Function at 0x4014e2
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set current directory
Set file attributes
Set registry value

Disassembly:
sub esp, 0x1c0
push ebx
mov edx, dword [0x42e8d8]
mov eax, section..ndata
push ebp
push esi
mov esi, dword [esp + 0x1d0]
xor ebx, ebx
push edi
push 7
pop ecx
lea edi, [esp + 0x24]
mov dword [esp + 0x14], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x2c]
mov edi, ecx
mov esi, dword [esp + 0x28]
mov ebp, esi
shl ebp, 0xa
add ebp, eax
shl edi, 0xa
add edi, eax
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x28]
mov dword [esp + 0x50], ecx
mov dword [0x40a104], eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffffe
cmp eax, 0x41
ja case.0x401544.65
jmp dword [eax*4 + 0x402be2]
mov eax, esi
jmp 0x402bd5
push ebx
push esi
call fcn.004057b1
mov eax, 0x7fffffff
jmp 0x402bd5
inc dword [0x42e8cc]
test edx, edx
je 0x401559
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x401559
push esi
call fcn.00402dd8
dec eax
push ebx
push eax
call fcn.00401399
jmp 0x402bd5
push ebx
push esi
call fcn.004057b1
jmp case.0x401544.65
push ebx
call fcn.00402d22
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovg ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x401544.65
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x401544.65
cmp dword [esp + 0x30], ebx
jne 0x4015ea
mov eax, dword [esi*4 + 0x42f1a0]
push 1
mov dword [esi*4 + 0x42f160], eax
call fcn.00402d22
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x28]
mov dword [eax*4 + 0x42f1a0], ecx
jmp case.0x401544.65
mov eax, dword [esi*4 + 0x42f160]
mov dword [esi*4 + 0x42f1a0], eax
jmp case.0x401544.65
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push 4
mov edx, dword [ecx*4 + 0x42f1a0]
and eax, edx
mov dword [ecx*4 + 0x42f1a0], eax
xor eax, eax
test edx, edx
pop ecx
cmove eax, ecx
mov eax, dword [esp + eax + 0x28]
jmp 0x402bd5
push dword [ecx*4 + 0x42f1a0]
push ebp
call fcn.00405fc6
jmp case.0x401544.65
mov eax, dword [0x42e8c4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x401651
push ecx
push eax
call edi
mov esi, dword [esp + 0x28]
mov eax, dword [0x42e8c8]
test eax, eax
je case.0x401544.65
push esi
push eax
call edi
jmp case.0x401544.65
push 0xfffffffffffffff0
call fcn.00402d5e
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne case.0x401544.65
xor eax, eax
inc eax
jmp 0x402bcd
push 0xfffffffffffffff0
call fcn.00402d5e
mov edi, eax
push edi
call fcn.00406574
mov esi, eax
test esi, esi
je 0x4016f6
push 0x5c
push esi
call fcn.00405fa2
mov esi, eax
mov al, byte [esi]
mov byte [esp + 0x14], al
mov byte [esi], bl
test al, al
jne 0x4016cb
cmp dword [esp + 0x30], ebx
je 0x4016cb
call fcn.00405eaa
test eax, eax
je 0x4016cb
push edi
call fcn.004058b6
jmp 0x4016d1
push edi
call fcn.00405896
test eax, eax
je 0x4016eb
cmp eax, 0xb7
jne 0x4016e7
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x4016eb
inc dword [esp + 0x10]
mov al, byte [esp + 0x14]
mov byte [esi], al
inc esi
test al, al
jne 0x40169e
push 0x40a508
cmp dword [esp + 0x30], ebx
je 0x40172c
push 0xffffffffffffffe6
call fcn.004057b1
push edi
push 0x435800
call fcn.004064c9
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x402bcd
inc eax
jmp 0x402bcd
push 0xfffffffffffffff5
jmp 0x40158b
push ebx
call fcn.00402d5e
push eax
call fcn.00405f7b
jmp 0x401e02
push 0xffffffffffffffd0
call fcn.00402d5e
push 0xffffffffffffffdf
mov esi, eax
call fcn.00402d5e
push 0x13
mov edi, eax
call fcn.00402d5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x401775
push 0x40a508
push 0xffffffffffffffe3
jmp 0x40158b
cmp dword [esp + 0x30], ebx
je 0x401681
push esi
call fcn.00405f7b
test eax, eax
je 0x401681
push edi
push esi
call fcn.00405cbe
push 0x40a508
push 0xffffffffffffffe4
jmp 0x40158b
push ebx
call fcn.00402d5e
mov esi, eax
mov ebp, 0x400
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x4017ca
xor eax, eax
mov byte [edi], bl
inc eax
mov dword [esp + 0x10], eax
jmp 0x4017f1
mov eax, dword [esp + 0x18]
cmp eax, esi
jbe 0x4017ed
cmp byte [eax], bl
je 0x4017ed
push esi
call fcn.00405f7b
test eax, eax
je 0x4017bf
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call fcn.004064c9
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x30], ebx
jne 0x402bcd
push ebp
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp case.0x401544.65
push 0xffffffffffffffff
call fcn.00402d5e
lea ecx, [esp + 0x50]
push ecx
push ebp
push 0x400
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne case.0x401544.65
xor eax, eax
inc eax
mov byte [ebp], bl
jmp 0x402bcd
push 0xffffffffffffffef
call fcn.00402d5e
push eax
push ebp
call fcn.00406410
jmp 0x401679
push 0x31
call fcn.00402d5e
mov ebp, dword [esp + 0x28]
mov esi, eax
push esi
mov dword [esp + 0x1c], esi
and ebp, 7
call fcn.00406747
mov edi, 0x40a108
push esi
test eax, eax
je 0x401876
push edi
call fcn.004064c9
jmp 0x40188d
push 0x435800
push edi
call fcn.004064c9
push eax
call fcn.00405f04
push eax
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00406696
xor esi, esi
inc esi
cmp ebp, 3
jl 0x4018c8
push edi
call fcn.00405f7b
mov ecx, ebx
test eax, eax
je 0x4018b8
lea ecx, [esp + 0x34]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
add ebp, 0xfffffffd
or ebp, 0x80000000
and ebp, ecx
neg ebp
sbb ebp, ebp
inc ebp
test ebp, ebp
jne 0x4018d2
push edi
call fcn.0040654c
xor eax, eax
cmp ebp, esi
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.004062d9
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x40197a
test ebp, ebp
jne 0x401961
push section..ndata
push 0x40a908
call fcn.004064c9
push edi
push section..ndata
call fcn.004064c9
push dword [esp + 0x3c]
push 0x40a508
call fcn.00405932
push 0x40a908
push section..ndata
call fcn.004064c9
mov eax, dword [esp + 0x28]
sar eax, 3
push eax
push 0x40a508
call fcn.00406457
sub eax, 4
je 0x401896
sub eax, 1
je 0x401956
push edi
push 0xfffffffffffffffa
jmp 0x401554
inc dword [0x42f1a8]
jmp 0x402bd3
mov esi, dword [esp + 0x18]
push esi
push 0xffffffffffffffe2
call fcn.004057b1
xor eax, eax
cmp ebp, 2
sete al
jmp 0x402bcd
mov esi, dword [esp + 0x18]
push esi
push 0xffffffffffffffea
call fcn.004057b1
mov ebp, dword [esp + 0x1c]
inc dword [0x42f1d4]
push ebx
push ebx
push ebp
push dword [esp + 0x3c]
call fcn.00402e23
dec dword [0x42f1d4]
cmp dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4019b4
cmp dword [esp + 0x38], 0xffffffff
je 0x4019d2
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 0x50]
push eax
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
jns case.0x401544.65
cmp eax, 0xfffffffe
jne 0x4019fb
push 0xffffffffffffffe9
push edi
call fcn.00405932
push esi
push edi
call sub.KERNEL32.dll_lstrcatA
jmp 0x401a03
push 0xffffffffffffffee
push edi
call fcn.00405932
push 0x200010
push edi
call fcn.00406457
jmp 0x401559
push ebx
call fcn.00402d5e
push dword [esp + 0x2c]
push eax
call fcn.004060bb
jmp case.0x401544.65
push 0x31
call fcn.00402d5e
push dword [esp + 0x28]
push eax
call fcn.00406457
test eax, eax
je 0x401681
cmp eax, dword [esp + 0x30]
je 0x401b96
cmp eax, dword [esp + 0x38]
jne case.0x401544.65
mov eax, dword [esp + 0x3c]
jmp 0x402bd5
push 0xfffffffffffffff0
jmp 0x401a14
push 1
call fcn.00402d5e
push eax
call sub.KERNEL32.dll_lstrlenA
push eax
jmp 0x40162f
push 2
call fcn.00402d22
push 3
mov edi, eax
mov esi, edx
call fcn.00402d22
pop ecx
pop ecx
push 1
mov dword [esp + 0x20], eax
call fcn.00402d5e
push eax
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_lstrlenA
test esi, esi
mov byte [ebp], bl
cmove edi, eax
test edi, edi
je case.0x401544.65
mov edx, dword [esp + 0x1c]
test edx, edx
lea ecx, [edx + eax]
cmovns ecx, edx
test ecx, ecx
js case.0x401544.65
cmp ecx, eax
cmovg ecx, eax
mov eax, dword [esp + 0x18]
add eax, ecx
push eax
push ebp
call fcn.004064c9
test edi, edi
jns 0x401ae0
push ebp
call sub.KERNEL32.dll_lstrlenA
add edi, eax
xor eax, eax
test edi, edi
cmovns eax, edi
cmp eax, 0x400
jge case.0x401544.65
mov byte [eax + ebp], bl
jmp case.0x401544.65
push 0x20
call fcn.00402d5e
push 0x31
mov esi, eax
call fcn.00402d5e
push eax
push esi
cmp dword [esp + 0x40], ebx
jne 0x401b1a
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x401b20
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401b96
mov eax, dword [esp + 0x30]
jmp 0x402bd5
xor esi, esi
inc esi
push esi
call fcn.00402d5e
push 0x400
mov edi, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x401b5b
cmp dword [esp + 0x30], ebx
je 0x401b62
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401b62
mov eax, esi
mov byte [ebp], bl
jmp 0x401b66
mov eax, dword [esp + 0x10]
mov byte [ebp + 0x3ff], bl
jmp 0x402bcd
mov esi, dword [esp + 0x3c]
push ebx
call fcn.00402d22
push 1
mov edi, eax
call fcn.00402d22
pop ecx
pop ecx
test esi, esi
jne 0x401b92
cmp edi, eax
jl 0x401b96
jle 0x401b24
jmp 0x401ba1
cmp edi, eax
jae 0x401b9f
mov eax, dword [esp + 0x34]
jmp 0x402bd5
jbe 0x401b24
mov eax, dword [esp + 0x38]
jmp 0x402bd5
xor edi, edi
inc edi
push edi
call fcn.00402d22
push 2
mov esi, eax
call fcn.00402d22
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x34]
cmp eax, 0xd
ja case.default.0x401bc9
jmp dword [eax*4 + 0x402cea]
add esi, ecx
jmp case.default.0x401bc9
sub esi, ecx
jmp case.default.0x401bc9
imul esi, ecx
jmp case.default.0x401bc9
test ecx, ecx
je 0x401bea
mov eax, esi
cdq
idiv ecx
mov esi, eax
jmp 0x401bec
mov esi, ebx
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
jmp case.default.0x401bc9
or esi, ecx
jmp case.default.0x401bc9
and esi, ecx
jmp case.default.0x401bc9
xor esi, ecx
jmp case.default.0x401bc9
xor eax, eax
test esi, esi
sete al
mov esi, eax
jmp case.default.0x401bc9
test esi, esi
jne 0x401c18
test ecx, ecx
je 0x401c20
mov esi, edi
jmp case.default.0x401bc9
test esi, esi
jne 0x401c14
mov esi, ebx
jmp case.default.0x401bc9
test ecx, ecx
je 0x401bea
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x401bec
shl esi, cl
jmp case.default.0x401bc9
sar esi, cl
jmp case.default.0x401bc9
shr esi, cl
push esi
jmp 0x40162f
push 1
call fcn.00402d5e
push 2
mov esi, eax
call fcn.00402d22
push eax
push esi
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.0x401544.65
mov eax, dword [esp + 0x30]
mov esi, dword [0x40a100]
test eax, eax
je 0x401cc4
dec eax
test esi, esi
je 0x401cb1
mov esi, dword [esi]
test eax, eax
jne 0x401c70
test esi, esi
je 0x401cb1
add esi, 4
mov edi, 0x40a108
push esi
push edi
call fcn.004064c9
mov eax, dword [0x40a100]
add eax, 4
push eax
push esi
call fcn.004064c9
mov eax, dword [0x40a100]
push edi
add eax, 4
push eax
call fcn.004064c9
jmp case.0x401544.65
push 0x200010
push 0xffffffffffffffe8
push ebx
call fcn.00405932
push eax
jmp 0x401a09
test ecx, ecx
je 0x401ced
test esi, esi
je 0x401681
lea eax, [esi + 4]
push eax
push ebp
call fcn.004064c9
mov eax, dword [esi]
mov dword [0x40a100], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x401544.65
push 0x404
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [esp + 0x28]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.00405932
mov eax, dword [0x40a100]
mov dword [esi], eax
mov dword [0x40a100], esi
jmp case.0x401544.65
push 3
call fcn.00402d22
mov esi, eax
push 4
mov dword [esp + 0x20], esi
call fcn.00402d22
mov edi, eax
mov eax, dword [esp + 0x44]
pop ecx
pop ecx
test al, 1
je 0x401d4c
push 0x33
call fcn.00402d5e
mov esi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], esi
test al, 2
je 0x401d59
push 0x44
call fcn.00402d5e
mov edi, eax
cmp dword [esp + 0x24], 0x21
push 1
jne 0x401db1
call fcn.00402d22
push 2
mov dword [esp + 0x20], eax
call fcn.00402d22
pop ecx
pop ecx
mov ecx, dword [esp + 0x3c]
sar ecx, 2
test ecx, ecx
je 0x401da2
lea edx, [esp + 0x14]
push edx
push ecx
push ebx
push edi
push esi
push eax
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov ecx, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
jmp 0x401de4
push edi
push esi
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x401dda
call fcn.00402d5e
push 0x12
mov esi, eax
call fcn.00402d5e
xor ecx, ecx
cmp byte [eax], cl
cmovne ecx, eax
push ecx
xor ecx, ecx
cmp byte [esi], cl
cmovne ecx, esi
push ecx
push edi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x28], ebx
jl 0x402bcd
push ecx
jmp 0x40162f
push ebx
call fcn.00402d22
pop ecx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401b24
mov eax, dword [esp + 0x2c]
jmp 0x402bd5
push 2
call fcn.00402d22
push 1
mov esi, eax
call fcn.00402d22
pop ecx
pop ecx
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401a6f
mov esi, dword [0x42f128]
push ebx
add esi, ecx
call fcn.00402d22
pop ecx
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x401544.65
xor ebp, ebp
inc ebp
test dword [esp + 0x30], 0x100
je 0x401e66
push ebp
call fcn.00402d22
pop ecx
jmp 0x401e6e
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 4
mov edi, eax
mov dword [esp + 0x14], ecx
mov esi, eax
shr edi, 0x1e
mov ecx, eax
shr ecx, 0x1f
and esi, 3
and edi, ebp
mov dword [esp + 0x1c], ecx
test eax, 0x10000
je 0x401ea5
push ebx
call fcn.00402d5e
mov ebp, eax
jmp 0x401eaa
movzx ebp, word [esp + 0x28]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
and eax, 0xfef0
push eax
mov eax, dword [esp + 0x60]
imul eax, edi
push eax
mov eax, dword [esp + 0x60]
imul eax, dword [esp + 0x24]
push eax
xor eax, eax
cmp dword [esp + 0x20], eax
push esi
cmovne eax, dword [0x42e8d4]
push ebp
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push esi
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je case.0x401544.65
test esi, esi
jne case.0x401544.65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x401544.65
push edx
call dword [sym.imp.USER32.dll_GetDC]
push 2
mov edi, eax
call fcn.00402d22
pop ecx
push 0x48
push 0x5a
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x40b508], eax
mov eax, dword [esp + 0x14]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
call fcn.00402d22
pop ecx
mov ecx, dword [esp + 0x38]
push dword [esp + 0x2c]
mov dword [0x40b518], eax
mov al, cl
and al, 1
mov byte [0x40b51f], 1
mov byte [0x40b51c], al
mov al, cl
and al, 2
and cl, 4
push 0x40b524
mov byte [0x40b51d], al
mov byte [0x40b51e], cl
call fcn.00405932
push 0x40b508
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x401a6f
push ebx
call fcn.00402d22
push 1
mov esi, eax
call fcn.00402d22
pop ecx
pop ecx
push eax
push esi
cmp dword [esp + 0x3c], ebx
jne 0x401fc4
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x401544.65
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x401544.65
push ebx
call fcn.00402d5e
push 0x31
mov ebx, eax
call fcn.00402d5e
push 0x22
mov esi, eax
call fcn.00402d5e
push 0x15
mov edi, eax
call fcn.00402d5e
push 0x40a508
push 0xffffffffffffffec
call fcn.004057b1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x6c], ecx
cmp byte [ebx], al
mov dword [esp + 0x60], esi
cmovne eax, ebx
mov dword [esp + 0x5c], eax
xor eax, eax
cmp byte [edi], al
mov dword [esp + 0x68], 0x435800
cmovne eax, edi
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
push eax
call fcn.004063ad
test eax, eax
je 0x401681
test byte [esp + 0x54], 0x40
je case.0x401544.65
push dword [esp + 0x88]
call fcn.00405ec2
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401544.65
push ebx
call fcn.00402d5e
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.004057b1
push esi
call fcn.00406078
mov esi, eax
test esi, esi
je 0x401681
cmp dword [esp + 0x30], ebx
je 0x4020be
push esi
call fcn.00405ec2
mov ecx, eax
cmp dword [esp + 0x2c], ebx
jl 0x4020ae
push ecx
push edi
call fcn.00405fc6
jmp 0x4020be
mov eax, dword [esp + 0x10]
xor edx, edx
inc edx
test ecx, ecx
cmovne eax, edx
mov dword [esp + 0x10], eax
push esi
jmp 0x402066
push 2
call fcn.00402d5e
push eax
call fcn.00405f7b
mov esi, eax
test esi, esi
je 0x4020e5
push dword [esi + 0x14]
push edi
call fcn.00405fc6
push dword [esi + 0x18]
jmp 0x40162f
mov byte [ebp], bl
mov byte [edi], bl
jmp 0x401681
push 0xffffffffffffffee
call fcn.00402d5e
lea ecx, [esp + 0x50]
mov dword [esp + 0x44], eax
push ecx
push eax
push 9
call fcn.004062a4
call eax
mov ecx, eax
mov byte [ebp], bl
xor eax, eax
mov dword [esp + 0x1c], ecx
inc eax
mov byte [edi], bl
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x402bcd
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je case.0x401544.65
push 0xa
call fcn.004062a4
push 0xb
mov esi, eax
call fcn.004062a4
push dword [esp + 0x14]
mov dword [esp + 0x4c], eax
push dword [esp + 0x20]
push ebx
push dword [esp + 0x50]
call esi
test eax, eax
je 0x402198
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x408298
push dword [esp + 0x20]
call dword [esp + 0x58]
test eax, eax
je 0x402198
mov eax, dword [esp + 0x18]
push dword [eax + 8]
push ebp
call fcn.00405fc6
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push edi
call fcn.00405fc6
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
jmp 0x401ce2
xor ebp, ebp
inc ebp
mov dword [esp + 0x10], ebp
cmp dword [0x42f140], ebx
jl 0x40228a
push 0xfffffffffffffff0
call fcn.00402d5e
mov esi, eax
push ebp
mov dword [esp + 0x4c], esi
call fcn.00402d5e
mov edi, eax
mov dword [esp + 0x44], edi
cmp dword [esp + 0x38], ebx
je 0x4021e4
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4021f8
mov esi, dword [esp + 0x48]
push 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x40227e
push edi
push esi
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
test edi, edi
je 0x40224b
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x30], ebx
je 0x40222b
push 0x40a508
push dword [esp + 0x34]
call fcn.004057b1
call edi
test eax, eax
je 0x402256
mov eax, ebp
mov dword [esp + 0x10], eax
jmp 0x40225a
mov eax, dword [esp + 0x14]
push section..data
push 0x40a100
push section..ndata
push 0x400
push eax
call edi
add esp, 0x14
jmp 0x402256
push dword [esp + 0x44]
push 0xfffffffffffffff7
call fcn.004057b1
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x34], ebx
jne 0x402bcd
push esi
call fcn.00403866
test eax, eax
je case.0x401544.65
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x401544.65
push 0x40a508
push 0xfffffffffffffff6
jmp 0x40158b
push 0x40a508
push 0xffffffffffffffe7
jmp 0x40158b
push 0xfffffffffffffff0
call fcn.00402d5e
push 0xffffffffffffffdf
mov dword [esp + 0x54], eax
call fcn.00402d5e
push 2
mov esi, eax
call fcn.00402d5e
push 0xffffffffffffffcd
mov dword [esp + 0x50], eax
call fcn.00402d5e
push 0x45
mov dword [esp + 0x20], eax
call fcn.00402d5e
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x38]
mov ecx, eax
and ecx, 0xfff
mov edi, eax
mov dword [esp + 0x8c], ecx
mov ecx, eax
and ecx, 0x8000
sar eax, 0x10
sar edi, 0xc
push esi
mov dword [esp + 0x4c], ecx
and edi, 7
mov dword [esp + 0x48], eax
call fcn.00406747
test eax, eax
jne 0x40230a
push 0x21
call fcn.00402d5e
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 0x40881c
inc ebp
push ebp
push ebx
push 0x40883c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402414
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x40882c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402406
mov eax, dword [esp + 0x14]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x48], ebx
jne 0x402373
mov eax, dword [esp + 0x14]
push 0x435800
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test edi, edi
je 0x402382
mov eax, dword [esp + 0x14]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x14]
push dword [esp + 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [esp + 0x1c]
cmp byte [edx], bl
je 0x4023aa
mov eax, dword [esp + 0x14]
push dword [esp + 0x8c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x14]
push dword [esp + 0x4c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x14]
push dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [esp + 0x10], ebx
jl 0x4023fc
push 0x400
push esi
push 0xffffffffffffffff
push dword [esp + 0x5c]
mov dword [esp + 0x20], 0x80004005
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4023fc
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
sar eax, 0x1f
and eax, 0xfffffffc
push 0x40a508
sub eax, 0xc
push eax
call fcn.004057b1
mov eax, dword [esp + 0x10]
shr eax, 0x1f
jmp 0x402bcd
push ebx
call fcn.00402d5e
push 0x11
mov esi, eax
call fcn.00402d5e
push 0x23
mov edi, eax
call fcn.00402d5e
push esi
mov ebp, eax
call fcn.00405f7b
test eax, eax
jne 0x402465
push ebx
push 0xfffffffffffffff9
call fcn.004057b1
jmp 0x401681
mov eax, dword [esp + 0x14]
push esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 2
call sub.KERNEL32.dll_lstrlenA
push edi
mov byte [eax + esi + 1], bl
call sub.KERNEL32.dll_lstrlenA
push ebp
push ebx
mov byte [eax + edi + 1], bl
mov ax, word [esp + 0x38]
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], edi
mov dword [esp + 0x72], ebp
mov word [esp + 0x68], ax
call fcn.004057b1
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.0x401544.65
jmp 0x402458
cmp esi, 0xbadf00d
jne 0x401cb1
inc dword [0x42f1b4]
jmp case.0x401544.65
mov edi, ebx
mov ebp, ebx
test esi, esi
je 0x4024e6
push ebx
call fcn.00402d5e
mov ecx, dword [esp + 0x2c]
mov ebx, eax
test ecx, ecx
je 0x4024f3
push 0x11
call fcn.00402d5e
mov edi, eax
cmp dword [esp + 0x38], ebp
je 0x402502
push 0x22
call fcn.00402d5e
mov ebp, eax
push 0xffffffffffffffcd
call fcn.00402d5e
push eax
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x401679
push 0xa
pop eax
push 1
mov word [esp + 0x18], ax
call fcn.00402d5e
push 0x12
mov edi, eax
call fcn.00402d5e
push 0xffffffffffffffdd
mov esi, eax
call fcn.00402d5e
push eax
push 0x3ff
push ebp
lea eax, [esp + 0x20]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp], 0xa
jne case.0x401544.65
xor esi, esi
lea eax, [esi + 1]
jmp 0x40182f
xor esi, esi
inc esi
cmp dword [esp + 0x38], ebx
jne 0x402591
push 2
call fcn.00402d9c
mov edi, eax
test edi, edi
je 0x4025df
push 0x33
call fcn.00402d5e
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4025df
push 0x22
call fcn.00402d5e
mov ecx, dword [esp + 0x38]
mov esi, eax
sar ecx, 1
cmp byte [esi], bl
jne 0x4025ab
mov esi, 0x3eb
jmp 0x4025df
lea eax, [esp + 0x18]
or ecx, 0x100020
push eax
push dword [esp + 0x54]
mov dword [esp + 0x20], ecx
call fcn.00402d43
push eax
call fcn.00405ba1
test eax, eax
je 0x4025dc
push dword [esp + 0x18]
push esi
push eax
call fcn.0040141e
mov esi, eax
jmp 0x4025df
push 6
pop esi
xor eax, eax
test esi, esi
setne al
jmp 0x402bcd
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
push 2
mov dword [esp + 0x44], eax
call fcn.00402d5e
push 0x11
mov dword [esp + 0x50], eax
call fcn.00402d5e
lea ecx, [esp + 0x50]
xor ebp, ebp
push ecx
push 0x100022
push eax
inc ebp
push esi
mov dword [esp + 0x20], ebp
call fcn.00402d43
push eax
call fcn.00405cf0
mov edi, dword [esp + 0x50]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
test edi, edi
je case.0x401544.65
mov eax, ebx
mov esi, 0x40a908
cmp dword [esp + 0x18], ebp
jne 0x402659
push 0x23
call fcn.00402d5e
push esi
call sub.KERNEL32.dll_lstrlenA
inc eax
mov ebp, dword [esp + 0x18]
cmp ebp, 4
jne 0x402671
push 3
call fcn.00402d22
pop ecx
push ebp
mov dword [0x40a908], eax
pop eax
cmp ebp, 3
jne 0x402686
push 0xc00
push esi
push ebx
push dword [esp + 0x40]
call fcn.00402e23
push eax
push esi
push dword [esp + 0x48]
push ebx
push dword [esp + 0x5c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
push edi
sbb eax, eax
and dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401544.65
push 0x20019
call fcn.00402d9c
push 0x33
mov esi, eax
call fcn.00402d5e
mov byte [ebp], bl
test esi, esi
je 0x401681
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0x400
push ecx
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x402729
cmp dword [esp + 0x14], 4
je 0x402711
cmp dword [esp + 0x14], ecx
je 0x402701
cmp dword [esp + 0x14], 2
jne 0x402729
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov byte [ebp + 0x3ff], bl
jmp 0x402730
push dword [ebp]
xor eax, eax
cmp dword [esp + 0x3c], eax
push ebp
sete al
mov dword [esp + 0x18], eax
call fcn.00405fc6
jmp 0x402730
mov byte [ebp], bl
mov dword [esp + 0x10], ecx
push esi
jmp 0x4026a1
push 0x20019
call fcn.00402d9c
push 3
mov esi, eax
call fcn.00402d22
mov byte [ebp], bl
pop ecx
test esi, esi
je 0x401681
mov ecx, 0x3ff
mov dword [esp + 0x50], ecx
cmp dword [esp + 0x38], ebx
je 0x402770
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x402709
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x60]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
test eax, eax
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x402709
push ebp
call fcn.004065c9
test eax, eax
je case.0x401544.65
push eax
jmp 0x402066
push 0xffffffffffffffed
call fcn.00402d5e
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
call fcn.004062d9
cmp eax, 0xffffffff
jne 0x401a6f
mov byte [ebp], bl
jmp 0x401681
xor ebx, ebx
inc ebx
cmp dword [esp + 0x30], 0
je 0x4027eb
push ebx
call fcn.00402d22
pop ecx
mov byte [0x40a508], al
mov esi, ebx
jmp 0x4027fa
push 0x11
call fcn.00402d5e
push eax
call sub.KERNEL32.dll_lstrlenA
mov esi, eax
cmp byte [ebp], 0
je 0x40281a
push ebp
call fcn.004065c9
push esi
push 0x40a508
push eax
call fcn.004063c5
test eax, eax
jne case.0x401544.65
mov eax, ebx
jmp 0x402bcd
push 2
mov dword [esp + 0x1c], ebx
call fcn.00402d22
xor esi, esi
inc esi
pop ecx
cmp eax, esi
jl case.0x401544.65
mov ecx, 0x3ff
cmp eax, ecx
cmovg eax, ecx
mov dword [esp + 0x10], eax
cmp byte [ebp], bl
je 0x4028a1
push ebp
mov byte [esp + 0x18], bl
call fcn.004065c9
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], ebx
jbe 0x4028a1
mov ebp, ebx
push esi
lea ecx, [esp + 0x27]
push ecx
push eax
call fcn.00406306
test eax, eax
je 0x4028a1
cmp dword [esp + 0x34], ebx
jne 0x4028dd
mov al, byte [esp + 0x14]
cmp al, 0xd
je 0x4028b1
cmp al, 0xa
je 0x4028b1
mov al, byte [esp + 0x23]
mov byte [edi + ebp], al
inc ebp
mov byte [esp + 0x14], al
mov dword [esp + 0x18], ebp
test al, al
je 0x4028a1
mov eax, dword [esp + 0x1c]
cmp ebp, dword [esp + 0x10]
jl 0x402861
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
mov byte [ecx + edi], bl
jmp 0x401972
mov cl, byte [esp + 0x23]
cmp al, cl
je 0x4028cd
cmp cl, 0xd
je 0x4028c3
cmp cl, 0xa
jne 0x4028cd
mov byte [edi + ebp], cl
inc ebp
mov dword [esp + 0x18], ebp
jmp 0x4028a1
push esi
push ebx
push 0xffffffffffffffff
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4028a1
movzx eax, byte [esp + 0x23]
push eax
push edi
call fcn.00405fc6
jmp 0x402bd3
cmp byte [ebp], bl
je case.0x401544.65
push 2
call fcn.00402d22
pop ecx
push dword [esp + 0x34]
push ebx
push eax
push ebp
call fcn.004065c9
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x2c], ebx
jl case.0x401544.65
push eax
push edi
jmp 0x401630
push ebp
call fcn.004065c9
test eax, eax
je case.0x401544.65
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x401544.65
push edi
call fcn.004065c9
test eax, eax
je 0x40182c
lea ecx, [esp + 0x90]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40182c
lea eax, [esp + 0xbc]
push eax
push ebp
jmp 0x401ca7
push 2
call fcn.00402d5e
lea ecx, [esp + 0x90]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x402992
mov byte [edi], bl
jmp 0x4027c9
push eax
push edi
call fcn.00405fc6
jmp 0x402962
push 0xfffffffffffffff0
mov edi, 0xfffffd66
call fcn.00402d5e
mov ebp, eax
push ebp
mov dword [esp + 0x54], ebp
call fcn.00406747
test eax, eax
jne 0x4029be
push 0xffffffffffffffed
call fcn.00402d5e
push ebp
call fcn.0040654c
push 2
push 0x40000000
push ebp
call fcn.004062d9
mov esi, eax
mov dword [esp + 0x40], esi
cmp esi, 0xffffffff
je 0x402a97
mov eax, dword [0x42f0ec]
push eax
push 0x40
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x402a8b
push ebx
call fcn.00402e0c
push dword [esp + 0x1c]
push edi
call fcn.00402df6
push dword [esp + 0x30]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x4c], edi
test edi, edi
je 0x402a67
push dword [esp + 0x30]
push edi
push ebx
push dword [esp + 0x38]
call fcn.00402e23
cmp byte [edi], bl
je 0x402a5d
mov ebp, dword [esp + 0x18]
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebp
push eax
call fcn.00406056
add edi, esi
cmp byte [edi], bl
jne 0x402a3d
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x40]
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
push edi
push esi
call fcn.004063c5
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push ebx
push esi
push 0xffffffffffffffff
call fcn.00402e23
mov edi, eax
jmp 0x402a90
mov edi, 0xfffffd66
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff3
pop esi
test edi, edi
jns 0x402ab0
push 0xffffffffffffffef
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x10], 1
push 0x40a508
jmp 0x40158a
push ebx
call fcn.00402d22
mov ebx, eax
pop ecx
cmp ebx, dword [0x42f10c]
jae 0x401681
mov ecx, dword [esp + 0x30]
imul esi, ebx, 0x418
add esi, dword [0x42f108]
test ecx, ecx
js 0x402af6
mov eax, dword [esi + ecx*4]
jne 0x40291c
lea eax, [esi + 0x18]
push eax
push edi
jmp 0x401ca7
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x30], eax
je 0x402b11
push 1
call fcn.00402d22
pop ecx
mov ecx, eax
mov dword [esp + 0x2c], ecx
jmp 0x402b29
push dword [esp + 0x38]
lea eax, [esi + 0x18]
push eax
call fcn.00405932
or dword [esi + 8], 0x100
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi + eax*4], ecx
cmp dword [esp + 0x34], 0
je case.0x401544.65
push ebx
call fcn.00401221
jmp case.0x401544.65
push ebx
call fcn.00402d22
mov edx, eax
pop ecx
cmp edx, 0x20
jae 0x401681
cmp dword [esp + 0x34], ebx
je 0x402b7e
cmp dword [esp + 0x30], ebx
je 0x402b73
push edx
call fcn.00401290
push ebx
push ebx
call fcn.004012dd
jmp case.0x401544.65
push ebx
call fcn.004011a0
jmp 0x40291c
mov eax, dword [0x42f0f4]
cmp dword [esp + 0x30], ebx
je 0x402b96
mov ecx, dword [esp + 0x2c]
mov dword [eax + edx*4 + 0x94], ecx
jmp case.0x401544.65
push dword [eax + edx*4 + 0x94]
push edi
call fcn.00405932
jmp case.0x401544.65
and esi, dword [0x429520]
push ebx
push esi
push 0xb
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x28], ebx
je case.0x401544.65
mov eax, dword [esp + 0x14]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0x10]
add dword [0x42f1a8], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0
ret 4