Function at 0x401b9a
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get comspec environment variable
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov eax, 0x63158
lea ebp, [esp - 0x78]
call fcn.00408050
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebx, ebx
push edi
lea eax, [ebp + 0x1c]
push eax
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x24], 8
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x30], ebx
call esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push ebx
push ebx
mov dword [ebp + 0x70], eax
call dword [sym.imp.msvcrt.dll__wgetcwd]
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
call fcn.004057f6
push 1
push 0x401085
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.0040405f
push ebx
lea eax, [ebp - 0x60]
mov dword [ebp + 0x4c], 0x401f0b
mov dword [ebp + 0x50], 0x401f1b
mov dword [ebp - 0x20], 0x401f0b
mov dword [ebp - 0x1c], 0x401f1b
mov dword [ebp - 0xc], 0x4043db
mov dword [ebp - 8], 0x4043f5
call fcn.00404e7e
mov edi, 0x104
push edi
lea eax, [ebp - 0xb18]
push eax
push ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
je 0x401f00
cmp eax, edi
ja 0x401f00
call esi
mov dword [ebp + 0x58], eax
xor ecx, ecx
mov eax, dword [ebp + 0x58]
mov ax, word [eax]
cmp ax, 0x22
jne 0x4013f1
xor eax, eax
cmp ecx, ebx
sete al
mov ecx, eax
jmp 0x401400
cmp ax, bx
je 0x401406
cmp ax, 0x20
jne 0x401400
cmp ecx, ebx
je 0x401406
add dword [ebp + 0x58], 2
jmp 0x4013da
lea eax, [ebp - 0x1c60]
push eax
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x30e0]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.msvcrt.dll__wsplitpath]
push ebx
push ebx
lea eax, [ebp - 0x30e0]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2ae0]
push eax
call dword [sym.imp.msvcrt.dll__wmakepath]
push 0x105
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.msvcrt.dll_wcstombs]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x34
lea eax, [ebp - 0x2ae0]
push eax
push str.SFXPATH
call esi
lea eax, [ebp - 0x1c60]
push eax
lea eax, [ebp - 0x90c]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push eax
push 0x4093c8
call esi
push dword [ebp + 0x14]
push str.WORKDIR
call esi
lea eax, [ebp - 0x90c]
push str.un7z.exe
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x4015dd
xor edi, edi
inc edi
cmp dword [ebp + 0x1c], 2
mov dword [ebp + 0x48], edi
jge 0x4014d0
push str.un7z.exe_file__extractDir_
jmp 0x4015d1
mov esi, dword [ebp + 0x70]
push dword [esi + 4]
call fcn.004011cc
test eax, eax
je 0x4015cc
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4015cc
push ebx
lea eax, [ebp - 0xb18]
push eax
mov edi, 0x30e
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push dword [eax + 4]
call esi
cmp dword [ebp + 0x1c], 3
lea eax, [ebp - 0x700]
push ebx
push eax
mov eax, dword [ebp + 0x70]
push edi
jne 0x40156f
push dword [eax + 8]
call esi
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x401554
push ebx
lea eax, [ebp - 0x700]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x401554
push str.cannot_create_target
jmp 0x401efb
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x401581
push str.target_is_not_empy
jmp 0x401efb
push dword [eax + 4]
call esi
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp + 0x70], eax
lea eax, [ebp - 0xb18]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
call fcn.00404254
test eax, eax
je 0x401794
mov dword [ebp + 0x68], str.can_not_open_input_file
mov dword [ebp + 0x74], 0xb
jmp 0x401837
push str.file_is_not_exists
call fcn.0040108b
mov eax, edi
jmp 0x401f03
mov dword [ebp + 0x70], ebx
lea eax, [ebp + 0x30]
push eax
mov eax, dword [ebp + 0x70]
push dword [eax + 0x40a008]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401627
lea eax, [ebp - 0x24c4]
push eax
push dword [ebp + 0x30]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40161e
lea eax, [ebp - 0x24c4]
push eax
mov eax, dword [ebp + 0x70]
push dword [eax + 0x40a00c]
call esi
push dword [ebp + 0x30]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
add dword [ebp + 0x70], 8
cmp dword [ebp + 0x70], 0x188
jb 0x4015e0
lea eax, [ebp - 0x700]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x401f00
cmp eax, edi
ja 0x401f00
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x700]
push eax
call edi
pop ecx
mov dword [ebp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
shl esi, 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
shl esi, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
mov eax, dword [ebp + 0x70]
lea eax, [ebp + eax*2 - 0x700]
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x44], eax
push 0x409340
push dword [ebp + 0x44]
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x700]
push eax
call edi
lea eax, [ebp + eax*2 - 0x700]
add esp, 0xc
mov dword [ebp + 0x64], esi
lea ecx, [eax + 0xe]
mov dword [ebp + 0x60], 8
mov edx, dword [ebp + 0x64]
shr dword [ebp + 0x64], 4
and edx, 0xf
cmp edx, 0xa
mov dword [ebp + 0x40], edx
jae 0x4016d8
add edx, 0x30
jmp 0x4016db
add edx, 0x37
mov word [ecx], dx
dec ecx
dec ecx
dec dword [ebp + 0x60]
jne 0x4016c1
mov word [eax + 0x10], bx
lea eax, [ebp - 0x700]
push eax
call fcn.004011cc
test eax, eax
jne 0x401718
push ebx
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40175d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40172d
inc dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
cmp dword [ebp + 0x6c], 0x64
jb 0x401693
mov dword [ebp + 0x74], 0xb
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x1ea8]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
cmp dword [ebp + 0x74], ebx
pop ecx
pop ecx
je 0x40159f
push str.Cant_create_temp_folder
jmp 0x401efb
lea eax, [ebp - 0x700]
push 0x4093e0
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x700]
push eax
call edi
mov dword [ebp + 0x70], eax
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x1448]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 0x14
jmp 0x401734
lea eax, [ebp - 4]
push eax
lea edi, [ebp + 0x38]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], ebx
call fcn.004010e1
test eax, eax
jne 0x4017b3
mov dword [ebp + 0x74], 0xb
jmp 0x4017d0
push ebx
lea eax, [ebp - 4]
push eax
lea esi, [ebp + 0x38]
call fcn.00404366
test eax, eax
je 0x4017cb
mov dword [ebp + 0x74], 0xb
cmp dword [ebp + 0x74], ebx
je 0x4017d7
mov dword [ebp + 0x68], str.Cant_find_7z_archive
cmp dword [ebp + 0x48], ebx
jne 0x401806
push 0xa
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call dword [sym.imp.msvcrt.dll__ui64tow]
add esp, 0x10
lea eax, [ebp - 0xe4]
push eax
push str.SFXSIZE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [ebp + 0x74], ebx
jne 0x401837
mov esi, 0x40000
mov edx, esi
lea ecx, [ebp + 0x4c]
call dword [ebp + 0x4c]
cmp eax, ebx
mov dword [ebp - 0x44], eax
jne 0x401828
mov dword [ebp + 0x74], 2
jmp 0x401837
lea eax, [ebp - 0xc]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0xe4]
call fcn.00401fdb
cmp dword [ebp + 0x74], ebx
jne 0x401b8c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00403e6a
cmp eax, ebx
mov dword [ebp + 0x74], eax
jne 0x401b8c
or dword [ebp + 0x44], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0xa4], ebx
mov dword [ebp], 0x40000000
mov dword [ebp + 0x60], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0x6c], ebx
jbe 0x401b30
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x8c]
sub eax, ecx
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp + 0x64]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
cmp eax, 0x104
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x54], ebx
jae 0x401b09
mov esi, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x6c]
lea esi, [ebp + esi*2 - 0x700]
push esi
lea edx, [ebp - 0xe4]
call fcn.00403fef
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x6c]
lea eax, [ebp - 0x60]
push eax
lea ebx, [ebp + 0x60]
lea eax, [ebp - 0xe4]
call fcn.00403e97
test eax, eax
mov dword [ebp + 0x74], eax
jne 0x401b2e
and dword [ebp + 0x2c], eax
cmp word [esi], ax
je 0x401950
mov edi, esi
mov dword [ebp + 0x5c], 1
mov ebx, esi
cmp word [edi], 0x2f
jne 0x401943
and word [edi], 0
lea eax, [ebp - 0x700]
push eax
call fcn.004010c4
mov eax, dword [ebp + 0x5c]
mov word [edi], 0x5c
mov dword [ebp + 0x2c], eax
inc dword [ebp + 0x5c]
inc ebx
inc ebx
cmp word [ebx], 0
mov edi, ebx
jne 0x401922
mov ecx, dword [ebp + 0x6c]
mov edx, dword [ebp - 0x9c]
and ecx, 7
mov eax, 0x80
sar eax, cl
mov ecx, dword [ebp + 0x6c]
shr ecx, 3
mov dword [ebp + 0x40], ecx
test byte [edx + ecx], al
mov dword [ebp + 0x5c], eax
je 0x401985
lea eax, [ebp - 0x700]
push eax
call fcn.004010c4
jmp 0x401aef
mov eax, dword [ebp + 0x2c]
lea esi, [esi + eax*2]
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
mov ebx, eax
lea eax, [ebp - 0xc20]
pop ecx
lea edi, [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], str.setup
mov dword [ebp - 0x34], str.install
mov dword [ebp - 0x30], 0x409770
mov dword [ebp - 0x2c], str.start
call section..text
sub ebx, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [esi + ebx*2]
mov ebx, dword [ebp + 0x20]
push eax
push 7
push 0x40970c
call fcn.0040102b
mov ebx, dword [ebp - 0x18]
push esi
mov edi, eax
push 5
lea eax, [ebp - 0x3c]
push eax
call fcn.0040102b
mov ecx, dword [ebp + 0x2c]
neg ecx
sbb ecx, ecx
and ecx, 0x1000
add eax, ecx
mov ecx, edi
shl ecx, 6
add eax, ecx
cmp dword [ebp], eax
jbe 0x401a13
mov dword [ebp], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x24], edi
lea eax, [ebp - 0x700]
push eax
call fcn.004011cc
test eax, eax
jne 0x401b12
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp + 0x34]
push eax
xor eax, eax
inc eax
call fcn.00404254
test eax, eax
jne 0x401b1b
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x54]
add eax, ecx
push eax
lea eax, [ebp + 0x34]
push eax
lea esi, [ebp + 0x54]
mov dword [ebp + 0x54], edi
call fcn.0040430f
test eax, eax
jne 0x401a66
cmp dword [ebp + 0x54], edi
je 0x401a74
mov dword [ebp + 0x68], str.Cant_write_output_file
mov dword [ebp + 0x74], 0xb
mov eax, dword [ebp - 0x88]
xor edi, edi
cmp eax, edi
je 0x401ab3
mov cl, byte [ebp + 0x5c]
mov edx, dword [ebp + 0x40]
test byte [eax + edx], cl
je 0x401ab3
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp - 0x84]
shl eax, 3
mov edx, dword [ecx + eax]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + eax + 4]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push edi
push edi
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea esi, [ebp + 0x34]
call fcn.0040429a
cmp dword [ebp + 0x74], edi
jne 0x401b2e
test eax, eax
jne 0x401b2b
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x401aef
mov cl, byte [ebp + 0x5c]
mov edx, dword [ebp + 0x40]
test byte [eax + edx], cl
je 0x401aef
mov eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x64]
push dword [eax + ecx]
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
add dword [ebp + 0x64], 4
xor ebx, ebx
cmp eax, dword [ebp - 0xa4]
jb 0x4018a3
jmp 0x401b30
mov dword [ebp + 0x74], 0xb
jmp 0x401b30
mov dword [ebp + 0x68], str.Duplicate_file
jmp 0x401b22
mov dword [ebp + 0x68], str.Cant_open_output_file
mov dword [ebp + 0x74], 0xb
jmp 0x401b2e
mov dword [ebp + 0x74], eax
xor ebx, ebx
cmp dword [ebp + 0x48], ebx
jne 0x401b83
cmp dword [ebp + 0x74], ebx
jne 0x401b83
mov ecx, dword [ebp + 0x44]
cmp ecx, 0xffffffff
jne 0x401b52
mov dword [ebp + 0x68], str.There_is_no_file_to_execute
mov dword [ebp + 0x74], 0xb
jmp 0x401b83
mov esi, dword [ebp + 0x70]
lea esi, [ebp + esi*2 - 0x700]
push esi
lea edx, [ebp - 0xe4]
call fcn.00403fef
cmp word [esi], bx
je 0x401b83
mov eax, esi
cmp word [eax], 0x2f
jne 0x401b7a
mov word [eax], 0x5c
inc esi
inc esi
cmp word [esi], bx
mov eax, esi
jne 0x401b6f
mov edx, dword [ebp + 0x60]
lea ecx, [ebp + 0x4c]
call dword [ebp + 0x50]
lea eax, [ebp + 0x4c]
lea ecx, [ebp - 0xe4]
call fcn.00402016
mov edx, dword [ebp - 0x44]
lea ecx, [ebp + 0x4c]
call dword [ebp + 0x50]
lea esi, [ebp - 4]
call fcn.0040429a
cmp dword [ebp + 0x48], ebx
jne 0x401eb6
cmp dword [ebp + 0x74], ebx
jne 0x401ea0
lea eax, [ebp - 0xe2c]
push eax
push 0x105
mov word [ebp - 0xe2c], bx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
je 0x401be1
cmp eax, 0x104
jbe 0x401be8
mov word [ebp - 0xe2c], bx
lea eax, [ebp - 0x1ea8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp + 0x24], 3
jne 0x401c14
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x1a60]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp + 0x58]
jmp 0x401c33
cmp dword [ebp + 0x24], 2
jne 0x401c72
lea eax, [ebp - 0x1a60]
push str.rundll32.exe_advpack.dll_LaunchINFSection
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x1a60]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
push 0x44
pop esi
push esi
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x1c
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1a60]
push eax
push ebx
jmp 0x401e44
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0xa4]
rep stosd dword es:[edi], eax
push 0xfffffffffffffff6
mov dword [ebp - 0xa8], 0x44
mov dword [ebp - 0x7c], 0x101
call esi
push 0xfffffffffffffff5
mov dword [ebp - 0x70], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x6c], eax
call esi
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x530e0]
push 0x409224
push eax
call edi
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x530e0]
push eax
call esi
push dword [ebp + 0x58]
lea eax, [ebp - 0x530e0]
push eax
call esi
add esp, 0x18
push 0xfffe
lea eax, [ebp - 0x630e0]
push eax
push 0x409218
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x330e0]
push eax
call edi
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x230e0]
push eax
call edi
lea eax, [ebp - 0x230e0]
push 0x409210
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x330e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x330e0]
push 0x40920c
push eax
call esi
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x330e0]
push eax
call esi
lea eax, [ebp - 0x330e0]
push str.bin_
push eax
call esi
lea eax, [ebp - 0x630e0]
push eax
lea eax, [ebp - 0x330e0]
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x330e0]
push eax
push 0x409218
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x130e0]
push eax
call edi
lea eax, [ebp - 0x130e0]
push str.bincmd.exe
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x230e0]
push eax
call fcn.004011cc
test eax, eax
je 0x401dc4
lea eax, [ebp - 0x1448]
push eax
jmp 0x401dc7
push dword [ebp + 0x14]
lea eax, [ebp - 0x430e0]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x130e0]
push eax
call fcn.004011cc
test eax, eax
lea eax, [ebp - 0x130e0]
je 0x401dfa
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x401e0b
push 0xfffe
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x430e0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x530e0]
push eax
lea eax, [ebp - 0x130e0]
push eax
mov dword [ebp - 0xa8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401e5d
mov dword [ebp + 0x74], 0xb
jmp 0x401e93
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 4]
cmp esi, ebx
je 0x401e93
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401e8c
mov dword [ebp + 0x28], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xe2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp + 0x70]
lea ecx, [ebp - 0x700]
mov word [ebp + eax*2 - 0x700], bx
call fcn.004011fc
mov eax, dword [ebp + 0x74]
cmp eax, ebx
jne 0x401ec2
mov eax, dword [ebp + 0x28]
jmp 0x401f03
cmp eax, 4
jne 0x401ed0
mov dword [ebp + 0x68], str.Decoder_doesnt_support_this_archive
jmp 0x401ef8
cmp eax, 2
jne 0x401ede
mov dword [ebp + 0x68], str.Cant_allocate_required_memory
jmp 0x401ef8
cmp eax, 3
jne 0x401eec
mov dword [ebp + 0x68], str.CRC_error
jmp 0x401ef8
cmp dword [ebp + 0x68], ebx
jne 0x401ef8
mov dword [ebp + 0x68], str.ERROR
push dword [ebp + 0x68]
call fcn.0040108b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret