Function at 0x401000
Capabilities:
Allocate thread local storage
Delete directory
Identify system language via api

Disassembly:
push 0xc8
push 0
push 0x40c318
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40c31c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40c318], eax
call section..text
call fcn.004084c0
call fcn.004083a8
call fcn.00406d20
call fcn.0040627c
call fcn.00406188
call fcn.00406174
call fcn.004060ef
call fcn.004060d8
call fcn.00404c31
call fcn.0040422b
call fcn.00403ffc
call fcn.00403e10
call fcn.00403954
call fcn.0040367d
push dword [0x40c3d8]
call fcn.0040401b
push 7
push 0x40b384
lea eax, [0x40c3d8]
push eax
push 8
call fcn.00403f70
push 0x40c3d0
push 0x40b37c
push 7
push 0x401
push 8
call fcn.00408317
push 0x400
call fcn.00403e40
mov dword [0x40c350], eax
push 8
push dword [0x40c350]
call sub.KERNEL32.dll_GetUserDefaultLangID
push eax
call sub.KERNEL32.dll_VerLanguageNameA
mov eax, dword [0x40c650]
push eax
push eax
mov eax, dword [0x40c650]
push eax
push eax
mov eax, dword [0x40c650]
push eax
push eax
push 8
push dword [0x40c350]
call fcn.00403e60
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.004030c0
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.004031f0
push 0x40c354
call fcn.00408510
push dword [0x40c350]
call fcn.00403eb0
push dword [0x40c354]
mov edx, str.deutsch
pop ecx
call fcn.00408590
je 0x401235
mov edx, str.Fortfahren_
lea ecx, [0x40c358]
call fcn.00403068
mov edx, str.Fehler_
lea ecx, [0x40c35c]
call fcn.00403068
mov edx, str.Einige_Include_Dateien_konnten_nicht_erstellt_werden.
lea ecx, [0x40c360]
call fcn.00403068
mov edx, str.Nicht_gen
lea ecx, [0x40c364]
call fcn.00403068
mov edx, str.Falsches_Passwort.
lea ecx, [0x40c368]
call fcn.00403068
mov edx, 0x40b10f
lea ecx, [0x40c36c]
call fcn.00403068
mov edx, str.Die_Datei
lea ecx, [0x40c370]
call fcn.00403068
mov edx, str._existiert_bereits_im_aktuellen_Arbeitsverzeichnis.
lea ecx, [0x40c374]
call fcn.00403068
mov edx, str.Ein_unbekannter_Fehler_ist_aufgetreten._Das_Programm_wird_beendet.
lea ecx, [0x40c378]
call fcn.00403068
mov edx, str.Das_Programm_wird_von_diesem_Betriebssytem_nicht_unterst
lea ecx, [0x40c37c]
call fcn.00403068
mov edx, str.Bitte_w
lea ecx, [0x40c380]
call fcn.00403068
mov edx, str.Passwort
lea ecx, [0x40c384]
call fcn.00403068
mov edx, str.Bitte_geben_Sie_das_Passwort_ein.
lea ecx, [0x40c388]
call fcn.00403068
jmp 0x401305
mov edx, str.Continue_
lea ecx, [0x40c358]
call fcn.00403068
mov edx, 0x40b0cb
lea ecx, [0x40c35c]
call fcn.00403068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40c360]
call fcn.00403068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40c364]
call fcn.00403068
mov edx, str.Wrong_password.
lea ecx, [0x40c368]
call fcn.00403068
mov edx, 0x40b014
lea ecx, [0x40c36c]
call fcn.00403068
mov edx, str.The_file
lea ecx, [0x40c370]
call fcn.00403068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40c374]
call fcn.00403068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40c378]
call fcn.00403068
mov edx, str.This_program_is_not_supported_on_this_operating_system.
lea ecx, [0x40c37c]
call fcn.00403068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40c380]
call fcn.00403068
mov edx, str.Password
lea ecx, [0x40c384]
call fcn.00403068
mov edx, 0x40b01f
lea ecx, [0x40c388]
call fcn.00403068
call fcn.00403d07
mov ebx, eax
cmp ebx, 0x32
jge 0x40132c
push 0x10
push dword [0x40c37c]
push dword [0x40c35c]
call fcn.0040368b
jmp 0x401b97
lea eax, [0x402067]
push eax
call fcn.00403ba0
call fcn.00403a92
mov dword [0x40c390], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40c394], eax
mov ebx, dword [0x40c390]
and ebx, ebx
jle 0x4013d3
mov dword [0x40c398], 0
mov ebx, dword [0x40c390]
dec ebx
cmp ebx, dword [0x40c398]
jl 0x4013d3
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c398]
call fcn.00403a44
push 0x40c39c
call fcn.00408510
push dword [0x40c39c]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x40c3a0]
push dword [0x40c650]
call fcn.004085c0
mov edx, dword [0x40c39c]
call fcn.004085c0
mov edx, 0x40b00e
call fcn.004085c0
push 0x40c3a0
call fcn.00408510
inc dword [0x40c398]
jno 0x401365
push 0x40b0c5
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x4013fe
mov eax, dword [0x40c350]
mov dword [0x40c3a4], eax
push dword [0x40c3a4]
call fcn.00401bda
jmp 0x40141e
push 0x10
push dword [0x40c378]
push dword [0x40c35c]
call fcn.0040368b
push 1
jmp 0x401b9c
push 0x40b0c3
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x401456
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c38c]
push dword [0x40c350]
call fcn.00403e60
push 0x40c3a8
call fcn.00408510
jmp 0x401476
push 0x10
push dword [0x40c378]
push dword [0x40c35c]
call fcn.0040368b
push 1
jmp 0x401b9c
push 0x40b0bb
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x4014aa
mov eax, dword [0x40c350]
mov dword [0x40c3ac], eax
mov eax, dword [0x40c38c]
mov dword [0x40c330], eax
mov eax, dword [0x40c3ac]
mov dword [0x40c324], eax
jmp 0x4014ca
push 0x10
push dword [0x40c378]
push dword [0x40c35c]
call fcn.0040368b
push 1
jmp 0x401b9c
push 0x40b0c1
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x4014fc
mov eax, dword [0x40c350]
mov dword [0x40c3b0], eax
mov eax, dword [0x40c38c]
mov dword [0x40c334], eax
mov eax, dword [0x40c3b0]
mov dword [0x40c328], eax
push 0x40b0bf
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x40152e
mov eax, dword [0x40c350]
mov dword [0x40c3b4], eax
mov eax, dword [0x40c38c]
mov dword [0x40c338], eax
mov eax, dword [0x40c3b4]
mov dword [0x40c32c], eax
push 0x40b0c7
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x401793
push 0xc80001
push dword [0x40c384]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00404f81
push dword [0x40c388]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00404408
push 0x20
push 0x40b00d
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.004044e2
push 0x40b28d
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.004046e7
push 4
push 0xd
push 0
call fcn.00404fa4
push 2
call fcn.00404707
call fcn.00405206
push eax
mov ebx, 0x10
cmp ebx, dword [esp]
jne 0x401626
push dword [0x40c34c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401b9c
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x40166d
call fcn.0040520e
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40166a
mov eax, dword [0x40c650]
push eax
push eax
push 2
call fcn.00404742
push 0x40c3b8
call fcn.00408510
push 0
call fcn.00404aa3
add esp, 8
jmp 0x4016b8
pop eax
jmp 0x4016b2
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4016b2
call fcn.0040521d
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4016b1
mov eax, dword [0x40c650]
push eax
push eax
push 2
call fcn.00404742
push 0x40c3b8
call fcn.00408510
push 0
call fcn.00404aa3
add esp, 8
jmp 0x4016b8
pop eax
pop eax
jmp 0x4015fc
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c3b8]
call fcn.00403210
push eax
mov eax, dword [0x40c3b8]
push eax
call fcn.00407710
inc dword [0x40c650]
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c38c]
push dword [0x40c350]
call fcn.00403e60
pop edx
pop ecx
mov dword [0x40c650], ecx
add ecx, dword [0x40b38c]
add edx, dword [0x40b38c]
call fcn.00408590
jne 0x40173a
push 0x10
push dword [0x40c368]
push dword [0x40c35c]
call fcn.0040368b
push dword [0x40c34c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401b9c
push 0x40b0c9
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x401758
mov eax, dword [0x40c350]
mov dword [0x40c3bc], eax
push dword [0x40c338]
push dword [0x40c334]
push dword [0x40c330]
push dword [0x40c3bc]
push dword [0x40c3b4]
push dword [0x40c3b0]
push dword [0x40c3ac]
push dword [0x40c3b8]
push dword [0x40c394]
call fcn.00401d35
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c330]
push dword [0x40c324]
call fcn.00403e60
push 0x40c3c0
call fcn.00408510
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c334]
push dword [0x40c328]
call fcn.00403e60
push 0x40c3c4
call fcn.00408510
push 0x40b0bd
push dword [0x40c394]
call fcn.0040208a
and eax, eax
je 0x401a3c
mov eax, dword [0x40c650]
push eax
push eax
push 0
call fcn.00403a44
inc dword [0x40c650]
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c38c]
push dword [0x40c350]
call fcn.00403e60
pop edx
pop ecx
mov dword [0x40c650], ecx
add ecx, dword [0x40b38c]
add edx, dword [0x40b38c]
call fcn.00408590
je 0x40184b
mov ebx, dword [0x40c390]
cmp ebx, 1
jne 0x40184b
mov eax, 1
jmp 0x40184d
xor eax, eax
and eax, eax
je 0x401a3c
mov eax, dword [0x40c650]
push eax
push eax
mov eax, dword [0x40c650]
push eax
push eax
call fcn.00406ab6
inc dword [0x40c650]
push dword [0x40c380]
mov edx, dword [0x40b38c]
add dword [esp + 4], edx
call fcn.004036e1
push 0x40c3c8
call fcn.00408510
mov edx, dword [0x40c3c8]
xor ecx, ecx
call fcn.00408590
jne 0x4019ec
mov edx, dword [0x40c3c8]
push dword [0x40c650]
call fcn.004085c0
push 0x40c344
call fcn.00408510
mov edx, dword [0x40c3c4]
xor ecx, ecx
call fcn.00408590
jne 0x4018d5
push dword [0x40c3c4]
call fcn.004020f1
push dword [0x40c3a8]
push 1
call fcn.00406e80
and eax, eax
je 0x4019be
push 1
call fcn.00406cb0
push dword [0x40c650]
push 0x24
mov edx, dword [0x40c370]
push dword [0x40c650]
call fcn.004085c0
mov edx, 0x40b010
call fcn.004085c0
mov edx, dword [0x40c3a8]
call fcn.004085c0
mov edx, 0x40b010
call fcn.004085c0
mov edx, dword [0x40c374]
call fcn.004085c0
inc dword [0x40c650]
push dword [0x40c36c]
mov edx, dword [0x40b38c]
add dword [esp + 4], edx
call fcn.0040368b
pop dword [0x40c650]
mov dword [0x40c3cc], eax
mov ebx, dword [0x40c3cc]
cmp ebx, 7
jne 0x4019be
mov eax, dword [0x40c650]
push eax
push eax
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c650]
call fcn.00403aa5
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.00406af6
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.00406b71
pop dword [0x40c650]
push dword [0x40c34c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401b9c
push dword [0x40c3a8]
push 1
call fcn.00406e60
and eax, eax
je 0x4019ec
push dword [0x40c3c0]
push 1
call fcn.00406ea0
push 1
call fcn.00406cb0
mov eax, dword [0x40c650]
push eax
push eax
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c650]
call fcn.00403aa5
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.00406af6
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.00406b71
pop dword [0x40c650]
push dword [0x40c34c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401b9c
mov edx, dword [0x40c34c]
push dword [0x40c650]
call fcn.004085c0
mov edx, str.BDFINOPS
call fcn.004085c0
mov edx, dword [0x40c3a8]
call fcn.004085c0
push 0x40c3a8
call fcn.00408510
push dword [0x40c3a8]
push 1
call fcn.00406e60
and eax, eax
je 0x401a9c
push dword [0x40c3c0]
push 1
call fcn.00406ea0
push 1
call fcn.00406cb0
jmp 0x401ad7
push dword [0x40c3a8]
call fcn.00406b81
call fcn.00401ffe
push 0x10
push dword [0x40c378]
push dword [0x40c35c]
call fcn.0040368b
push dword [0x40c34c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401b9c
mov edx, dword [0x40c3c4]
xor ecx, ecx
call fcn.00408590
jne 0x401af1
push dword [0x40c3c4]
call fcn.004020f1
push dword [0x40c650]
mov edx, dword [0x40c3a0]
push dword [0x40c650]
call fcn.004085c0
mov edx, dword [0x40c348]
call fcn.004085c0
inc dword [0x40c650]
push dword [0x40c344]
push dword [0x40c3a8]
mov edx, dword [0x40b38c]
add dword [esp + 8], edx
call fcn.00402727
pop dword [0x40c650]
call fcn.00401ffe
push dword [0x40c3a8]
call fcn.00406b81
mov eax, dword [0x40c650]
push eax
push eax
mov eax, dword [0x40c650]
push eax
push eax
push dword [0x40c650]
call fcn.00403aa5
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.00406af6
mov edx, dword [0x40b38c]
add dword [esp], edx
call fcn.00406b71
pop dword [0x40c650]
push dword [0x40c34c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401b9c
push 0
call 0x401bb1
push dword [0x40c318]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00403b37
call fcn.00403cf0
call fcn.00403e30
call fcn.0040429b
call fcn.00404b91
call fcn.00406146
call fcn.0040630a
call fcn.00406d10
ret