax, dword [edx + 0xc]
push eax
push 0x426908
call fcn.00408330
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x401b8f
mov ecx, 0x426908
mov eax, 0xffffffe3
call fcn.00407330
jmp case.0x4018fb.65
cmp dword [esp + 0x2c], 0
je 0x401a51
mov eax, ebx
call fcn.004086f0
test eax, eax
je 0x401a51
call fcn.004081d0
mov ecx, 0x426908
mov eax, 0xffffffe4
call fcn.00407330
jmp case.0x4018fb.65
push eax
push 0x426508
call fcn.00408330
lea ecx, [esp + 0x18]
push ecx
push ebx
mov esi, eax
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x401c13
mov eax, dword [esp + 0x18]
cmp eax, esi
jbe 0x401c1e
cmp byte [eax], 0
je 0x401c1e
mov eax, esi
call fcn.004086f0
test eax, eax
je 0x401c13
mov edx, dword [esp + 0x18]
push 0x400
add eax, 0x2c
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x401c1e
mov byte [ebx], 0
mov dword [esp + 0x14], 1
cmp dword [esp + 0x2c], 0
jne case.0x4018fb.65
push 0x400
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp case.0x4018fb.65
push ecx
push 0x426508
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
lea eax, [esp + 0x40]
push eax
push edi
push 0x400
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
mov byte [edi], 0
jmp case.0x4018fb.65
push ecx
push 0x426908
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
push esi
push edi
call fcn.00407f90
test eax, eax
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
push ecx
push 0x427108
call fcn.00408330
mov ebx, dword [esp + 0x24]
mov edi, eax
mov edx, edi
mov dword [esp + 0x3c], edi
and ebx, 7
call fcn.00407d20
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x400
test eax, eax
je 0x401ce3
push edi
push 0x426508
call ebp
jmp 0x401cfe
push 0x449800
push 0x426508
call ebp
mov esi, eax
call fcn.00407ca0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x426508
call fcn.00408610
cmp ebx, 3
jl 0x401d3e
mov eax, 0x426508
call fcn.004086f0
xor ecx, ecx
test eax, eax
je 0x401d2e
lea ecx, [esp + 0x30]
push ecx
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
add ebx, 0xfffffffd
or ebx, 0x80000000
and ebx, ecx
neg ebx
sbb ebx, ebx
inc ebx
test ebx, ebx
jne 0x401d50
mov edi, 0x426508
call fcn.00407f40
mov edi, dword [esp + 0x3c]
push 0x426508
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, eax
inc edx
neg edx
sbb edx, edx
and edx, eax
xor eax, eax
cmp ebx, 1
setne al
push 0
push edx
inc eax
push eax
push 0
push 1
push 0x40000000
push 0x426508
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401e39
test ebx, ebx
jne 0x401e0c
push 0x400
push section..ndata
push 0x426d08
call ebp
push 0x400
push 0x426508
push section..ndata
call ebp
mov ecx, dword [esp + 0x38]
push ecx
push 0x426908
call fcn.00408330
push 0x400
push 0x426d08
push section..ndata
call ebp
mov eax, dword [esp + 0x24]
sar eax, 3
push 0x426908
call fcn.00407950
sub eax, 4
je 0x401d08
sub eax, 1
je 0x401e2e
mov ecx, 0x426508
lea eax, [ebx - 6]
call fcn.00407330
mov eax, 0x7fffffff
jmp case.0x4018fb.2
mov ecx, edi
mov eax, 0xffffffe2
call fcn.00407330
cmp ebx, 2
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
inc dword [0x4436a8]
jmp 0x403437
mov ecx, edi
mov eax, 0xffffffea
call fcn.00407330
mov edx, dword [esp + 0x2c]
push 0
push edx
mov ebp, 1
add dword [0x4436d4], ebp
xor edx, edx
mov ecx, esi
call fcn.004039c0
sub dword [0x4436d4], ebp
mov ebx, eax
or eax, 0xffffffff
cmp dword [esp + 0x30], eax
jne 0x401e77
cmp dword [esp + 0x34], eax
je 0x401e88
lea eax, [esp + 0x30]
push eax
push 0
mov ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jge case.0x4018fb.65
cmp ebx, 0xfffffffe
jne 0x401eb6
push 0xffffffffffffffe9
push 0x426508
call fcn.00408330
push edi
push 0x426508
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x401ec2
push 0xffffffffffffffee
push 0x426508
call fcn.00408330
push 0x426508
mov eax, 0x200010
call fcn.00407950
mov eax, 0x7fffffff
jmp case.0x4018fb.2
push eax
push 0x426508
call fcn.00408330
mov edx, dword [esp + 0x28]
push edx
push eax
call fcn.00407a30
jmp case.0x4018fb.65
push ecx
push 0x427108
call fcn.00408330
push eax
mov eax, dword [esp + 0x28]
call fcn.00407950
test eax, eax
je 0x401a51
cmp eax, dword [esp + 0x2c]
jne 0x401f22
mov eax, dword [esp + 0x30]
jmp case.0x4018fb.2
cmp eax, dword [esp + 0x34]
jne case.0x4018fb.65
mov eax, dword [esp + 0x38]
jmp case.0x4018fb.2
push eax
push 0x426908
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
mov eax, dword [esp + 0x28]
push eax
push esi
call fcn.00407a30
jmp case.0x4018fb.65
push ecx
push 0x426508
call fcn.00408330
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x4209cc
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
mov ecx, 2
call fcn.004016e0
mov ecx, 3
mov ebx, eax
call fcn.004016e0
mov ecx, dword [0x426500]
mov edx, dword [ecx + 4]
push edx
push 0x426508
mov esi, eax
call fcn.00408330
cmp dword [esp + 0x2c], 0
mov ebp, eax
mov byte [edi], 0
je 0x401fbf
test ebx, ebx
je case.0x4018fb.65
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test esi, esi
jge 0x401fd2
add esi, eax
js case.0x4018fb.65
cmp esi, eax
jle 0x401fd8
mov esi, eax
push 0x400
add ebp, esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
test ebx, ebx
je case.0x4018fb.65
jge 0x402006
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add ebx, eax
jns 0x402006
xor ebx, ebx
mov byte [ebx + edi], bl
jmp case.0x4018fb.65
cmp ebx, 0x400
jge case.0x4018fb.65
mov byte [ebx + edi], 0
jmp case.0x4018fb.65
push eax
push 0x426d08
call fcn.00408330
mov esi, eax
mov eax, dword [0x426500]
mov ecx, dword [eax + 4]
push ecx
push 0x427108
call fcn.00408330
cmp dword [esp + 0x34], 0
push eax
push esi
jne 0x40205b
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401f19
mov eax, dword [esp + 0x2c]
jmp case.0x4018fb.2
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401f19
mov eax, dword [esp + 0x2c]
jmp case.0x4018fb.2
push ecx
push 0x426508
call fcn.00408330
push 0x400
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4020a3
cmp dword [esp + 0x2c], 0
je 0x4020ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4020ae
mov dword [esp + 0x14], 1
mov byte [edi], 0
mov byte [edi + 0x3ff], 0
jmp case.0x4018fb.65
xor ecx, ecx
call fcn.004016e0
mov ecx, 1
mov esi, eax
call fcn.004016e0
cmp dword [esp + 0x38], 0
jne 0x4020eb
cmp esi, eax
jl 0x401f19
jle 0x402052
mov eax, dword [esp + 0x34]
jmp case.0x4018fb.2
cmp esi, eax
jb 0x401f19
jbe 0x402052
mov eax, dword [esp + 0x34]
jmp case.0x4018fb.2
mov ebx, 1
mov ecx, ebx
call fcn.004016e0
lea ecx, [ebx + 1]
mov esi, eax
call fcn.004016e0
mov ecx, eax
mov eax, dword [esp + 0x30]
cmp eax, 0xc
ja case.default.0x402123
jmp dword [eax*4 + 0x40355c]
add esi, ecx
jmp case.default.0x402123
sub esi, ecx
jmp case.default.0x402123
imul ecx, esi
mov esi, ecx
jmp case.default.0x402123
test ecx, ecx
je 0x402146
mov eax, esi
cdq
idiv ecx
mov esi, eax
jmp case.default.0x402123
xor esi, esi
mov dword [esp + 0x14], ebx
jmp case.default.0x402123
or esi, ecx
jmp case.default.0x402123
and esi, ecx
jmp case.default.0x402123
xor esi, ecx
jmp case.default.0x402123
xor edx, edx
test esi, esi
sete dl
mov esi, edx
jmp case.default.0x402123
test esi, esi
jne 0x40216d
test ecx, ecx
je 0x402179
mov esi, ebx
jmp case.default.0x402123
test esi, esi
je 0x402179
test ecx, ecx
jne 0x40216d
xor esi, esi
jmp case.default.0x402123
test ecx, ecx
je 0x402146
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp case.default.0x402123
shl esi, cl
jmp case.default.0x402123
sar esi, cl
push esi
push 0x4209cc
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
push ecx
push 0x426508
call fcn.00408330
mov ecx, 2
mov esi, eax
call fcn.004016e0
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
mov eax, dword [esp + 0x2c]
mov esi, dword [0x426504]
test eax, eax
je 0x40224f
jmp 0x4021e0
dec eax
test esi, esi
je 0x4021ef
mov esi, dword [esi]
test eax, eax
jne 0x4021e0
test esi, esi
jne 0x40220d
push 0xffffffffffffffe8
push 0
call fcn.00408330
push eax
mov eax, 0x200010
call fcn.00407950
mov eax, 0x7fffffff
jmp case.0x4018fb.2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x400
add esi, 4
push esi
push 0x426508
call edi
mov eax, dword [0x426504]
push 0x400
add eax, 4
push eax
push esi
call edi
mov ecx, dword [0x426504]
push 0x400
push 0x426508
add ecx, 4
push ecx
call edi
jmp case.0x4018fb.65
test ecx, ecx
je 0x40227e
test esi, esi
je 0x401a51
push 0x400
lea edx, [esi + 4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esi]
push esi
mov dword [0x426504], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x4018fb.65
push 0x404
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x24]
mov esi, eax
push ecx
lea edx, [esi + 4]
push edx
call fcn.00408330
mov eax, dword [0x426504]
mov dword [esi], eax
mov dword [0x426504], esi
jmp case.0x4018fb.65
mov ecx, 3
call fcn.004016e0
mov ecx, 4
mov esi, eax
call fcn.004016e0
test byte [esp + 0x38], 1
mov ebp, eax
je 0x4022e2
mov ecx, dword [0x426500]
mov edx, dword [ecx + 0xc]
push edx
push 0x427108
call fcn.00408330
mov esi, eax
test byte [esp + 0x38], 2
je 0x4022fe
mov eax, dword [0x426500]
mov ecx, dword [eax + 0x10]
push ecx
push 0x427508
call fcn.00408330
mov ebp, eax
cmp dword [esp + 0x20], 0x21
jne 0x40234f
mov ecx, 1
call fcn.004016e0
mov ecx, 2
mov ebx, eax
call fcn.004016e0
mov ecx, dword [esp + 0x38]
sar ecx, 2
test ecx, ecx
je 0x402343
lea edx, [esp + 0x18]
push edx
push ecx
push 0
push ebp
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jmp 0x402398
push ebp
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x402394
mov eax, dword [0x426500]
mov ecx, dword [eax + 4]
push ecx
push 0x426508
call fcn.00408330
mov edx, dword [0x426500]
mov ebx, eax
mov eax, dword [edx + 8]
push eax
push 0x426908
call fcn.00408330
movsx ecx, byte [eax]
movsx edx, byte [ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
neg edx
push ecx
sbb edx, edx
and edx, ebx
push edx
push ebp
push esi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x24], 0
jl case.0x4018fb.65
mov eax, dword [esp + 0x18]
jmp 0x401f6a
xor ecx, ecx
call fcn.004016e0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x401b1c
mov ecx, 2
call fcn.004016e0
push eax
mov ecx, 1
call fcn.004016e0
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401f6a
mov edx, dword [0x4415e8]
lea eax, [edx + ecx]
push eax
push 0xffffffffffffffeb
xor ecx, ecx
call fcn.004016e0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x4018fb.65
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x48]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [0x426500]
mov edx, dword [ecx]
push edx
push 0x426508
call fcn.00408330
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x54]
imul edx, ecx
push 0x10
push edx
mov edx, dword [esp + 0x58]
imul edx, ecx
push edx
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je case.0x4018fb.65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x4018fb.65
push ebp
call dword [sym.imp.USER32.dll_GetDC]
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov ecx, 2
call fcn.004016e0
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push esi
neg eax
push ebp
mov dword [0x427908], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 3
call fcn.004016e0
mov dword [0x427918], eax
mov al, byte [esp + 0x34]
mov cl, al
mov dl, al
and al, 4
mov byte [0x42791e], al
mov eax, dword [esp + 0x28]
push eax
and cl, 1
and dl, 2
push 0x427924
mov byte [0x42791c], cl
mov byte [0x42791d], dl
mov byte [0x42791f], 1
call fcn.00408330
push 0x427908
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x401f6a
xor ecx, ecx
call fcn.004016e0
mov ecx, 1
mov esi, eax
call fcn.004016e0
cmp dword [esp + 0x30], 0
push eax
push esi
jne 0x40251e
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x4018fb.65
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x4018fb.65
push eax
push 0x426508
call fcn.00408330
mov ecx, dword [0x426500]
mov edx, dword [ecx + 4]
push edx
push 0x427108
mov esi, eax
call fcn.00408330
mov ebx, eax
mov eax, dword [0x426500]
mov ecx, dword [eax + 8]
push ecx
push 0x426d08
call fcn.00408330
mov edx, dword [0x426500]
mov edi, eax
mov eax, dword [edx + 0x14]
push eax
push 0x426908
call fcn.00408330
mov ecx, 0x426908
mov eax, 0xffffffec
call fcn.00407330
movsx edx, byte [edi]
mov ecx, dword [esp + 0x30]
movsx eax, byte [esi]
neg edx
push ecx
sbb edx, edx
push 0x449800
and edx, edi
neg eax
push edx
sbb eax, eax
push ebx
and eax, esi
push eax
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jge case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
push eax
push 0x426508
call fcn.00408330
mov esi, eax
mov ecx, esi
mov eax, 0xffffffeb
call fcn.00407330
mov ecx, esi
call fcn.00407900
mov edi, eax
test edi, edi
je 0x401a51
cmp dword [esp + 0x2c], 0
je 0x40265b
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push edi
call ebp
cmp eax, 0x102
jne 0x402619
mov esi, 0xf
call fcn.00408720
push 0x64
push edi
call ebp
cmp eax, 0x102
je 0x402603
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x28], 0
jl 0x40264c
mov edx, dword [esp + 0x18]
push edx
push 0x4209cc
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4018fb.65
cmp dword [esp + 0x18], 0
je 0x40265b
mov dword [esp + 0x14], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4018fb.65
mov eax, dword [esp + 0x2c]
push eax
push 0x426508
call fcn.00408330
call fcn.004086f0
mov esi, eax
test esi, esi
je 0x4026aa
mov ecx, dword [esi + 0x14]
push ecx
push 0x4209cc
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
call ebx
mov edx, dword [esi + 0x18]
add esp, 0xc
push edx
push 0x4209cc
push edi
call ebx
add esp, 0xc
jmp case.0x4018fb.65
mov byte [edi], 0
mov byte [ebx], 0
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
mov eax, dword [esp + 0x2c]
push eax
push 0x426908
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
lea ecx, [esp + 0x40]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
mov byte [edi], 0
mov byte [ebx], 0
mov dword [esp + 0x14], 1
test ebp, ebp
je case.0x4018fb.65
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x3c], eax
test eax, eax
je case.0x4018fb.65
push eax
push ebp
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40276b
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x420124
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40276b
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push 0x4209cc
push edi
call esi
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0xc]
add esp, 0xc
push edx
push 0x4209cc
push ebx
call esi
add esp, 0xc
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x4018fb.65
cmp dword [0x4436d8], 0
mov dword [esp + 0x14], 1
jl 0x402897
push eax
push 0x426908
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
mov ecx, dword [0x426500]
mov edx, dword [ecx + 4]
push edx
push 0x426508
call fcn.00408330
cmp dword [esp + 0x34], 0
mov ebx, eax
je 0x4027cd
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x4027e9
mov eax, esi
call fcn.004015c0
test eax, eax
je 0x402821
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
je 0x402835
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402865
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
test eax, eax
je 0x402849
mov ecx, 0x426908
call fcn.00407330
call esi
test eax, eax
je 0x402871
mov dword [esp + 0x14], 1
jmp 0x402871
push 0
push 0x420128
push 0x420140
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x426908
mov eax, 0xfffffff6
call fcn.00407330
jmp case.0x4018fb.65
push 0x4255c0
push 0x426504
push section..ndata
push 0x400
push ebp
call esi
add esp, 0x14
jmp 0x402871
mov ecx, ebx
mov eax, 0xfffffff7
call fcn.00407330
cmp dword [esp + 0x30], 0
jne case.0x4018fb.65
mov ecx, edi
call fcn.00405760
test eax, eax
je case.0x4018fb.65
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x4018fb.65
mov ecx, 0x426908
mov eax, 0xffffffe7
call fcn.00407330
jmp case.0x4018fb.65
push eax
push 0x426908
call fcn.00408330
mov ebp, eax
push ebp
call fcn.00408610
mov eax, dword [0x426500]
mov ecx, dword [eax + 4]
push ecx
push 0x426d08
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
mov edx, dword [0x426500]
mov eax, dword [edx + 8]
push eax
push 0x426508
call fcn.00408330
mov ecx, dword [0x426500]
mov edx, dword [ecx + 0xc]
push edx
push 0x427108
mov dword [esp + 0x4c], eax
call fcn.00408330
mov ebx, eax
push ebx
call fcn.00408610
mov eax, dword [0x426500]
mov ecx, dword [eax + 0x14]
push ecx
push 0x427508
call fcn.00408330
mov edx, esi
mov dword [esp + 0x40], eax
call fcn.00407d20
test eax, eax
jne 0x402943
mov edx, dword [0x426500]
mov eax, dword [edx + 4]
push eax
push 0x426d08
call fcn.00408330
lea ecx, [esp + 0x18]
push ecx
push 0x4200f4
push 1
push 0
push 0x420104
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x402a69
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x3c]
push ecx
push 0x420114
push eax
call edx
mov edi, eax
test edi, edi
jl 0x402a59
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov edi, eax
mov eax, dword [esp + 0x34]
test eax, 0x8000
jne 0x4029b2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0x449800
push eax
call edx
mov eax, dword [esp + 0x34]
mov ecx, eax
sar ecx, 8
and ecx, 0x7f
je 0x4029cd
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x3c]
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
sar eax, 0x10
push eax
mov eax, dword [edx + 0x34]
push ecx
call eax
cmp byte [ebx], 0
je 0x4029fa
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
and edx, 0xff
push edx
push ebx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x44]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x40]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test edi, edi
jl 0x402a4d
push 0x400
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x402a4d
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push esi
push eax
call edx
mov edi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
jge 0x402a85
mov ecx, 0x426908
mov eax, 0xfffffff0
mov dword [esp + 0x14], 1
call fcn.00407330
jmp case.0x4018fb.65
mov ecx, 0x426908
mov eax, 0xfffffff4
call fcn.00407330
jmp case.0x4018fb.65
push eax
push 0x426508
call fcn.00408330
mov esi, eax
mov eax, dword [0x426500]
mov ecx, dword [eax + 4]
push ecx
push 0x426908
call fcn.00408330
mov edx, dword [0x426500]
mov edi, eax
mov eax, dword [edx + 0xc]
push eax
push 0x426d08
call fcn.00408330
mov ebx, eax
mov eax, esi
call fcn.004086f0
test eax, eax
je 0x402b30
mov dword [esp + 0x48], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov dword [esp + 0x50], 2
call ebp
push edi
mov byte [eax + esi + 1], 0
call ebp
mov byte [eax + edi + 1], 0
mov cx, word [esp + 0x2c]
mov word [esp + 0x58], cx
mov ecx, ebx
xor eax, eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x62], ebx
call fcn.00407330
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.0x4018fb.65
xor ecx, ecx
lea eax, [ecx - 7]
call fcn.00407330
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
cmp eax, 0xbadf00d
jne 0x4021ef
inc dword [0x4436b4]
jmp case.0x4018fb.65
xor edi, edi
xor ebp, ebp
xor ebx, ebx
test eax, eax
je 0x402b78
push eax
push 0x426508
call fcn.00408330
mov ecx, dword [esp + 0x28]
mov edi, eax
test ecx, ecx
je 0x402b91
mov eax, dword [0x426500]
mov ecx, dword [eax + 4]
push ecx
push 0x426908
call fcn.00408330
mov ebp, eax
cmp dword [esp + 0x34], ebx
je 0x402bad
mov edx, dword [0x426500]
mov eax, dword [edx + 8]
push eax
push 0x426d08
call fcn.00408330
mov ebx, eax
mov ecx, dword [0x426500]
mov edx, dword [ecx + 0xc]
push edx
push 0x427108
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
push esi
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
push ecx
mov eax, 0xa
push 0x426508
mov word [esp + 0x20], ax
call fcn.00408330
mov ecx, dword [0x426500]
mov edx, dword [ecx + 8]
push edx
push 0x426908
mov ebx, eax
call fcn.00408330
mov ebp, eax
mov eax, dword [0x426500]
mov ecx, dword [eax + 0xc]
push ecx
push 0x426d08
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
push esi
push 0x3ff
push edi
lea edx, [esp + 0x24]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [edi], 0xa
jmp 0x401c66
cmp dword [esp + 0x34], 0
jne 0x402c86
push 2
call fcn.00401830
mov esi, eax
test esi, esi
je 0x402cc2
mov eax, dword [0x426500]
mov ecx, dword [eax + 0xc]
push ecx
push 0x427108
call fcn.00408330
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402cba
mov edx, dword [esp + 0x2c]
push edx
push 0x426d08
call fcn.00408330
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x402ca9
mov ecx, dword [0x4436a4]
add ecx, 0x80000001
mov edx, dword [esp + 0x34]
and edx, 2
push edx
push eax
push ecx
call fcn.00401700
mov edi, eax
test edi, edi
je case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
test eax, eax
je 0x402cd7
mov edi, eax
jmp 0x402ce3
mov edi, dword [0x4436a4]
add edi, 0x80000001
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
push eax
push 0x426508
call fcn.00408330
mov ecx, dword [0x426500]
mov edx, dword [ecx + 4]
push edx
push 0x426908
mov ebp, eax
call fcn.00408330
mov edx, dword [0x4436d0]
push 0
lea ecx, [esp + 0x40]
push ecx
push 0
or edx, 2
push edx
push 0
push 0
push 0
push eax
push edi
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne case.0x4018fb.65
cmp esi, 1
jne 0x402d67
mov eax, dword [0x426500]
mov ecx, dword [eax + 0xc]
push ecx
push 0x426d08
call fcn.00408330
push 0x426d08
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
jmp 0x402d98
cmp esi, 4
jne 0x402d7d
lea ecx, [esi - 1]
call fcn.004016e0
mov dword [0x426d08], eax
mov eax, esi
jmp 0x402d98
cmp esi, 3
jne 0x402d98
mov edx, dword [esp + 0x30]
push 0x426d08
push edx
mov edx, 0xc00
xor ecx, ecx
call fcn.004039c0
push eax
mov eax, dword [esp + 0x40]
push 0x426d08
push ebx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402db5
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4018fb.65
push 0x20019
call fcn.00401830
mov edx, dword [0x426500]
mov esi, eax
mov eax, dword [edx + 0xc]
push eax
push 0x427108
call fcn.00408330
mov byte [edi], 0
test esi, esi
je 0x401a51
lea ecx, [esp + 0x40]
push ecx
push edi
lea edx, [esp + 0x4c]
push edx
push 0
push eax
push esi
mov dword [esp + 0x58], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402e6a
mov eax, dword [esp + 0x44]
cmp eax, 4
je 0x402e3f
cmp eax, 1
je 0x402e24
cmp eax, 2
jne 0x402e6a
mov edx, dword [esp + 0x34]
push esi
mov dword [esp + 0x18], edx
mov byte [edi + 0x3ff], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4018fb.65
mov ecx, dword [edi]
xor eax, eax
cmp dword [esp + 0x34], eax
push ecx
sete al
push 0x4209cc
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4018fb.65
push esi
mov byte [edi], 0
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4018fb.65
push 0x20019
call fcn.00401830
mov ecx, 3
mov esi, eax
call fcn.004016e0
mov byte [edi], 0
test esi, esi
je 0x401a51
cmp dword [esp + 0x34], 0
mov dword [esp + 0x40], 0x3ff
je 0x402ed2
push 0x3ff
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
mov byte [edi + 0x3ff], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4018fb.65
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x50]
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401a51
push esi
mov byte [edi + 0x3ff], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4018fb.65
cmp byte [edi], 0
je case.0x4018fb.65
mov eax, edi
call fcn.004082a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4018fb.65
mov edx, dword [esp + 0x30]
push edx
push 0x426908
call fcn.00408330
mov esi, eax
push esi
call fcn.00408610
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call fcn.00407f60
cmp eax, 0xffffffff
jne 0x401f6a
mov byte [edi], 0
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
cmp dword [esp + 0x2c], 0
je 0x402f7a
mov ecx, 1
call fcn.004016e0
mov byte [0x426908], al
mov eax, 1
jmp 0x402f8c
push ecx
push 0x426908
call fcn.00408330
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [edi], 0
je 0x401a51
push 0
lea edx, [esp + 0x44]
push edx
push eax
push 0x426908
mov eax, edi
call fcn.004082a0
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
xor esi, esi
lea ecx, [esi + 2]
call fcn.004016e0
mov ebp, eax
cmp ebp, 1
jl case.0x4018fb.65
cmp ebp, 0x3ff
jle 0x402fe7
mov ebp, 0x3ff
cmp byte [edi], 0
je 0x40308e
mov eax, edi
mov byte [esp + 0x18], 0
call fcn.004082a0
mov edi, eax
test ebp, ebp
jle 0x40308e
push 0
lea eax, [esp + 0x44]
push eax
push 1
lea ecx, [esp + 0x2b]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40308e
cmp dword [esp + 0x40], 1
jne 0x40308e
cmp dword [esp + 0x30], 0
jne 0x403051
mov cl, byte [esp + 0x18]
cmp cl, 0xd
je 0x40306b
cmp cl, 0xa
je 0x40306b
mov al, byte [esp + 0x1f]
mov byte [esi + ebx], al
inc esi
mov byte [esp + 0x18], al
test al, al
je 0x40308e
cmp esi, ebp
jl 0x403006
jmp 0x40308e
movzx edx, byte [esp + 0x1f]
push edx
push 0x4209cc
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x403437
mov al, byte [esp + 0x1f]
cmp cl, al
je 0x403081
cmp al, 0xd
je 0x40307b
cmp al, 0xa
jne 0x403081
mov byte [esi + ebx], al
inc esi
jmp 0x40308e
push 1
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [esi + ebx], 0
test esi, esi
jne case.0x4018fb.65
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
cmp byte [edi], 0
je case.0x4018fb.65
mov eax, dword [esp + 0x30]
push eax
push 0
mov ecx, 2
call fcn.004016e0
push eax
mov eax, edi
call fcn.004082a0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x28], 0
jl case.0x4018fb.65
push eax
push 0x4209cc
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
cmp byte [edi], 0
je case.0x4018fb.65
mov eax, edi
call fcn.004082a0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x4018fb.65
cmp byte [ebx], 0
je 0x401c6c
lea ecx, [esp + 0x68]
push ecx
mov eax, ebx
call fcn.004082a0
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401c6c
jmp 0x403175
mov eax, dword [esp + 0x2c]
push eax
push 0x426508
call fcn.00408330
lea ecx, [esp + 0x68]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x403165
mov byte [ebx], 0
mov byte [edi], 0
mov dword [esp + 0x14], 1
jmp case.0x4018fb.65
push eax
push 0x4209cc
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x400
lea edx, [esp + 0x98]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp case.0x4018fb.65
push eax
push 0x426908
mov dword [esp + 0x44], 0xfffffd66
call fcn.00408330
mov esi, eax
push esi
mov dword [esp + 0x1c], esi
call fcn.00408610
mov edx, esi
call fcn.00407d20
test eax, eax
jne 0x4031d1
mov eax, dword [0x426500]
mov ecx, dword [eax + 0xc]
push ecx
push 0x426908
call fcn.00408330
push eax
call fcn.00408610
mov edi, esi
call fcn.00407f40
push 2
push 0x40000000
call fcn.00407f60
mov ebp, eax
mov dword [esp + 0x44], ebp
cmp ebp, 0xffffffff
je 0x4032b1
mov edi, dword [0x44160c]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4032a6
mov edx, dword [0x4255bc]
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, edi
mov ecx, ebx
call fcn.00403d00
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [esp + 0x40], esi
test esi, esi
je 0x40327e
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push esi
push ecx
xor ecx, ecx
call fcn.004039c0
cmp byte [esi], 0
je 0x40326f
mov ebp, dword [esi]
mov eax, dword [esi + 4]
add esi, 8
add eax, ebx
mov ecx, ebp
mov edx, esi
call fcn.00407f20
add esi, ebp
cmp byte [esi], 0
jne 0x403255
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebp, dword [esp + 0x44]
push 0
lea eax, [esp + 0x40]
push eax
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0xffffffffffffffff
xor edx, edx
mov ecx, ebp
call fcn.004039c0
mov dword [esp + 0x3c], eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x3c], 0
mov edi, 0xfffffff3
jge 0x4032d1
push esi
mov edi, 0xffffffef
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x14], 1
mov ecx, 0x426908
mov eax, edi
call fcn.00407330
jmp case.0x4018fb.65
xor ecx, ecx
call fcn.004016e0
mov edi, eax
cmp edi, dword [0x4415cc]
jae 0x401a51
mov eax, dword [esp + 0x2c]
mov esi, edi
imul esi, esi, 0x418
add esi, dword [0x4415c8]
test eax, eax
jl 0x40333c
mov ecx, dword [esi + eax*4]
jne 0x403327
push 0x400
add esi, 0x18
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp case.0x4018fb.65
push ecx
push 0x4209cc
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
or ecx, 0xffffffff
sub ecx, eax
mov dword [esp + 0x2c], ecx
je 0x403357
mov ecx, 1
call fcn.004016e0
mov dword [esp + 0x28], eax
jmp 0x40336c
mov edx, dword [esp + 0x34]
push edx
lea eax, [esi + 0x18]
push eax
call fcn.00408330
or dword [esi + 8], 0x100
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esi + ecx*4], edx
cmp dword [esp + 0x30], 0
je case.0x4018fb.65
mov ecx, edi
call fcn.004011f0
jmp case.0x4018fb.65
xor ecx, ecx
call fcn.004016e0
cmp eax, 0x20
jae 0x401a51
cmp dword [esp + 0x30], 0
je 0x4033d7
cmp dword [esp + 0x2c], 0
je 0x4033be
mov ecx, eax
call fcn.00401320
push 0
push 0
call fcn.00401260
jmp case.0x4018fb.65
push 0
call fcn.00401370
push eax
push 0x4209cc
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.0x4018fb.65
cmp dword [esp + 0x2c], 0
je 0x4033f1
mov ecx, dword [esp + 0x28]
mov edx, dword [0x4415ac]
mov dword [edx + eax*4 + 0x94], ecx
jmp case.0x4018fb.65
mov ecx, dword [0x4415ac]
mov edx, dword [ecx + eax*4 + 0x94]
push edx
push ebx
call fcn.00408330
jmp case.0x4018fb.65
mov ecx, dword [0x43f3a4]
push 0
and ecx, eax
push ecx
push 0xb
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x24], 0
je case.0x4018fb.65
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x14]
add dword [0x4436a8], edx
xor eax, eax
mov ecx, dword [esp + 0x1ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040f602
add esp, 0x1a4
ret