Function at 0x401ee0
Capabilities:
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x990
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, section..ndata
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 8]
mov dword [ebp + 8], edx
lea ecx, [eax + 4]
shl edx, 0xa
add edx, esi
and dword [ebp - 4], 0
mov dword [ebp - 0x18], edx
lea edx, [eax + 0x10]
mov dword [ebp - 0x30], edx
push edi
mov edx, dword [edx]
mov edi, dword [ecx]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edi
shl edx, 0xa
add edx, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x28], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x10], edx
mov edx, dword [eax]
mov dword [ebp - 8], edx
mov edx, dword [0x799e98]
mov dword [0x409904], ecx
mov ecx, dword [ebp - 8]
shl edi, 0xa
shl ebx, 0xa
add ecx, 0xfffffffe
add edi, esi
add ebx, esi
cmp ecx, 0x3e
mov dword [ebp - 0x20], edx
ja case.default.0x401f60
jmp dword [ecx*4 + 0x403672]
mov eax, dword [ebp - 0x1c]
jmp 0x402ad5
push 0
push dword [ebp - 0x1c]
call fcn.00405d92
jmp 0x402f90
inc dword [0x799604]
cmp dword [0x799e40], 0
je 0x402f90
push 0
jmp 0x402f8a
mov eax, dword [ebp - 0x1c]
test eax, eax
jge 0x401fab
inc eax
shl eax, 0xa
sub esi, eax
push esi
call fcn.004067d3
dec eax
push 0
push eax
call fcn.00401e3d
jmp 0x402ad5
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x401fe1
test al, 8
je 0x401fcb
mov eax, dword [0x40900c]
jmp 0x401fd7
mov ecx, dword [0x409260]
mov dword [0x40900c], ecx
mov dword [0x409260], eax
jmp case.default.0x401f60
push 0
push dword [ebp - 0x1c]
jmp 0x402204
push 0
call fcn.00403821
cmp eax, 1
jg 0x401ffa
xor eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x401f60
push dword [0x799e40]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.default.0x401f60
push 1
call fcn.00403821
mov ecx, dword [ebp - 0x1c]
mov dword [ecx*4 + 0x799ea0], eax
jmp case.default.0x401f60
mov ecx, dword [ebp + 8]
xor edx, edx
lea esi, [ecx*4 + 0x799ea0]
mov ecx, dword [esi]
test ecx, ecx
sete dl
and ecx, dword [ebp - 0x24]
mov eax, dword [eax + edx*4 + 4]
mov dword [esi], ecx
jmp 0x402ad5
mov eax, dword [ebp - 0xc]
push dword [eax*4 + 0x799ea0]
push edi
call fcn.004067ba
jmp case.default.0x401f60
mov eax, dword [0x799608]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x402078
push dword [ebp - 0xc]
push eax
call esi
mov eax, dword [0x799618]
test eax, eax
je case.default.0x401f60
push dword [ebp - 0x1c]
push eax
call esi
jmp case.default.0x401f60
push 0xfffffffffffffff0
call fcn.0040383e
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jmp 0x403386
push 0xfffffffffffffff0
call fcn.0040383e
cmp dword [ebp - 0xc], 0
mov esi, eax
mov dword [ebp + 8], esi
push esi
je 0x4020d6
push 0xffffffffffffffe6
call fcn.00405d92
push esi
push 0x79f800
call sub.KERNEL32.dll_lstrcpyA
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x4020dd
push 0xfffffffffffffff5
call fcn.00405d92
mov edi, dword [sym.imp.USER32.dll_CharNextA]
push esi
call edi
cmp byte [esi], 0
je case.default.0x401f60
cmp word [eax], 0x5c3a
jne 0x4020fb
lea esi, [eax + 2]
jmp 0x40212d
cmp word [esi], 0x5c5c
jne case.default.0x401f60
push 4
pop ebx
jmp 0x402114
test al, al
je 0x40211a
push esi
call edi
mov esi, eax
mov al, byte [esi]
cmp al, 0x5c
jne 0x40210b
push esi
call edi
dec ebx
mov esi, eax
jne 0x402114
jmp 0x40212d
test al, al
je 0x402133
push esi
call edi
mov esi, eax
mov al, byte [esi]
cmp al, 0x5c
jne 0x402124
push dword [ebp + 8]
mov bl, byte [esi]
and byte [esi], 0
call fcn.00406b28
test eax, eax
jne 0x402152
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jmp 0x402155
test byte [eax], 0x10
jne 0x40215a
inc dword [ebp - 4]
mov byte [esi], bl
inc esi
test bl, bl
jne 0x40212d
jmp case.default.0x401f60
push 0
call fcn.0040383e
push eax
call fcn.00406b28
jmp 0x4028cc
push 0xfffffffffffffff0
call fcn.0040383e
push 0xffffffffffffffdf
mov dword [ebp - 0x10], eax
call fcn.0040383e
push dword [ebp - 0x10]
mov esi, 0x40a508
mov ebx, eax
push esi
call sub.KERNEL32.dll_lstrcpyA
push ebx
call sub.KERNEL32.dll_lstrlenA
push dword [ebp - 0x10]
mov edi, eax
call sub.KERNEL32.dll_lstrlenA
add edi, eax
cmp edi, 0x3fd
jge 0x4021c5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x409090
push esi
call edi
push ebx
push esi
call edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4021d8
push esi
push 0xffffffffffffffe3
jmp 0x402204
cmp dword [ebp + 8], 0
je 0x402ac3
push dword [ebp - 0x10]
call fcn.00406b28
test eax, eax
je 0x402ac3
inc dword [0x799eb0]
push ebx
push dword [ebp - 0x10]
call fcn.004065a6
push esi
push 0xffffffffffffffe4
call fcn.00405d92
jmp case.default.0x401f60
xor esi, esi
inc esi
push esi
call fcn.0040383e
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x402252
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jbe 0x402258
cmp byte [eax], 0
je 0x402258
push ebx
call fcn.00406b28
test eax, eax
je 0x402252
add eax, 0x2c
push eax
push dword [ebp - 0x20]
call sub.KERNEL32.dll_lstrcpyA
jmp 0x402258
and byte [edi], 0
mov dword [ebp - 4], esi
cmp dword [ebp + 8], 0
jne case.default.0x401f60
push 0x400
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp case.default.0x401f60
push 0xffffffffffffffff
call fcn.0040383e
lea ecx, [ebp + 8]
push ecx
push edi
push 0x400
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne case.default.0x401f60
and byte [edi], 0
jmp 0x402ac3
push 0xffffffffffffffef
call fcn.0040383e
push eax
push edi
call fcn.0040655a
jmp 0x4020a1
push 0x31
call fcn.0040383e
mov edi, eax
mov eax, dword [ebp - 0x1c]
and eax, 7
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
call fcn.0040641a
push edi
mov edi, 0x409908
test eax, eax
je 0x4022e0
push edi
call sub.KERNEL32.dll_lstrcpyA
jmp 0x4022f8
push 0x79f800
push edi
call sub.KERNEL32.dll_lstrcpyA
push eax
call fcn.00406395
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.00406a85
mov ebx, 0x40a108
cmp dword [ebp - 0x18], 3
jl 0x402339
push edi
call fcn.00406b28
xor ecx, ecx
test eax, eax
je 0x402324
push dword [ebp - 0x30]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffffd
or eax, 0x80000000
and eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x402355
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x402355
xor eax, 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
cmp dword [ebp - 0x18], 1
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.0040653e
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x4023ea
cmp dword [ebp - 0x18], 0
jne 0x4023c0
push esi
push ebx
call sub.KERNEL32.dll_lstrcpyA
push edi
push esi
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 0x10]
push 0x409d08
call fcn.0040686a
push ebx
push esi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [ebp - 0x1c]
sar eax, 3
push eax
push 0x409d08
call fcn.004062ff
sub eax, 4
je 0x402303
dec eax
je 0x4023df
push edi
push 0xfffffffffffffffa
jmp 0x401f74
push dword [ebp - 0x14]
push 0xffffffffffffffe2
call fcn.00405d92
cmp dword [ebp - 0x18], 2
jne case.default.0x401f60
inc dword [0x799ea8]
jmp case.default.0x401f60
inc dword [0x799ea8]
jmp 0x402ad3
push dword [ebp - 0x14]
push 0xffffffffffffffea
call fcn.00405d92
xor esi, esi
xor dword [0x409260], 1
push esi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00403c24
xor dword [0x409260], 1
cmp dword [ebp - 0x24], 0xffffffff
mov ebx, eax
jne 0x40241f
cmp dword [ebp - 0x28], 0xffffffff
je 0x40242f
push dword [ebp - 0x30]
push esi
push dword [ebp - 0x30]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
jge case.default.0x401f60
cmp ebx, 0xfffffffe
jne 0x402459
push 0xffffffffffffffe9
push edi
call fcn.0040686a
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x402461
push 0xffffffffffffffee
push edi
call fcn.0040686a
push 0x10
push edi
call fcn.004062ff
jmp 0x402f90
push 0x10
call fcn.0040383e
mov esi, eax
mov edi, 0x409908
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
push edi
call fcn.004063c1
lea eax, [ebp - 0x190]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je case.default.0x401f60
test byte [ebp - 0x190], 0x10
jne 0x40250d
lea eax, [ebp - 0x164]
push eax
push edi
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x190]
add esp, 0x10
test al, 1
je 0x4024d7
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4024ec
push esi
push 0xfffffffffffffff2
call fcn.00405d92
jmp 0x40250d
cmp dword [ebp - 0xc], 0
je 0x40250a
inc dword [0x799eb0]
push esi
push 0xfffffffffffffff1
call fcn.00405d92
push 0
push esi
call fcn.004065a6
jmp 0x40250d
inc dword [ebp - 4]
lea eax, [ebp - 0x190]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4024a2
push ebx
jmp 0x4033d7
push 0x31
call fcn.0040383e
push dword [ebp - 0x1c]
push eax
call fcn.004062ff
test eax, eax
je 0x402ac3
cmp eax, dword [ebp + 8]
je 0x4026ad
cmp eax, dword [ebp - 0x28]
jne case.default.0x401f60
mov eax, dword [ebp - 0x10]
jmp 0x402ad5
push 0
call fcn.0040383e
mov esi, eax
push esi
call sub.KERNEL32.dll_lstrlenA
add eax, esi
push eax
push esi
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
jne 0x40257b
push esi
call fcn.004063c1
push dword [ebp - 0xc]
push esi
call fcn.0040632a
push esi
call fcn.00406b28
test eax, eax
je 0x402598
cmp dword [ebp - 0xc], 2
jne 0x402ac3
push esi
push 0xffffffffffffffe5
jmp 0x402204
push 1
call fcn.0040383e
push eax
call sub.KERNEL32.dll_lstrlenA
jmp 0x402a2d
push 2
call fcn.00403821
push 3
mov ebx, eax
call fcn.00403821
push 1
mov esi, eax
call fcn.0040383e
and byte [edi], 0
cmp dword [ebp + 8], 0
mov dword [ebp - 8], eax
je 0x4025df
test ebx, ebx
je case.default.0x401f60
push eax
call sub.KERNEL32.dll_lstrlenA
test esi, esi
jge 0x4025f1
add esi, eax
js case.default.0x401f60
cmp esi, eax
jle 0x4025f7
mov esi, eax
mov eax, dword [ebp - 8]
add eax, esi
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
test ebx, ebx
je case.default.0x401f60
jge 0x402619
push edi
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
jns 0x402619
xor ebx, ebx
cmp ebx, 0x400
jge case.default.0x401f60
and byte [ebx + edi], 0
jmp case.default.0x401f60
push 0x20
call fcn.0040383e
push 0x31
mov esi, eax
call fcn.0040383e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4026ad
mov eax, dword [ebp + 8]
jmp 0x402ad5
xor esi, esi
inc esi
push esi
call fcn.0040383e
cmp dword [ebp + 8], 0
push 0x400
push edi
push eax
je 0x402679
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40267f
and byte [edi], al
mov dword [ebp - 4], esi
jmp 0x40267f
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
and byte [edi + 0x3ff], 0
jmp case.default.0x401f60
push 0
call fcn.00403821
push 1
mov esi, eax
call fcn.00403821
cmp dword [ebp - 0x10], 0
jne 0x4026a9
cmp esi, eax
jl 0x4026ad
jle 0x40264a
jmp 0x4026b7
cmp esi, eax
jae 0x4026b5
mov eax, dword [ebp - 0x24]
jmp 0x402ad5
jbe 0x40264a
mov eax, dword [ebp - 0x28]
jmp 0x402ad5
xor ebx, ebx
inc ebx
push ebx
call fcn.00403821
push 2
mov esi, eax
call fcn.00403821
mov ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xa
ja case.default.0x4026db
jmp dword [eax*4 + 0x40376e]
add esi, ecx
jmp case.default.0x4026db
sub esi, ecx
jmp case.default.0x4026db
imul ecx, esi
mov esi, ecx
jmp case.default.0x4026db
test ecx, ecx
je 0x402732
mov eax, esi
cdq
idiv ecx
mov esi, eax
jmp case.default.0x4026db
or esi, ecx
jmp case.default.0x4026db
and esi, ecx
jmp case.default.0x4026db
xor esi, ecx
jmp case.default.0x4026db
xor eax, eax
test esi, esi
sete al
jmp 0x4026fa
test esi, esi
jne 0x402721
jmp 0x40271d
test esi, esi
je 0x402735
test ecx, ecx
je 0x402735
mov esi, ebx
jmp case.default.0x4026db
test ecx, ecx
je 0x402732
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp case.default.0x4026db
mov dword [ebp - 4], ebx
xor esi, esi
push esi
jmp 0x402058
push 1
call fcn.0040383e
push 2
mov esi, eax
call fcn.00403821
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.default.0x401f60
mov eax, dword [ebp + 8]
mov esi, dword [0x40ad08]
test eax, eax
je 0x4027af
dec eax
test esi, esi
je 0x402edc
mov esi, dword [esi]
test eax, eax
jne 0x40276b
test esi, esi
je 0x402edc
add esi, 4
mov edi, 0x409908
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [0x40ad08]
add eax, 4
push eax
push esi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [0x40ad08]
push edi
add eax, 4
push eax
jmp 0x40340f
cmp dword [ebp - 0xc], 0
je 0x4027da
test esi, esi
je 0x402ac3
lea eax, [esi + 4]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [esi]
push esi
mov dword [0x40ad08], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.default.0x401f60
push 0x404
call fcn.0040631b
push dword [ebp - 0x1c]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.0040686a
mov eax, dword [0x40ad08]
mov dword [esi], eax
mov dword [0x40ad08], esi
jmp case.default.0x401f60
push 0x33
call fcn.0040383e
push 0x44
mov dword [ebp + 8], eax
call fcn.0040383e
test byte [ebp - 0x10], 1
mov ebx, eax
jne 0x402828
push dword [ebp + 8]
call fcn.004067d3
mov dword [ebp + 8], eax
test byte [ebp - 0x10], 2
jne 0x402836
push ebx
call fcn.004067d3
mov ebx, eax
cmp dword [ebp - 8], 0x21
push 1
jne 0x40287f
call fcn.00403821
push 2
mov esi, eax
call fcn.00403821
mov ecx, dword [ebp - 0x10]
sar ecx, 2
je 0x402871
lea edx, [ebp - 0x14]
push edx
push ecx
push 0
push ebx
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
jmp 0x4028ac
push ebx
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4028a9
call fcn.0040383e
push 0x12
mov esi, eax
call fcn.0040383e
mov cl, byte [eax]
neg cl
sbb ecx, ecx
and ecx, eax
mov al, byte [esi]
neg al
sbb eax, eax
push ecx
and eax, esi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 0
jl case.default.0x401f60
push dword [ebp - 0x14]
jmp 0x402058
push 0
call fcn.00403821
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40264a
mov eax, dword [ebp - 0xc]
jmp 0x402ad5
push 2
call fcn.00403821
push eax
push 1
call fcn.00403821
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402a2d
mov eax, dword [0x799e88]
mov ecx, dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
lea esi, [eax + ecx]
test byte [esi + 0x18], 2
je 0x402914
push dword [esi]
call edi
mov dword [esi], eax
test byte [esi + 0x18], 8
je 0x402922
push dword [esi + 8]
call edi
mov dword [esi + 8], eax
test byte [esi + 0x18], 0x10
je 0x402935
lea eax, [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [esi + 0x10], eax
and dword [esi + 0x18], 0xffffffe5
push esi
push 0xffffffffffffffeb
push 0
call fcn.00403821
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.default.0x401f60
push dword [ebp - 0xc]
push dword [0x799e40]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp + 8]
push 0x10
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x38]
neg eax
sbb eax, eax
push ecx
and eax, dword [ebp - 0x3c]
xor esi, esi
push eax
push esi
push esi
call fcn.0040383e
push eax
push esi
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push esi
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, esi
je case.default.0x401f60
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x401f60
push 0x48
push 0x5a
push dword [0x799e40]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 2
call fcn.00403821
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 3
mov dword [0x4098c8], eax
call fcn.00403821
mov dword [0x4098d8], eax
mov al, byte [ebp - 0x28]
push dword [ebp - 0xc]
mov cl, al
and cl, 1
mov byte [0x4098df], 1
mov byte [0x4098dc], cl
mov cl, al
and cl, 2
and al, 4
push 0x4098e4
mov byte [0x4098dd], cl
mov byte [0x4098de], al
call fcn.0040686a
push 0x4098c8
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
jmp 0x402058
push 1
call fcn.00403821
push eax
push 0
call fcn.00403821
cmp dword [ebp - 0x24], 0
push eax
jne 0x402a51
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x401f60
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x401f60
push 0
call fcn.0040383e
push 0x11
mov edi, eax
call fcn.0040383e
push 0x22
mov dword [ebp + 8], eax
call fcn.0040383e
push dword [ebp + 8]
mov esi, 0x40a508
mov ebx, eax
push edi
push str._s__s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
push 0xffffffffffffffec
call fcn.00405d92
mov al, byte [ebx]
push dword [ebp - 0x24]
neg al
sbb eax, eax
push 0x79f800
and eax, ebx
push eax
mov al, byte [edi]
push dword [ebp + 8]
neg al
sbb eax, eax
and eax, edi
push eax
push dword [0x799e40]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jge case.default.0x401f60
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add dword [0x799ea8], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 0
call fcn.0040383e
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.00405d92
push 0x79f800
push esi
call fcn.00406295
test eax, eax
mov dword [ebp - 0x10], eax
je 0x402ac3
cmp dword [ebp - 0xc], 0
je 0x402b75
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push eax
call edi
mov ebx, 0x102
cmp eax, ebx
jne 0x402b48
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x402b2b
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0xf
push 0xf
lea eax, [ebp - 0x50]
push 0
push eax
call esi
test eax, eax
jne 0x402b21
push 0x64
push dword [ebp - 0x10]
call edi
cmp eax, ebx
je 0x402b2b
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp + 8], 0
jl 0x402b68
push dword [ebp - 8]
push dword [ebp - 0x18]
call fcn.004067ba
jmp 0x402b75
cmp dword [ebp - 8], 0
je 0x402b75
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x401f60
push 0
call fcn.0040383e
push eax
call fcn.00406b28
mov esi, eax
test esi, esi
je 0x402baa
push dword [esi + 0x14]
push dword [ebp - 0x18]
call fcn.004067ba
push dword [esi + 0x18]
push ebx
jmp 0x402059
and byte [ebx], 0
mov eax, dword [ebp - 0x18]
jmp 0x40327c
lea eax, [ebp - 0x44]
push 0xfffffffffffffff0
mov dword [ebp + 8], eax
call fcn.0040383e
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
and byte [ebx], 0
mov esi, eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 1
and byte [eax], 0
test esi, esi
je case.default.0x401f60
push esi
call fcn.0040631b
test eax, eax
mov dword [ebp - 8], eax
je case.default.0x401f60
push eax
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402c3e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push 0x40907c
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402c3e
mov eax, dword [ebp + 8]
push dword [eax + 8]
push ebx
call fcn.004067ba
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [ebp - 0x18]
call fcn.004067ba
and dword [ebp - 4], 0
push dword [ebp - 8]
jmp 0x4027cf
cmp dword [0x799ec0], 0
mov dword [ebp - 4], 1
jl 0x402cff
push 0xfffffffffffffff0
call fcn.0040383e
push 1
mov edi, eax
call fcn.0040383e
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x402c89
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x402cf7
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x402cd5
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x402cbd
push edi
push dword [ebp + 8]
call fcn.00405d92
call ebx
test eax, eax
je 0x402cdf
mov dword [ebp - 4], 1
jmp 0x402cdf
push 0x40ad08
push esi
push 0x400
push dword [0x799e40]
call ebx
add esp, 0x10
jmp 0x402cdf
push dword [ebp - 8]
push 0xfffffffffffffff7
call fcn.00405d92
cmp dword [ebp - 0x24], 0
jne case.default.0x401f60
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.default.0x401f60
push edi
push 0xfffffffffffffff6
jmp 0x402204
push 0x409d08
push 0xffffffffffffffe7
jmp 0x402204
push 0xffffffffffffffe0
call fcn.0040383e
push 0x11
mov dword [ebp - 0x14], eax
call fcn.0040383e
push 2
mov esi, eax
call fcn.0040383e
push 0xffffffffffffffcd
mov dword [ebp - 0x30], eax
call fcn.0040383e
push 0x45
mov dword [ebp - 8], eax
call fcn.0040383e
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push 0x407290
push 1
push 0
push 0x4072a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x402e33
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x20]
push edx
push 0x4072b0
mov ecx, dword [eax]
push eax
call dword [ecx]
mov ebx, eax
test ebx, ebx
jl 0x402e26
mov eax, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
mov eax, dword [ebp + 8]
push 0x79f800
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edi, dword [ebp - 0x28]
mov esi, 0xff
mov eax, edi
sar eax, 8
and eax, esi
je 0x402dac
mov ecx, dword [ebp + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov eax, dword [ebp + 8]
mov edx, edi
sar edx, 0x10
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
cmp byte [eax], 0
je 0x402dd2
mov eax, dword [ebp + 8]
and edi, esi
push edi
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test ebx, ebx
jl 0x402e1d
lea eax, [ebp - 0x990]
push 0x400
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x990]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov ebx, eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
jge 0x402e44
push dword [ebp - 0x14]
mov dword [ebp - 4], 1
push 0xfffffffffffffff0
jmp 0x402204
push dword [ebp - 0x14]
push 0xfffffffffffffff4
jmp 0x402204
push 0
call fcn.0040383e
push 0x11
mov edi, eax
call fcn.0040383e
mov esi, eax
mov eax, dword [0x799e40]
push edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 2
call sub.KERNEL32.dll_lstrlenA
and byte [eax + edi + 1], 0
push esi
call sub.KERNEL32.dll_lstrlenA
and byte [eax + esi + 1], 0
mov ebx, 0x40a108
push 0xfffffffffffffff8
push ebx
call fcn.0040686a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ax, word [ebp + 8]
push ebx
push 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x36], ebx
mov word [ebp - 0x40], ax
call fcn.00405d92
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.default.0x401f60
push 0
push 0xfffffffffffffff9
call fcn.00405d92
jmp 0x402ac3
cmp dword [ebp - 0x1c], 0xbadf00d
je 0x402eed
push 0x10
push 0xffffffffffffffe8
push 0
call fcn.0040686a
push eax
jmp 0x402464
inc dword [0x799ea8]
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x402f76
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenProcessToken
push ebx
call esi
push str.LookupPrivilegeValueA
push ebx
mov dword [ebp + 8], eax
call esi
push str.AdjustTokenPrivileges
push ebx
mov dword [ebp - 8], eax
call esi
cmp dword [ebp + 8], edi
mov esi, eax
je 0x402f76
cmp dword [ebp - 8], edi
je 0x402f76
cmp esi, edi
je 0x402f76
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp + 8]
test eax, eax
je 0x402f76
lea eax, [ebp - 0x40]
push eax
push str.SeShutdownPrivilege
push edi
call dword [ebp - 8]
push edi
push edi
lea eax, [ebp - 0x44]
push edi
push eax
push edi
push dword [ebp - 0x20]
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x38], 2
call esi
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x402f9a
inc dword [0x799604]
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 0x7fffffff
jmp 0x402ad5
push ebx
jmp 0x402cec
xor edi, edi
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
je 0x402fb3
push ebx
call fcn.0040383e
mov esi, eax
cmp dword [ebp - 0xc], 0
je 0x402fc2
push 0x11
call fcn.0040383e
mov ebx, eax
cmp dword [ebp - 0x28], 0
je 0x402fd1
push 0x22
call fcn.0040383e
mov edi, eax
push 0xffffffffffffffcd
call fcn.0040383e
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4020a1
push 1
call fcn.0040383e
push 0x12
mov esi, eax
call fcn.0040383e
push 0xffffffffffffffdd
mov ebx, eax
call fcn.0040383e
push eax
push 0x3ff
push edi
push 0x409010
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x409010]
cmp eax, dword [edi]
jmp 0x402292
push 0x31
call fcn.0040383e
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 1
test ecx, ecx
jne 0x403070
lea ecx, [ebp + 8]
push ecx
push 2
push 0
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x401f60
push 2
call fcn.0040383e
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40313d
and dword [ebp - 4], eax
jmp 0x40313d
and ecx, 2
push ecx
push eax
push dword [ebp - 0x1c]
call fcn.0040379a
test eax, eax
jne case.default.0x401f60
and dword [ebp - 4], eax
jmp case.default.0x401f60
push 0x12
call fcn.0040383e
push 0x31
mov edi, eax
call fcn.0040383e
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
push ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.default.0x401f60
mov ebx, dword [ebp - 0x28]
cmp ebx, 1
jg 0x4030ef
push 0x23
call fcn.0040383e
mov esi, eax
push esi
call sub.KERNEL32.dll_lstrlenA
inc eax
push eax
xor eax, eax
cmp ebx, 1
push esi
setne al
inc eax
push eax
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x403060
cmp ebx, 2
jne 0x403108
push 3
call fcn.00403821
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
push 4
jmp 0x4030de
cmp ebx, 3
jne 0x40313d
mov ebx, 0x40a108
push 0x400
xor esi, esi
push ebx
push esi
push dword [ebp - 0x24]
call fcn.00403c24
cmp eax, esi
jl 0x40313d
push eax
push ebx
push 3
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40313d
mov dword [ebp - 4], esi
push dword [ebp + 8]
jmp 0x4031d2
push 2
call fcn.0040383e
push 0x13
mov esi, eax
call fcn.0040383e
mov ebx, eax
lea eax, [ebp - 8]
and byte [edi], 0
push eax
push 0x20019
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ac3
lea eax, [ebp - 0x20]
xor esi, esi
push eax
lea eax, [ebp + 8]
push edi
push eax
push esi
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x20], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x4031c9
cmp dword [ebp + 8], 4
je 0x4031b3
cmp dword [ebp + 8], ecx
je 0x4031ac
cmp dword [ebp + 8], 2
jne 0x4031c9
cmp dword [ebp - 0x28], esi
je 0x4031cf
jmp 0x4031cc
cmp dword [ebp - 0x28], esi
jne 0x4031bf
mov dword [ebp - 4], 1
push dword [edi]
push edi
call fcn.004067ba
jmp 0x4031cf
and byte [edi], 0
mov dword [ebp - 4], ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.default.0x401f60
push 3
call fcn.00403821
push 0x12
mov ebx, eax
call fcn.0040383e
lea ecx, [ebp + 8]
and byte [edi], 0
push ecx
xor esi, esi
push 0x20019
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ac3
cmp dword [ebp - 0x28], esi
mov eax, 0x3ff
mov dword [ebp - 8], eax
je 0x403229
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x40323c
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
and byte [edi + 0x3ff], 0
jmp 0x40313d
cmp byte [edi], 0
je case.default.0x401f60
push edi
call fcn.004067d3
push eax
jmp 0x402b78
push 0xfffffffffffffff0
call fcn.0040383e
push dword [ebp + 8]
push dword [ebp - 0xc]
push eax
call fcn.0040653e
cmp eax, 0xffffffff
jne 0x4033be
mov eax, dword [ebp - 0x14]
and byte [eax], 0
jmp 0x402ac3
cmp dword [ebp + 8], 0
je 0x40329b
push 1
call fcn.00403821
mov byte [0x409d08], al
xor eax, eax
inc eax
jmp 0x4032a8
push 0x11
call fcn.0040383e
push eax
call sub.KERNEL32.dll_lstrlenA
cmp byte [edi], 0
je 0x402ac3
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push 0x409d08
push edi
call fcn.004067d3
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4020a1
push 2
xor esi, esi
call fcn.00403821
cmp eax, 1
mov dword [ebp - 0x10], eax
jl case.default.0x401f60
mov eax, 0x3ff
cmp dword [ebp - 0x10], eax
jle 0x4032f1
mov dword [ebp - 0x10], eax
cmp byte [edi], 0
je 0x403380
and byte [ebp + 0xb], 0
push edi
call fcn.004067d3
cmp dword [ebp - 0x10], 0
mov edi, eax
jle 0x403380
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x29]
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403380
cmp dword [ebp - 8], 1
jne 0x403380
cmp dword [ebp - 0x24], 0
jne 0x403350
mov al, byte [ebp - 0x29]
test al, al
je 0x403380
cmp byte [ebp + 0xb], 0xd
je 0x403360
cmp byte [ebp + 0xb], 0xa
je 0x403360
mov byte [esi + ebx], al
inc esi
cmp esi, dword [ebp - 0x10]
mov byte [ebp + 0xb], al
jl 0x40330c
jmp 0x403380
movzx eax, byte [ebp - 0x29]
push eax
push ebx
call fcn.004067ba
jmp 0x402ad3
cmp byte [ebp + 0xb], al
je 0x403373
cmp al, 0xd
je 0x40336d
cmp al, 0xa
jne 0x403373
mov byte [esi + ebx], al
inc esi
jmp 0x403380
push 1
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and byte [esi + ebx], 0
test esi, esi
jne case.default.0x401f60
jmp 0x402ac3
cmp byte [edi], 0
je case.default.0x401f60
push dword [ebp + 8]
push 0
push 1
call fcn.00403821
push eax
push edi
call fcn.004067d3
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x24], 0
jl case.default.0x401f60
push eax
push dword [ebp - 0x14]
jmp 0x402059
cmp byte [edi], 0
je case.default.0x401f60
push edi
call fcn.004067d3
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.default.0x401f60
cmp byte [ebx], 0
je 0x402298
lea eax, [ebp - 0x190]
push eax
push ebx
call fcn.004067d3
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402298
lea eax, [ebp - 0x164]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
jmp case.default.0x401f60
push 0
call fcn.0040383e
lea ecx, [ebp - 0x190]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x403441
mov eax, dword [ebp - 0x18]
and byte [eax], 0
and byte [ebx], 0
jmp 0x402ac3
push eax
push dword [ebp - 0x18]
call fcn.004067ba
lea eax, [ebp - 0x164]
push eax
push ebx
jmp 0x40340f
push 0
mov esi, 0xfffffd66
call fcn.0040383e
mov edi, eax
push edi
call fcn.0040641a
test eax, eax
push edi
je 0x40347a
mov ebx, 0x409d08
push ebx
call sub.KERNEL32.dll_lstrcpyA
jmp 0x40349b
push 0x79f400
push 0x409d08
call sub.KERNEL32.dll_lstrcpyA
push eax
call fcn.00406395
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, 0x409d08
push ebx
call fcn.00406a85
push 2
push 0x40000000
push ebx
call fcn.0040653e
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40356f
mov eax, dword [0x799e48]
push eax
mov dword [ebp - 8], eax
call fcn.0040631b
mov edi, eax
test edi, edi
je 0x403566
push 0
call fcn.00403f6e
push dword [ebp - 8]
push edi
call fcn.00403f3c
mov eax, dword [0x799e44]
push dword [eax + 0x118]
call fcn.0040631b
mov esi, eax
test esi, esi
mov dword [ebp - 0x20], esi
je 0x40353d
mov eax, dword [0x799e44]
push dword [eax + 0x118]
push esi
push 0
push dword [eax + 0x114]
call fcn.00403c24
jmp 0x40352a
mov ebx, dword [esi]
mov eax, dword [esi + 4]
add esi, 8
push ebx
add eax, edi
push esi
push eax
call fcn.0040651a
add esi, ebx
cmp byte [esi], 0
jne 0x403516
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, 0x409d08
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp - 8]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
push esi
push dword [ebp + 8]
push 0xffffffffffffffff
call fcn.00403c24
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff3
test esi, esi
pop edi
jge 0x403587
push 0xffffffffffffffef
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 1
push ebx
push edi
jmp 0x402204
push 0
call fcn.00403821
mov esi, eax
cmp esi, dword [0x799e6c]
jae 0x402ac3
mov ecx, dword [0x799e68]
lea eax, [esi + esi*2]
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
mov dword [ebp - 8], eax
jl 0x4035d0
mov eax, dword [eax + ecx*4]
push eax
push dword [ebp - 0x18]
jne 0x402059
call fcn.0040686a
jmp case.default.0x401f60
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
or edi, 0xffffffff
sub edi, ecx
je 0x4035e9
push 2
call fcn.00403821
mov dword [ebp + 8], eax
jmp 0x4035f7
push dword [ebp + 8]
push esi
push 0x417
push dword [ebp - 0x20]
call ebx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
test edi, edi
mov dword [ecx + edi*4], eax
je case.default.0x401f60
push 0
push esi
push 0x418
push dword [ebp - 0x20]
call ebx
jmp case.default.0x401f60
xor esi, esi
push esi
call fcn.00403821
cmp dword [ebp - 0x24], esi
je 0x403642
inc dword [0x799eb8]
push esi
push esi
push 0x432
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x401f60
cmp eax, 0x20
jae 0x402ac3
cmp dword [ebp + 8], esi
mov ecx, dword [0x799e44]
je 0x403665
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4 + 0x88], edx
jmp case.default.0x401f60
push dword [ecx + eax*4 + 0x88]
push ebx
jmp 0x4035c6