Function at 0x40165a
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x174]
sub esp, 0x1bc
mov eax, dword [0x42bca4]
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x170]
mov ecx, eax
mov esi, edx
shl ecx, 0xa
shl esi, 0xa
mov dword [ebp - 0x194], ecx
add ecx, section..ndata
mov dword [ebp - 0x18c], ecx
lea ecx, [ebp - 0x170]
mov dword [0x41283c], ecx
mov ecx, dword [ebp - 0x174]
sub ecx, 2
cmp ecx, 0x41
ja case.0x4016cd.65
lea ebx, [esi + section..ndata]
jmp dword [ecx*4 + 0x40b004]
mov dword [esp + 4], 0
mov dword [esp], edx
jmp 0x401caa
inc dword [0x42c4c0]
cmp dword [ebp - 0x190], 0
mov edx, 0x7fffffff
je case.0x4016cd.2
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push edi
mov edx, 0x7fffffff
jmp case.0x4016cd.2
mov dword [esp], edx
call fcn.0040161a
push ebx
dec eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040382b
mov edx, eax
push esi
push esi
jmp case.0x4016cd.2
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.00406fb7
jmp 0x4037ba
mov dword [esp], 0
call fcn.00401456
test eax, eax
push ecx
mov edx, 1
cmovle eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402181
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x402181
cmp dword [ebp - 0x168], 0
jne 0x4017b7
mov eax, dword [edx*4 + 0x42bbe0]
mov dword [esp], 1
mov dword [ebp - 0x18c], edx
mov dword [edx*4 + 0x42bba0], eax
call fcn.00401456
push edx
mov edx, dword [ebp - 0x18c]
jmp 0x4017be
mov eax, dword [edx*4 + 0x42bba0]
mov dword [edx*4 + 0x42bbe0], eax
jmp case.0x4016cd.65
mov ecx, dword [ebp - 0x168]
xor edx, edx
mov eax, dword [ecx*4 + 0x42bbe0]
test eax, eax
sete dl
and eax, dword [ebp - 0x164]
mov edx, dword [ebp + edx*4 - 0x170]
mov dword [ecx*4 + 0x42bbe0], eax
jmp case.0x4016cd.2
mov eax, dword [eax*4 + 0x42bbe0]
jmp 0x402516
mov edx, dword [0x42c4c4]
test edx, edx
je 0x40181c
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
mov eax, dword [0x42c4c8]
test eax, eax
je case.0x4016cd.65
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x402553
mov dword [esp], 0xfffffff0
call fcn.00401400
mov edx, dword [ebp - 0x16c]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401ae5
mov dword [esp], 0xfffffff0
xor edi, edi
call fcn.00401400
push ecx
mov ebx, eax
mov dword [esp], eax
call fcn.00407921
test eax, eax
push esi
je 0x4018f2
mov ecx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x190], ecx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call fcn.00407890
mov esi, eax
push ecx
push ecx
mov al, byte [eax]
mov byte [esi], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
mov byte [ebp - 0x18c], al
call dword [ebp - 0x190]
test eax, eax
push edx
push edx
jne 0x4018e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4018d0
inc edi
jmp 0x4018e3
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
push edx
cmp eax, 1
adc edi, 0
mov cl, byte [ebp - 0x18c]
lea eax, [esi + 1]
test cl, cl
mov byte [esi], cl
jne 0x40188a
cmp dword [ebp - 0x16c], 0
je 0x401928
mov dword [esp], 0xffffffe6
call fcn.0040163b
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x434800
call fcn.00407ca2
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x40365d
mov dword [esp], 0xfffffff5
jmp 0x403658
mov dword [esp], 0
call fcn.00401400
push ecx
mov dword [esp], eax
call fcn.0040810f
jmp 0x402335
mov dword [esp], 0xffffffd0
call fcn.00401400
push edx
mov ebx, eax
mov dword [esp], 0xffffffdf
call fcn.00401400
push ecx
mov esi, eax
mov dword [esp], 0x13
call fcn.00401400
push edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
push edx
push edx
je 0x401998
mov dword [esp], 0xffffffe3
jmp 0x402bb2
cmp dword [ebp - 0x168], 0
je 0x402a22
mov dword [esp], ebx
call fcn.0040810f
test eax, eax
push edi
je 0x402a22
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004082eb
push ebx
push ebx
mov dword [esp], 0xffffffe4
jmp 0x402bb2
mov dword [esp], 0
call fcn.00401400
mov ebx, eax
push ecx
lea eax, [ebp - 0x158]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], 0x400
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x401a42
mov eax, dword [ebp - 0x158]
xor edi, edi
cmp ebx, eax
jae 0x401a54
cmp byte [eax], 0
je 0x401a54
mov dword [esp], ebx
call fcn.0040810f
test eax, eax
push edx
je 0x401a42
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call fcn.00407ca2
push eax
push eax
jmp 0x401a54
mov eax, dword [ebp - 0x194]
mov edi, 1
mov byte [eax + section..ndata], 0
cmp dword [ebp - 0x168], 0
jne 0x403817
mov eax, dword [ebp - 0x18c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 0xc
jmp 0x403817
mov dword [esp], 0xffffffff
call fcn.00401400
lea edx, [ebp - 0x158]
push edi
xor edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
sub esp, 0x18
test eax, eax
jmp 0x402d8f
mov dword [esp], 0xffffffef
call fcn.00401400
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407ac0
push edx
push edx
jmp 0x40320d
mov dword [esp], 0x31
call fcn.00401400
push ebx
mov ebx, dword [ebp - 0x170]
mov esi, eax
mov dword [esp], eax
call fcn.004078f3
and ebx, 7
test eax, eax
push edi
je 0x401b23
mov dword [esp + 4], esi
mov dword [esp], 0x412840
call fcn.00407ca2
jmp 0x401b4e
mov dword [esp + 4], 0x434800
mov dword [esp], 0x412840
call fcn.00407ca2
push edx
push edx
mov dword [esp], eax
call fcn.00407cde
push ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407cd4
push edi
push edi
mov dword [esp], 0x412840
call fcn.00407d23
cmp ebx, 2
push eax
jle 0x401ba0
mov dword [esp], 0x412840
call fcn.0040810f
mov edx, eax
xor eax, eax
push ecx
test edx, edx
je 0x401b8f
lea eax, [ebp - 0x164]
add edx, 0x14
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push edx
push edx
sub ebx, 3
or ebx, 0x80000000
test ebx, eax
sete bl
movzx ebx, bl
test ebx, ebx
jne 0x401bb8
mov dword [esp], 0x412840
call fcn.00407a32
mov eax, 2
push edi
jmp 0x401bc1
xor eax, eax
cmp ebx, 1
setne al
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x412840
call fcn.00407a64
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
jne 0x401cb4
test ebx, ebx
je 0x401c0d
mov dword [esp + 4], esi
mov dword [esp], 0xffffffe2
call fcn.00406fb7
push ecx
push ecx
cmp ebx, 2
sete al
movzx eax, al
mov edi, eax
jmp 0x403817
mov dword [esp + 4], section..ndata
mov dword [esp], 0x413040
call fcn.00407ca2
push eax
push eax
mov dword [esp + 4], 0x412840
mov dword [esp], section..ndata
call fcn.00407ca2
push eax
push eax
mov eax, dword [ebp - 0x15c]
mov dword [esp], 0x412c40
mov dword [esp + 4], eax
call fcn.00407df2
push eax
push eax
mov dword [esp + 4], 0x413040
mov dword [esp], section..ndata
call fcn.00407ca2
push eax
push eax
mov eax, dword [ebp - 0x170]
mov dword [esp], 0x412c40
sar eax, 3
mov dword [esp + 4], eax
call fcn.00407822
cmp eax, 4
push edx
push edx
je 0x401ba4
cmp eax, 5
jne 0x401c9b
inc dword [0x42bbe8]
jmp 0x40381d
mov dword [esp + 4], 0x412840
mov dword [esp], 0xfffffffa
call fcn.00406fb7
jmp 0x40210d
mov dword [esp + 4], esi
mov dword [esp], 0xffffffea
call fcn.00406fb7
push eax
push eax
mov eax, dword [ebp - 0x168]
inc dword [0x42bc14]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00403d3a
dec dword [0x42bc14]
sub esp, 0x10
cmp dword [ebp - 0x164], 0xffffffff
mov ebx, eax
jne 0x401d0b
cmp dword [ebp - 0x160], 0xffffffff
je 0x401d2d
lea eax, [ebp - 0x164]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
push eax
jns case.0x4016cd.65
cmp ebx, 0xfffffffe
jne 0x401d6c
mov dword [esp + 4], 0xffffffe9
mov dword [esp], 0x412840
call fcn.00407df2
push edi
push edi
mov dword [esp + 4], esi
mov dword [esp], 0x412840
call fcn.00407cd4
jmp 0x401d80
mov dword [esp + 4], 0xffffffee
mov dword [esp], 0x412840
call fcn.00407df2
push ebx
push ebx
mov dword [esp + 4], 0x200010
mov dword [esp], 0x412840
jmp 0x402108
mov dword [esp], 0
jmp 0x401df2
mov dword [esp], 0x31
call fcn.00401400
push edx
mov edx, dword [ebp - 0x170]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00407822
test eax, eax
push ecx
push ecx
je 0x402a22
cmp eax, dword [ebp - 0x168]
je 0x401fc7
cmp eax, dword [ebp - 0x160]
jne case.0x4016cd.65
mov edx, dword [ebp - 0x15c]
jmp case.0x4016cd.2
mov dword [esp], 0xfffffff0
call fcn.00401400
mov edx, dword [ebp - 0x16c]
push edi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00408592
jmp 0x4037ba
mov dword [esp], 1
call fcn.00401400
push esi
mov dword [esp], eax
call fcn.00407cca
jmp 0x402515
mov dword [esp], 2
call fcn.00401456
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.00401456
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 1
call fcn.00401400
cmp dword [ebp - 0x168], 0
push ecx
mov ecx, eax
mov byte [esi + section..ndata], 0
mov edx, dword [ebp - 0x18c]
je 0x401e78
test edi, edi
je case.0x4016cd.65
mov dword [esp], ecx
mov dword [ebp - 0x190], edx
mov dword [ebp - 0x18c], ecx
call fcn.00407cca
push edx
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x18c]
test edx, edx
jns 0x401ea5
add edx, eax
js case.0x4016cd.65
cmp eax, edx
mov dword [esp], ebx
cmovg eax, edx
add ecx, eax
mov dword [esp + 4], ecx
call fcn.00407ca2
test edi, edi
push ecx
push ecx
je case.0x4016cd.65
jns 0x401ed1
mov dword [esp], ebx
call fcn.00407cca
add edi, eax
push edx
js 0x401edf
cmp edi, 0x3ff
jg case.0x4016cd.65
jmp 0x401ee1
xor edi, edi
mov byte [edi + esi + section..ndata], 0
jmp case.0x4016cd.65
mov dword [esp], 0x20
call fcn.00401400
push ebx
mov ebx, eax
mov dword [esp], 0x31
call fcn.00401400
cmp dword [ebp - 0x160], 0
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x401f22
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x401f28
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push ecx
push ecx
jne 0x401fc7
jmp 0x402345
mov dword [esp], 1
call fcn.00401400
push edx
mov edi, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
test eax, eax
jne 0x401f70
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x401f92
cmp dword [ebp - 0x168], 0
jne 0x401f7d
xor edi, edi
jmp 0x401f92
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push edi
push edi
je 0x401f62
jmp 0x401f79
mov byte [ebx + 0x3ff], 0
jmp 0x403817
mov dword [esp], 0
call fcn.00401456
push ebx
mov ebx, eax
mov dword [esp], 1
call fcn.00401456
cmp dword [ebp - 0x15c], 0
push esi
jne 0x401fe3
cmp ebx, eax
jge 0x401fd2
mov edx, dword [ebp - 0x164]
jmp case.0x4016cd.2
jle 0x402345
mov edx, dword [ebp - 0x160]
jmp case.0x4016cd.2
cmp ebx, eax
jb 0x401fc7
ja 0x401fd8
jmp 0x402345
mov dword [esp], 1
xor edi, edi
call fcn.00401456
push edx
mov esi, eax
mov dword [esp], 2
call fcn.00401456
cmp dword [ebp - 0x164], 0xc
push ecx
mov ecx, eax
ja case.default.0x40201d
mov eax, dword [ebp - 0x164]
jmp dword [eax*4 + 0x40b10c]
add esi, ecx
jmp 0x402080
sub esi, ecx
jmp 0x402080
imul esi, ecx
jmp 0x402080
test ecx, ecx
je 0x402084
mov eax, esi
cdq
idiv ecx
jmp 0x402057
or esi, ecx
jmp 0x402080
and esi, ecx
jmp 0x402080
xor esi, ecx
jmp 0x402080
test esi, esi
sete al
jmp 0x402054
or esi, ecx
setne al
movzx eax, al
mov esi, eax
jmp 0x402080
test esi, esi
setne al
xor edx, edx
test ecx, ecx
setne dl
mov esi, edx
and esi, eax
jmp 0x402080
test ecx, ecx
je 0x402084
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x402080
shl esi, cl
jmp 0x402080
sar esi, cl
xor edi, edi
jmp case.default.0x40201d
xor esi, esi
mov edi, 1
mov dword [esp + 4], esi
jmp 0x402310
mov dword [esp], 1
call fcn.00401400
push ecx
mov esi, eax
mov dword [esp], 2
call fcn.00401456
push edi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp case.0x4016cd.65
mov edx, dword [ebp - 0x168]
mov esi, dword [0x413c40]
test edx, edx
je 0x402154
mov eax, edx
dec eax
test esi, esi
je 0x4020e7
test eax, eax
mov esi, dword [esi]
jne 0x4020d8
test esi, esi
jne 0x402114
mov dword [esp + 4], 0xffffffe8
mov dword [esp], 0
call fcn.00407df2
push edx
push edx
mov dword [esp + 4], 0x200010
mov dword [esp], eax
call fcn.00407822
push eax
push eax
jmp 0x40170a
add esi, 4
mov dword [esp], 0x412840
mov dword [esp + 4], esi
call fcn.00407ca2
push eax
push eax
mov eax, dword [0x413c40]
mov dword [esp], esi
add eax, 4
mov dword [esp + 4], eax
call fcn.00407ca2
push eax
push eax
mov eax, dword [0x413c40]
mov dword [esp + 4], 0x412840
add eax, 4
jmp 0x4036a3
test eax, eax
je 0x402187
test esi, esi
je 0x402a22
lea eax, [esi + 4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407ca2
push edi
push edi
mov eax, dword [esi]
mov dword [esp], esi
mov dword [0x413c40], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
jmp case.0x4016cd.65
mov dword [esp + 4], 0x404
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x170]
push edx
push edx
mov dword [esp + 4], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.00407df2
mov eax, dword [0x413c40]
push ecx
push ecx
mov dword [ebx], eax
mov dword [0x413c40], ebx
jmp case.0x4016cd.65
mov dword [esp], 3
call fcn.00401456
push ecx
mov esi, eax
mov dword [esp], 4
call fcn.00401456
test byte [ebp - 0x15c], 1
push edi
mov edi, eax
je 0x4021ff
mov dword [esp], 0x33
call fcn.00401400
push edx
mov esi, eax
test byte [ebp - 0x15c], 2
je 0x402217
mov dword [esp], 0x44
call fcn.00401400
push edi
mov edi, eax
cmp dword [ebp - 0x174], 0x21
mov dword [esp], 1
jne 0x4022ac
call fcn.00401456
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 2
call fcn.00401456
mov edx, dword [ebp - 0x15c]
push ecx
sar edx, 2
je 0x40228f
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x158]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
sub esp, 0x1c
test eax, eax
sete al
movzx eax, al
mov edi, eax
jmp 0x4022f9
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4022ee
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x12
call fcn.00401400
push ecx
xor ecx, ecx
cmp byte [eax], 0
mov edx, dword [ebp - 0x18c]
cmove eax, ecx
cmp byte [edx], 0
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], esi
cmove edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_FindWindowExA]
sub esp, 0x10
mov dword [ebp - 0x158], eax
xor edi, edi
cmp dword [ebp - 0x170], 0
js 0x403817
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407bcf
push esi
push esi
jmp 0x403817
mov dword [esp], 0
call fcn.00401456
push ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
push ecx
je 0x402345
mov edx, dword [ebp - 0x16c]
jmp case.0x4016cd.2
mov edx, dword [ebp - 0x168]
jmp case.0x4016cd.2
mov dword [esp], 2
call fcn.00401456
push esi
mov esi, eax
mov dword [esp], 1
call fcn.00401456
push edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push edx
push edx
jmp 0x402516
add eax, dword [0x42bc68]
mov dword [esp], 0
mov ebx, eax
call fcn.00401456
push ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x403812
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edx
lea eax, [ebp - 0x158]
push edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x168]
mov edi, dword [ebp - 0x14c]
push ecx
push ecx
imul edi, eax
mov dword [esp], 0
imul eax, dword [ebp - 0x150]
mov ebx, eax
call fcn.00401400
push edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadImageA]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x172
mov dword [esp], esi
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
test eax, eax
je case.0x4016cd.65
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x402181
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push edi
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edx
push edx
mov esi, eax
mov dword [esp], 2
call fcn.00401456
push ecx
mov dword [esp + 4], esi
mov dword [esp + 8], 0x48
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esp, 0xc
neg eax
mov dword [esp], 3
mov dword [0x412800], eax
call fcn.00401456
mov dword [0x412810], eax
mov eax, dword [ebp - 0x160]
push esi
mov byte [0x412817], 1
mov dl, al
mov dword [esp], 0x41281c
and edx, 1
mov byte [0x412814], dl
mov dl, al
and eax, 4
mov byte [0x412816], al
mov eax, dword [ebp - 0x16c]
and edx, 2
mov byte [0x412815], dl
mov dword [esp + 4], eax
call fcn.00407df2
push edi
push edi
mov dword [esp], 0x412800
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00407bcf
jmp 0x4037ba
mov dword [esp], 0
call fcn.00401456
push edx
mov ebx, eax
mov dword [esp], 1
call fcn.00401456
cmp dword [ebp - 0x164], 0
push ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
jne 0x40255e
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4037ba
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4037ba
mov dword [esp], 0
call fcn.00401400
push esi
mov edi, eax
mov dword [esp], 0x31
call fcn.00401400
push edx
mov esi, eax
mov dword [esp], 0x22
call fcn.00401400
push ecx
mov ebx, eax
mov dword [esp], 0x15
call fcn.00401400
push eax
mov dword [esp], 0xffffffec
call fcn.0040163b
push eax
xor eax, eax
cmp byte [ebx], 0
mov edx, dword [ebp - 0x164]
cmove ebx, eax
cmp byte [edi], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x434800
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
cmovne eax, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
cmp eax, 0x20
setle al
jmp 0x401c03
mov dword [esp], 0
call fcn.00401400
push edx
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0xffffffeb
call fcn.00406fb7
push ecx
push ecx
mov dword [esp], ebx
call fcn.00407765
test eax, eax
push ebx
mov ebx, eax
je 0x402a22
cmp dword [ebp - 0x168], 0
je 0x402699
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], 0x64
mov dword [esp], ebx
call esi
cmp eax, 0x102
push edi
push edi
jne 0x402661
mov dword [esp], 0xf
call fcn.00408822
push eax
jmp 0x40263c
lea eax, [ebp - 0x158]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x16c], 0
push esi
push esi
js 0x40269d
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407bcf
push ecx
push ecx
xor edi, edi
jmp 0x4026ab
xor eax, eax
cmp dword [ebp - 0x158], 0
setne al
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40365d
mov dword [esp], 2
call fcn.00401400
push edi
mov dword [esp], eax
call fcn.0040810f
test eax, eax
push edx
mov edi, eax
je 0x4026f4
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x18c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00407bcf
push esi
push esi
mov eax, dword [edi + 0x18]
jmp 0x402516
mov eax, dword [ebp - 0x194]
mov byte [esi + section..ndata], 0
mov byte [eax + section..ndata], 0
jmp 0x402a22
mov dword [esp], 0xffffffee
call fcn.00401400
push edi
mov dword [ebp - 0x190], eax
mov dword [esp], 0xc
call fcn.00408273
mov ecx, dword [ebp - 0x190]
push edx
lea edx, [ebp - 0x17c]
mov dword [esp + 4], edx
mov dword [esp], ecx
call eax
mov edi, eax
mov eax, dword [ebp - 0x194]
push ecx
test edi, edi
mov byte [esi + section..ndata], 0
push ecx
mov byte [eax + section..ndata], 0
je 0x402a22
mov dword [esp + 4], edi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
push esi
push esi
mov esi, eax
je 0x402a22
mov dword [esp], 0xd
call fcn.00408273
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], 0xe
call fcn.00408273
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x190]
push ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x194]
sub esp, 0x10
test eax, eax
jne 0x4027d2
mov edi, 1
jmp 0x402834
lea eax, [ebp - 0x158]
mov dword [esp + 4], 0x40b000
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x178]
mov dword [esp + 8], eax
call dword [ebp - 0x198]
sub esp, 0x10
test eax, eax
je 0x4027cb
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407bcf
mov eax, dword [ebp - 0x178]
push edi
push edi
xor edi, edi
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407bcf
push eax
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40365d
cmp dword [0x42bc18], 0
js 0x402962
mov dword [esp], 0xfffffff0
call fcn.00401400
push ebx
mov edi, eax
mov dword [esp], 1
call fcn.00401400
cmp dword [ebp - 0x160], 0
push esi
mov esi, eax
jne 0x40289e
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x402956
jmp 0x4028ae
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push ecx
mov ebx, eax
je 0x402876
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push edx
mov edi, eax
push edx
je 0x402913
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4028e4
mov dword [esp], eax
call fcn.0040163b
push eax
call edi
test eax, eax
setne al
movzx eax, al
mov edi, eax
jmp 0x40292a
mov eax, dword [ebp - 0x190]
mov dword [esp + 0x10], 0x40a000
mov dword [esp + 0xc], 0x413c40
mov dword [esp + 8], 0x42f000
mov dword [esp + 4], 0x400
mov dword [esp], eax
call edi
xor edi, edi
jmp 0x40292a
mov dword [esp + 4], esi
mov dword [esp], 0xfffffff7
call fcn.00406fb7
push edi
push edi
mov edi, 1
cmp dword [ebp - 0x164], 0
jne 0x403817
mov dword [esp], ebx
call fcn.00404a13
test eax, eax
push esi
je 0x403817
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40365d
mov dword [esp], 0xfffffff6
jmp 0x402a1c
mov dword [esp], 0xffffffe7
jmp 0x402a1c
mov dword [esp], 0xfffffff0
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdf
call fcn.00401400
push ecx
mov edi, eax
mov dword [esp], 2
call fcn.00401400
push ebx
mov dword [ebp - 0x190], eax
mov dword [esp], 0xffffffcd
call fcn.00401400
push esi
mov esi, eax
mov dword [esp], 0x45
call fcn.00401400
push edx
mov dword [ebp - 0x194], eax
mov dword [esp], edi
call fcn.004078f3
test eax, eax
push ecx
jne 0x4029df
mov dword [esp], 0x21
call fcn.00401400
push eax
lea eax, [ebp - 0x178]
mov dword [esp + 0xc], 0x4108d4
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40c5b4
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jns 0x402a2c
mov dword [esp], 0xfffffff0
call fcn.0040163b
push ebx
mov edi, 1
jmp 0x403817
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40ff94
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
mov ebx, eax
js 0x402b94
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x50]
mov ebx, eax
mov eax, dword [ebp - 0x178]
push edx
push edx
mov edx, dword [eax]
mov dword [esp + 4], 0x434800
mov dword [esp], eax
call dword [edx + 0x24]
mov eax, dword [ebp - 0x160]
push ecx
push ecx
movzx eax, ah
test eax, eax
je 0x402aa7
mov edx, dword [ebp - 0x178]
mov ecx, dword [edx]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x3c]
push eax
push eax
mov eax, dword [ebp - 0x178]
movzx ecx, word [ebp - 0x15e]
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x34]
push eax
push eax
cmp byte [esi], 0
je 0x402ae7
mov eax, dword [ebp - 0x178]
movzx ecx, byte [ebp - 0x160]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x190]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x178]
push edi
mov ecx, dword [ebp - 0x194]
push edi
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x1c]
test ebx, ebx
push eax
push eax
js 0x402b85
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x14], 0x400
mov ebx, 0x80004005
mov dword [esp + 0x10], 0x412000
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
je 0x402b85
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x412000
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0x178]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
test ebx, ebx
push ecx
js 0x402a15
mov dword [esp], 0xfffffff4
call fcn.0040163b
jmp 0x402181
mov dword [esp], 0
call fcn.00401400
push edi
mov ebx, eax
mov dword [esp], 0x11
call fcn.00401400
push edx
mov esi, eax
mov dword [esp], 0x23
call fcn.00401400
push ecx
mov edi, eax
mov dword [esp], ebx
call fcn.0040810f
test eax, eax
push edx
je 0x402c73
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [ebp - 0x154], 2
mov dword [ebp - 0x158], eax
call fcn.00407cca
push edx
mov byte [ebx + eax + 1], 0
mov dword [esp], esi
call fcn.00407cca
push ecx
mov byte [esi + eax + 1], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x150], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x13e], edi
xor edi, edi
mov word [ebp - 0x148], ax
call fcn.00406fb7
lea eax, [ebp - 0x158]
push ebx
push ebx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
push esi
je 0x403817
mov dword [esp + 4], 0
mov dword [esp], 0xfffffff9
call fcn.00406fb7
push edi
push edi
jmp 0x402a22
cmp edx, 0xbadf00d
jne 0x4020e7
inc dword [0x42bbf4]
jmp case.0x4016cd.65
xor esi, esi
test edx, edx
je 0x402cba
mov dword [esp], 0
call fcn.00401400
push esi
mov esi, eax
xor edi, edi
cmp dword [ebp - 0x16c], 0
je 0x402cd4
mov dword [esp], 0x11
call fcn.00401400
push ebx
mov edi, eax
xor ebx, ebx
cmp dword [ebp - 0x160], 0
je 0x402cee
mov dword [esp], 0x22
call fcn.00401400
push ecx
mov ebx, eax
mov dword [esp], 0xffffffcd
call fcn.00401400
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
sub esp, 0x10
jmp 0x40320d
mov dword [esp], 1
mov dword [ebp - 0x158], 0x7e4e21
call fcn.00401400
push ecx
mov edi, eax
mov dword [esp], 0x12
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0xffffffdd
call fcn.00401400
push ecx
mov edx, dword [ebp - 0x18c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x158]
mov dword [esp], edi
mov dword [esp + 0x10], 0x3ff
mov dword [esp + 0xc], ebx
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x158]
sub esp, 0x18
cmp dword [esi + section..ndata], eax
jne 0x403817
jmp 0x403445
cmp dword [ebp - 0x160], 0
jne 0x402de4
mov dword [esp], 2
call fcn.004015b0
test eax, eax
push edx
mov ebx, eax
je 0x402a22
mov dword [esp], 0x33
call fcn.00401400
push esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push edi
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x402e25
mov dword [esp], 0x22
call fcn.00401400
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x16c]
push ebx
and ecx, 2
test edx, edx
jne 0x402e10
mov ebx, dword [0x42bbe4]
lea edx, [ebx - 0x7fffffff]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00401482
sub esp, 0xc
mov esi, eax
test esi, esi
setne al
jmp 0x401c03
test edx, edx
mov edi, edx
jne 0x402e40
mov eax, dword [0x42bbe4]
lea edi, [eax - 0x7fffffff]
mov dword [esp], 2
mov ebx, dword [ebp - 0x160]
mov esi, dword [ebp - 0x15c]
call fcn.00401400
push edx
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x11
call fcn.00401400
push ecx
lea ecx, [ebp - 0x158]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x42bc10]
mov dword [esp], edi
mov dword [esp + 0x20], 0
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
or ecx, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x403817
cmp ebx, 1
jne 0x402eea
mov dword [esp], 0x23
call fcn.00401400
push ebx
mov dword [esp], 0x413040
call fcn.00407cca
inc eax
push edi
jmp 0x402f38
cmp ebx, 4
jne 0x402f08
mov dword [esp], 3
call fcn.00401456
mov dword [0x413040], eax
push ecx
mov eax, 4
jmp 0x402f38
xor eax, eax
cmp ebx, 3
jne 0x402f38
mov eax, dword [ebp - 0x164]
mov dword [esp + 0xc], 0xc00
mov dword [esp + 8], 0x413040
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403d3a
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x10], 0x413040
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
setne al
movzx eax, al
mov edi, eax
mov eax, dword [ebp - 0x158]
jmp 0x40305f
mov dword [esp], 0x20019
call fcn.004015b0
push edi
mov dword [ebp - 0x18c], eax
mov dword [esp], 0x33
call fcn.00401400
cmp dword [ebp - 0x18c], 0
push edx
mov byte [esi + section..ndata], 0
je 0x402a22
lea edx, [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x178], 0x3ff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x158]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x40300e
mov eax, dword [ebp - 0x158]
cmp eax, 4
je 0x40301c
cmp eax, 1
je 0x40301c
cmp eax, 2
je 0x403045
mov byte [esi + section..ndata], 0
mov edi, 1
jmp 0x403059
cmp eax, 4
jne 0x403045
xor eax, eax
cmp dword [ebp - 0x160], 0
mov dword [esp], ebx
sete al
mov edi, eax
mov eax, dword [esi + section..ndata]
mov dword [esp + 4], eax
call fcn.00407bcf
push ecx
push ecx
jmp 0x403059
mov eax, dword [ebp - 0x178]
mov edi, dword [ebp - 0x160]
mov byte [esi + eax + section..ndata], 0
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40365d
mov dword [esp], 0x20019
call fcn.004015b0
push ecx
mov edi, eax
mov dword [esp], 3
call fcn.00401456
test edi, edi
push edx
mov byte [esi + section..ndata], 0
je 0x402a22
cmp dword [ebp - 0x160], 0
mov dword [ebp - 0x158], 0x3ff
je 0x4030c9
mov dword [esp + 0xc], 0x3ff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
sub esp, 0x10
jmp 0x40310f
lea edx, [ebp - 0x158]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
sub esp, 0x20
test eax, eax
jne 0x402a22
mov byte [ebx + 0x3ff], 0
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402181
cmp byte [esi + section..ndata], 0
je case.0x4016cd.65
mov dword [esp], ebx
call fcn.00407bf4
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402181
mov dword [esp], 0xffffffed
call fcn.00401400
mov edx, dword [ebp - 0x168]
push edi
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x16c]
mov dword [esp + 4], edx
call fcn.00407a64
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402516
jmp 0x403445
cmp dword [ebp - 0x168], 0
je 0x4031a4
mov dword [esp], 1
call fcn.00401456
mov byte [0x412c40], al
push ecx
mov ecx, 1
jmp 0x4031bc
mov dword [esp], 0x11
call fcn.00401400
push edi
mov dword [esp], eax
call fcn.00407cca
push edx
mov ecx, eax
cmp byte [esi + section..ndata], 0
mov edi, 1
je 0x403817
mov dword [esp], ebx
mov dword [ebp - 0x18c], ecx
call fcn.00407bf4
mov ecx, dword [ebp - 0x18c]
push ebx
lea edx, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x412c40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jmp 0x401c00
mov dword [esp], 2
xor edi, edi
call fcn.00401456
test eax, eax
push ecx
mov dword [ebp - 0x190], eax
jle 0x403817
cmp byte [esi + section..ndata], 0
je 0x403346
mov dword [esp], ebx
xor ebx, ebx
call fcn.00407bf4
lea ecx, [ebp - 0x178]
push edx
mov esi, eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [ebp - 0x198], ecx
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403346
cmp dword [ebp - 0x158], 1
jne 0x403346
cmp dword [ebp - 0x164], 0
mov ecx, dword [ebp - 0x198]
je 0x4032c5
movzx eax, byte [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407bcf
push esi
push esi
jmp 0x40381d
cmp bl, 0xd
mov al, byte [ebp - 0x178]
je 0x4032d5
cmp bl, 0xa
jne 0x403317
cmp al, bl
je 0x4032e1
cmp al, 0xd
je 0x403307
cmp al, 0xa
je 0x403307
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
jmp 0x403346
mov ecx, dword [ebp - 0x194]
mov byte [edi + ecx + section..ndata], al
inc edi
jmp 0x403346
mov bl, al
mov eax, dword [ebp - 0x18c]
inc edi
test bl, bl
mov byte [eax + edi - 1], bl
je 0x403346
cmp dword [ebp - 0x190], 0x3ff
mov eax, 0x3ff
cmovle eax, dword [ebp - 0x190]
cmp eax, edi
jg 0x403251
mov eax, dword [ebp - 0x194]
test edi, edi
mov byte [edi + eax + section..ndata], 0
jmp 0x401c00
cmp byte [esi + section..ndata], 0
je case.0x4016cd.65
mov dword [esp], 2
mov edi, dword [ebp - 0x164]
call fcn.00401456
push ecx
mov esi, eax
mov dword [esp], ebx
call fcn.00407bf4
push ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp dword [ebp - 0x16c], 0
jns 0x4036b3
jmp case.0x4016cd.65
cmp byte [esi + section..ndata], 0
je case.0x4016cd.65
mov dword [esp], ebx
call fcn.00407bf4
push edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402181
mov eax, dword [ebp - 0x194]
cmp byte [eax + section..ndata], 0
je 0x403445
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407bf4
lea edx, [ebp - 0x158]
push ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
push edi
push edi
je 0x403445
jmp 0x403465
mov dword [esp], 2
call fcn.00401400
lea edx, [ebp - 0x158]
push edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
push edx
push edx
jne 0x403451
mov eax, dword [ebp - 0x194]
mov byte [eax + section..ndata], 0
mov byte [esi + section..ndata], 0
jmp 0x402a22
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407bcf
push esi
push esi
lea eax, [ebp - 0x12c]
mov dword [esp], ebx
mov dword [esp + 4], eax
jmp 0x4036a6
mov dword [esp], 0xfffffff0
call fcn.00401400
push edx
mov esi, eax
mov dword [esp], eax
call fcn.004078f3
test eax, eax
push ecx
jne 0x4034a0
mov dword [esp], 0xffffffed
call fcn.00401400
push eax
mov dword [esp], esi
call fcn.00407a32
push edi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call fcn.00407a64
sub esp, 0xc
mov dword [ebp - 0x18c], eax
inc eax
jne 0x4034e6
mov dword [esp], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xffffffef
push ebx
jmp 0x403655
mov eax, dword [0x42bc8c]
mov dword [esp], 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x190], eax
mov dword [esp + 4], eax
call edi
test eax, eax
push ecx
mov ebx, eax
push ecx
mov edx, 0xfffffd66
je 0x40362a
mov dword [esp], 0
call fcn.00403b19
push eax
mov eax, dword [ebp - 0x190]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00403ad1
push eax
push eax
mov eax, dword [ebp - 0x168]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call edi
test eax, eax
push edx
mov edi, eax
push edx
je 0x4035c3
mov eax, dword [ebp - 0x168]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call fcn.00403d3a
mov eax, edi
sub esp, 0x10
cmp byte [eax], 0
je 0x4035b9
mov ecx, dword [eax]
lea edx, [eax + 8]
mov dword [esp + 4], edx
mov dword [ebp - 0x194], edx
mov dword [esp + 8], ecx
mov dword [ebp - 0x198], ecx
mov ecx, dword [eax + 4]
add ecx, ebx
mov dword [esp], ecx
call fcn.00407a0f
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x198]
sub esp, 0xc
lea eax, [edx + ecx]
jmp 0x40357a
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00403d3a
sub esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x190], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x190]
push edi
test edx, edx
js 0x4034cd
mov eax, 0xfffffff3
xor edi, edi
mov dword [esp], eax
call fcn.0040163b
push ebx
jmp 0x403817
mov dword [esp], 0
call fcn.00401456
cmp dword [0x42bc4c], eax
push ecx
mov ebx, eax
jbe 0x402a22
imul esi, eax, 0x418
mov eax, dword [ebp - 0x168]
add esi, dword [0x42bc48]
test eax, eax
js 0x4036c5
jne 0x4036b0
mov eax, dword [ebp - 0x18c]
add esi, 0x18
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00407ca2
jmp 0x4037ba
mov eax, dword [esi + eax*4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
jmp 0x40251d
not eax
test eax, eax
mov dword [ebp - 0x168], eax
je 0x4036e6
mov dword [esp], 1
call fcn.00401456
mov dword [ebp - 0x16c], eax
push edx
jmp 0x403704
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], eax
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.00407df2
push edi
push edi
or dword [esi + 8], 0x100
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x16c]
mov dword [esi + eax*4], edx
cmp dword [ebp - 0x164], 0
je case.0x4016cd.65
mov dword [esp], ebx
call fcn.0040121c
jmp 0x402181
mov dword [esp], 0
call fcn.00401456
cmp eax, 0x1f
push ebx
ja 0x402a22
cmp dword [ebp - 0x164], 0
je 0x403786
cmp dword [ebp - 0x168], 0
je 0x403774
mov dword [esp], eax
call fcn.00401332
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00401282
jmp 0x4037ba
mov dword [esp], 0
call fcn.0040137c
push edx
jmp 0x4036b3
cmp dword [ebp - 0x168], 0
mov edx, dword [0x42bc20]
lea eax, [eax + 0x24]
je 0x4037a4
mov ecx, dword [ebp - 0x16c]
mov dword [edx + eax*4 + 4], ecx
jmp case.0x4016cd.65
mov eax, dword [edx + eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp], eax
call fcn.00407df2
push eax
push eax
jmp case.0x4016cd.65
and edx, dword [0x428140]
mov eax, dword [ebp - 0x190]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0xb
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
cmp dword [ebp - 0x170], 0
je case.0x4016cd.65
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
xor edi, edi
add dword [0x42bbe8], edi
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 4