Function at 0x4113f9
Capabilities:
Delete file
Set current directory

Disassembly:
push ebp
sub esp, 0x28c
lea ebp, [esp - 4]
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x28c], eax
push 0x60
mov eax, 0x42e5e2
call fcn.00415554
mov eax, dword [ebp + 0x298]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x2a0]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x50]
call fcn.00403937
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
mov byte [ebp - 0x12], 1
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x40], bl
push 0x42f944
lea ecx, [ebp + 0x54]
call fcn.00405078
mov byte [ebp - 4], 1
mov esi, 0x43009c
push esi
lea ecx, [ebp + 0x38]
call fcn.00408b9c
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp + 0x1c]
call fcn.00408b9c
mov byte [ebp - 4], 3
call dword [0x452508]
mov byte [ebp - 4], 4
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004135cd
push 0x29
push 0x28
lea eax, [ebp - 0x1c]
push eax
push 0x435d74
push dword [ebp - 0x20]
call fcn.004137dc
add esp, 0x20
test al, al
je 0x411506
push dword [ebp - 0x1c]
call fcn.00416cb0
push eax
push 0x453b18
push dword [ebp - 0x1c]
call fcn.0041270c
add esp, 0x10
test al, al
je 0x4114f3
push dword [0x453b18]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [0x453b18]
push str.WinMain__WinMain__szWorkingFolder_from_service____s_
jmp 0x4114fb
push dword [ebp - 0x1c]
push str.WinMain__WinMain__Error_hex2char___s__
call fcn.004140dd
pop ecx
pop ecx
mov byte [ebp - 0x13], 1
cmp dword [0x453b18], ebx
jne 0x41152e
push 1
push ebx
push 0x453b18
call fcn.00412adc
push dword [0x453b18]
push str.WinMain__WinMain__szWorkingFolder____s_
call fcn.004140dd
add esp, 0x14
push 1
lea eax, [ebp + 0x8c]
push eax
push ebx
push ebx
call fcn.0041208b
lea eax, [ebp + 0x8c]
push eax
push str.WinMain______s
call fcn.004140dd
push dword [ebp - 0x20]
push str.WinMain__WinMain__szCmdLine___s_
call fcn.004140dd
add esp, 0x20
push ebx
mov edi, 0x40f68a
push edi
push 0x104
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call esi
push ebx
push edi
push 0xa
push dword [ebp - 0x24]
call esi
lea eax, [ebp - 0x50]
push eax
push str.PARAMS
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00412fea
add esp, 0xc
cmp dword [ebp - 0x48], ebx
jne 0x4115a7
push str.WinMain__WinMain__Error_extracting_params
jmp 0x41199e
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x453b24
push 0x453b20
push 0x453b1c
push 0x453b14
push dword [ebp - 0x20]
lea eax, [ebp - 0x50]
push eax
call fcn.004100fe
push dword [0x453b24]
push dword [0x453b20]
push dword [0x453b1c]
push dword [0x453b14]
push str.WinMain__WinMain__Params_Loaded:_szLang__s__szURL__s__szCode__s__szOwner__s_
call fcn.004140dd
add esp, 0x40
push dword [ebp - 0x44]
push dword [ebp - 0x18]
push str.WinMain__WinMain__Params_Loaded:_szScript__s__szTmp__s_
call fcn.004140dd
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x40]
push eax
movzx eax, byte [ebp - 0x11]
push eax
push str.WinMain__WinMain__Params_Loaded:_bSelfDelete__i__bPrintScript__i__bElevation__i__bFromService__i_
call fcn.004140dd
lea eax, [ebp + 0x54]
push eax
call fcn.0041093e
add esp, 0x24
cmp dword [ebp - 0x18], ebx
je 0x411771
mov byte [ebp - 0x12], 1
cmp dword [0x453b1c], ebx
je 0x411999
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov esi, str.WinMain__WinMain__Extracting_proxy_data_from_command_line...
push esi
call fcn.004140dd
push 0x29
push 0x28
lea eax, [ebp - 0x30]
push eax
push str.proxy
push dword [ebp - 0x20]
call fcn.004137dc
push 0x29
push 0x28
lea eax, [ebp - 0x28]
push eax
push str.auth
push dword [ebp - 0x20]
call fcn.004137dc
push esi
call fcn.004140dd
add esp, 0x30
cmp dword [ebp - 0x30], ebx
je 0x4118b1
push dword [ebp - 0x30]
lea ecx, [ebp + 0x54]
call fcn.00404f8b
lea eax, [ebp - 0x30]
push eax
call fcn.0041354e
pop ecx
cmp dword [ebp - 0x28], ebx
je 0x411875
push dword [ebp - 0x28]
call fcn.00416cb0
pop ecx
test eax, eax
jbe 0x411875
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
call fcn.0041263d
pop ecx
pop ecx
cmp dword [ebp - 0x2c], ebx
je 0x41186b
push dword [ebp - 0x2c]
lea ecx, [ebp + 0x70]
call fcn.00408b9c
mov byte [ebp - 4], 5
push ebx
push 0x430098
lea ecx, [ebp + 0x70]
call fcn.0040a653
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x411840
push esi
push ebx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 0x70]
call fcn.0040a8c6
mov byte [ebp - 4], 6
push edi
push ebx
push eax
lea ecx, [ebp + 0x38]
call fcn.0040890b
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.00408583
push edi
inc esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 0x70]
call fcn.0040a8c6
mov byte [ebp - 4], 7
push edi
push ebx
push eax
lea ecx, [ebp + 0x1c]
call fcn.0040890b
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.00408583
jmp 0x41185c
push str.WinMain__WinMain__Getting_script...
call fcn.004140dd
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11]
push eax
call fcn.004109e6
push dword [ebp - 0x18]
push str.WinMain__WinMain__script_:__s
call fcn.004140dd
add esp, 0x2c
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x4117bb
mov eax, 0x42f944
push eax
push str.WinMain__WinMain__error_:__s
call fcn.004140dd
push dword [ebp - 0x38]
push str.WinMain__WinMain__szRCMode_:__s
call fcn.004140dd
push dword [ebp - 0x3c]
push str.WinMain__WinMain__szTicket_:__s
call fcn.004140dd
add esp, 0x18
cmp dword [ebp - 0x38], ebx
je 0x411647
push 0x435a98
push dword [ebp - 0x38]
call fcn.00417cc0
pop ecx
pop ecx
test eax, eax
jne 0x411647
call fcn.00412965
cmp eax, 0x50
jl 0x411647
push str.scrRC.tmp
push dword [ebp - 0x18]
call fcn.0040fa1a
push str.WinMain__WinMain__Elevating...
call fcn.004140dd
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x12]
push eax
push dword [ebp - 0x24]
call fcn.00410641
add esp, 0x18
jmp 0x4119bb
cmp dword [ebp + 0x88], 8
mov eax, dword [ebp + 0x74]
jae 0x41184f
lea eax, [ebp + 0x74]
push eax
push str.WinMain_GetProxyAuth__could_not_decrypt_auth___ws_
call fcn.004140dd
pop ecx
pop ecx
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp + 0x70]
call fcn.00408583
lea eax, [ebp - 0x2c]
push eax
call fcn.0041354e
pop ecx
cmp dword [ebp + 0x34], 8
mov edx, dword [ebp + 0x20]
jae 0x411881
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x50], 8
mov ecx, dword [ebp + 0x3c]
jae 0x41188d
lea ecx, [ebp + 0x3c]
cmp dword [ebp + 0x6c], 0x10
mov eax, dword [ebp + 0x58]
jae 0x411899
lea eax, [ebp + 0x58]
push edx
push ecx
push eax
push dword [0x453b1c]
push str.WinMain__WinMain__szURL___s__proxy___s__auth_ws:_ws
call fcn.004140dd
add esp, 0x14
jmp 0x4118bc
push str.WinMain__WinMain__No_proxy_data_in_command_line...
call fcn.004140dd
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x411992
push 0x42f944
lea ecx, [ebp + 0x70]
call fcn.00405078
mov byte [ebp - 4], 8
push dword [ebp - 0x18]
lea ecx, [ebp]
call fcn.00405078
mov byte [ebp - 4], 9
push str.WinMain__WinMain__Executing_script...
call fcn.004140dd
pop ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6c]
call fcn.00405078
mov byte [ebp - 4], 0xa
lea eax, [ebp + 0x70]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x24]
call fcn.00410fb6
add esp, 0x24
mov byte [ebp - 4], 9
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.004049c1
cmp dword [ebp + 0x84], ebx
jbe 0x411972
cmp dword [ebp + 0x88], 0x10
mov eax, dword [ebp + 0x74]
jae 0x41194f
lea eax, [ebp + 0x74]
push eax
push str.WinMain__WinMain__ShowQuest__s_
call fcn.004140dd
pop ecx
pop ecx
cmp dword [ebp + 0x88], 0x10
mov eax, dword [ebp + 0x74]
jae 0x41196b
lea eax, [ebp + 0x74]
push eax
call fcn.004107ed
pop ecx
mov byte [ebp - 4], 8
push ebx
push 1
lea ecx, [ebp]
call fcn.004049c1
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp + 0x70]
call fcn.004049c1
jmp 0x4119a4
push str.WinMain__WinMain_Could_not_retrieve_script
jmp 0x41199e
push str.WinMain__WinMain_szURL_Error...
call fcn.004140dd
pop ecx
push str.WinMain__WinMain__Deleting_files...
call fcn.004140dd
mov dword [esp], 0x435154
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.WinMain__WinMain__Cleanning_up
call fcn.004140dd
mov dword [esp], 0x453b14
call fcn.0041354e
mov dword [esp], 0x453b1c
call fcn.0041354e
mov dword [esp], 0x453b20
call fcn.0041354e
mov dword [esp], 0x453b24
call fcn.0041354e
lea eax, [ebp - 0x18]
push eax
call fcn.0041354e
lea eax, [ebp - 0x20]
push eax
call fcn.0041354e
lea eax, [ebp - 0x44]
push eax
call fcn.0041354e
lea eax, [ebp - 0x3c]
push eax
call fcn.0041354e
lea eax, [ebp - 0x1c]
push eax
call fcn.0041354e
add esp, 0x18
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xc
jge 0x411a44
mov eax, dword [ebp - 0x34]
lea eax, [eax*4 + 0x453b34]
push eax
call fcn.0041354e
pop ecx
inc dword [ebp - 0x34]
jmp 0x411a28
mov eax, dword [0x453b30]
cmp eax, ebx
je 0x411a54
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x453b30], ebx
cmp byte [ebp - 0x11], bl
je 0x411a76
push str.WinMain__WinMain_SelfDelete
call fcn.004140dd
push dword [0x453b18]
call fcn.0040f779
pop ecx
pop ecx
push 0x453b18
call fcn.0041354e
mov dword [esp], str.WinMain____
call fcn.004140dd
pop ecx
mov dword [ebp - 4], 3
jmp 0x411ab1
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.00408583
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.00408583
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.004049c1
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x50]
call fcn.00416e16
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x28c]
xor ecx, ebp
call fcn.00414b1e
add ebp, 0x290
leave
ret 0x10