Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x104
push 0
push 0x411368
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x41136c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x411368], eax
call section..text
call fcn.0040df20
call fcn.0040dd0c
call fcn.0040c213
call fcn.0040bd43
call fcn.0040b6f0
call fcn.0040b379
call fcn.0040b1b0
call fcn.0040b192
call fcn.0040b109
call fcn.0040a871
call fcn.004098a0
call fcn.00408ab1
call fcn.00408776
call fcn.004082f1
call fcn.00407f69
push dword [0x411458]
call fcn.00408795
push 7
push 0x410280
lea eax, [0x411458]
push eax
push 8
call fcn.004086e4
push 0x411450
push 0x410290
push 7
push 0x401
push 8
call fcn.0040dc0d
mov eax, 0x200
push eax
lea eax, [0x411468]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040c232
push dword [0x411460]
call fcn.00408795
push 7
push 0x410288
lea eax, [0x411460]
push eax
push 8
call fcn.004086e4
mov edx, str.Continue_
lea ecx, [0x411380]
call fcn.00405068
mov edx, str.Error_
lea ecx, [0x41143c]
call fcn.00405068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x4113a8]
call fcn.00405068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x4113ec]
call fcn.00405068
mov edx, str.Wrong_password.
lea ecx, [0x411410]
call fcn.00405068
mov edx, 0x410025
lea ecx, [0x4113f0]
call fcn.00405068
mov edx, str.The_file
lea ecx, [0x411384]
call fcn.00405068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x411398]
call fcn.00405068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x4113e8]
call fcn.00405068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x411424]
call fcn.00405068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x41140c]
call fcn.00405068
mov edx, str.Password
lea ecx, [0x411428]
call fcn.00405068
mov edx, str.Please_enter_the_password.
lea ecx, [0x4113c0]
call fcn.00405068
call fcn.0040965f
mov ebx, eax
cmp ebx, 0x32
jge 0x40120f
push 0x10
push dword [0x411424]
push dword [0x41143c]
call fcn.00407fa0
jmp 0x401fd0
lea eax, [0x403274]
push eax
call fcn.00408500
call fcn.0040842f
mov dword [0x411418], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4113cc], eax
mov edx, dword [0x411738]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1e0
push 0x411414
call fcn.0040dfa0
push dword [0x411414]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x411418]
and ebx, ebx
jle 0x401378
mov dword [0x4113ac], 0
mov ebx, dword [0x411418]
dec ebx
cmp ebx, dword [0x4113ac]
jl 0x4012fb
mov edx, dword [0x411738]
push edx
push edx
push dword [0x4113ac]
call fcn.004083e1
push 0x411400
call fcn.0040dfa0
push dword [0x411400]
mov edx, str._b2epass
pop ecx
call fcn.0040e020
je 0x4012bf
mov dword [0x4113a4], 1
jmp 0x4012ef
mov ebx, dword [0x4113a4]
cmp ebx, 1
jne 0x4012ef
mov edx, dword [0x411400]
push dword [0x411738]
call fcn.0040e050
push 0x411430
call fcn.0040dfa0
mov dword [0x4113a4], 0
inc dword [0x4113ac]
jno 0x401274
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1e0
inc dword [0x411738]
mov edx, dword [0x410348]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x411738]
push eax
call fcn.0040b1e0
push 0x4113c4
call fcn.0040dfa0
mov edx, dword [0x411414]
push dword [0x411738]
call fcn.0040e050
mov edx, 0x41001f
call fcn.0040e050
mov edx, dword [0x4113c4]
call fcn.0040e050
push 0x4113c4
call fcn.0040dfa0
jmp 0x401393
mov edx, dword [0x411414]
push dword [0x411738]
call fcn.0040e050
push 0x4113c4
call fcn.0040dfa0
push 0x410087
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x4013be
mov eax, dword [0x411374]
mov dword [0x4113f8], eax
push dword [0x4113f8]
call fcn.004033a1
jmp 0x4013de
push 0x10
push dword [0x4113e8]
push dword [0x41143c]
call fcn.00407fa0
push 1
jmp 0x401fd5
push str.NOPSX
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x401417
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411388]
push dword [0x411374]
call fcn.0040b230
push 0x4113e4
call fcn.0040dfa0
jmp 0x401437
push 0x10
push dword [0x4113e8]
push dword [0x41143c]
call fcn.00407fa0
push 1
jmp 0x401fd5
push 0x41006e
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x40146b
mov eax, dword [0x411374]
mov dword [0x4113b0], eax
mov eax, dword [0x411388]
mov dword [0x411378], eax
mov eax, dword [0x4113b0]
mov dword [0x411420], eax
jmp 0x40148b
push 0x10
push dword [0x4113e8]
push dword [0x41143c]
call fcn.00407fa0
push 1
jmp 0x401fd5
push 0x410074
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x4014bd
mov eax, dword [0x411374]
mov dword [0x4113b8], eax
mov eax, dword [0x411388]
mov dword [0x4113bc], eax
mov eax, dword [0x4113b8]
mov dword [0x4113f4], eax
push 0x410072
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x4014ef
mov eax, dword [0x411374]
mov dword [0x4113b4], eax
mov eax, dword [0x411388]
mov dword [0x41137c], eax
mov eax, dword [0x4113b4]
mov dword [0x411440], eax
push 0x410089
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x401787
mov edx, dword [0x411430]
xor ecx, ecx
call fcn.0040e020
jne 0x401536
mov edx, dword [0x411430]
push dword [0x411738]
call fcn.0040e050
push 0x411408
call fcn.0040dfa0
jmp 0x4016aa
push 0xc80001
push dword [0x411428]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00409bb0
push dword [0x4113c0]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00408d93
push 0x20
push 0x41001e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00408f6c
push 0x410203
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00409279
push 4
push 0xd
push 0
call fcn.00409bd3
push 2
call fcn.00409299
call fcn.00409dd7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401616
push dword [0x411438]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x40165e
call fcn.0040be0c
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40165b
mov edx, dword [0x411738]
push edx
push edx
push 2
call fcn.004092d4
push 0x411408
call fcn.0040dfa0
push 0
call fcn.00409773
add esp, 8
jmp 0x4016aa
pop eax
jmp 0x4016a4
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4016a4
call fcn.0040be1b
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4016a3
mov edx, dword [0x411738]
push edx
push edx
push 2
call fcn.004092d4
push 0x411408
call fcn.0040dfa0
push 0
call fcn.00409773
add esp, 8
jmp 0x4016aa
pop eax
pop eax
jmp 0x4015ec
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411408]
call fcn.004050c0
push eax
mov eax, dword [0x411408]
push eax
call fcn.0040c7f0
inc dword [0x411738]
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411388]
push dword [0x411374]
call fcn.0040b230
pop edx
pop ecx
mov dword [0x411738], ecx
add ecx, dword [0x410348]
add edx, dword [0x410348]
call fcn.0040e020
jne 0x40172e
push 0x10
push dword [0x411410]
push dword [0x41143c]
call fcn.00407fa0
push dword [0x411438]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401fd5
push 0x41008b
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x40174c
mov eax, dword [0x411374]
mov dword [0x41141c], eax
push dword [0x41137c]
push dword [0x4113bc]
push dword [0x411378]
push dword [0x41141c]
push dword [0x4113b4]
push dword [0x4113b8]
push dword [0x4113b0]
push dword [0x411408]
push dword [0x4113cc]
call fcn.00403ccf
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411378]
push dword [0x411420]
call fcn.0040b230
push 0x4113e0
call fcn.0040dfa0
mov edx, dword [0x411738]
push edx
push edx
push dword [0x4113bc]
push dword [0x4113f4]
call fcn.0040b230
push 0x41139c
call fcn.0040dfa0
push 0x410070
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x401a45
mov edx, dword [0x411738]
push edx
push edx
push 0
call fcn.004083e1
inc dword [0x411738]
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411388]
push dword [0x411374]
call fcn.0040b230
pop edx
pop ecx
mov dword [0x411738], ecx
add ecx, dword [0x410348]
add edx, dword [0x410348]
call fcn.0040e020
je 0x401843
mov ebx, dword [0x411418]
cmp ebx, 1
jne 0x401843
mov eax, 1
jmp 0x401845
xor eax, eax
and eax, eax
je 0x401a45
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
call fcn.0040b385
inc dword [0x411738]
push dword [0x41140c]
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.00408013
push 0x411394
call fcn.0040dfa0
mov edx, dword [0x411394]
xor ecx, ecx
call fcn.0040e020
jne 0x4019f3
mov edx, dword [0x411394]
push dword [0x411738]
call fcn.0040e050
push 0x4113d8
call fcn.0040dfa0
push dword [0x4113d8]
call fcn.0040b3c5
mov edx, dword [0x41139c]
xor ecx, ecx
call fcn.0040e020
jne 0x4018da
push dword [0x41139c]
call fcn.004034cf
push dword [0x4113e4]
push 1
call fcn.0040b960
and eax, eax
je 0x4019c5
push 1
call fcn.0040b670
push dword [0x411738]
push 0x24
mov edx, dword [0x411384]
push dword [0x411738]
call fcn.0040e050
mov edx, 0x410021
call fcn.0040e050
mov edx, dword [0x4113e4]
call fcn.0040e050
mov edx, 0x410021
call fcn.0040e050
mov edx, dword [0x411398]
call fcn.0040e050
inc dword [0x411738]
push dword [0x4113f0]
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.00407fa0
pop dword [0x411738]
mov dword [0x4113dc], eax
mov ebx, dword [0x4113dc]
cmp ebx, 7
jne 0x4019c5
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call fcn.00408442
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3d7
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3c5
pop dword [0x411738]
push dword [0x411438]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
push dword [0x4113e4]
push 1
call fcn.0040b890
and eax, eax
je 0x4019f3
push dword [0x4113e0]
push 1
call fcn.0040ba10
push 1
call fcn.0040b670
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call fcn.00408442
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3d7
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3c5
pop dword [0x411738]
push dword [0x411438]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
push 0x41008d
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x401b81
push 0x400
call fcn.0040b2d0
mov dword [0x4113c8], eax
mov edx, dword [0x411738]
push edx
push edx
call fcn.0040b44d
push 0x411448
call fcn.0040dfa0
push dword [0x4113c8]
push 0
push 0x41001e
push dword [0x411448]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x411738]
push edx
push edx
push dword [0x4113c8]
call fcn.0040b1e0
push 0x411434
call fcn.0040dfa0
push dword [0x4113c8]
call fcn.0040b2f0
push dword [0x411434]
call fcn.0040b4dc
push dword [0x411434]
call fcn.0040b4ea
push dword [0x411434]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x411434]
push dword [0x411738]
call fcn.0040e050
mov edx, str.extd.exe
call fcn.0040e050
push 0x4113d4
call fcn.0040dfa0
push dword [0x4113d4]
push 0
call fcn.0040b890
push dword [0x411388]
push dword [0x411374]
push 0
call fcn.0040ba90
push 0
call fcn.0040b670
mov edx, dword [0x4113d4]
push dword [0x411738]
call fcn.0040e050
push 0x4113d0
call fcn.0040dfa0
push dword [0x4113d0]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x4113d0]
push str.b2eextd
call fcn.0040849d
push str._call:extd
push str.extd
call fcn.0040849d
mov edx, dword [0x411438]
push dword [0x411738]
call fcn.0040e050
mov edx, str.BDFI
call fcn.0040e050
mov edx, dword [0x4113e4]
call fcn.0040e050
push 0x4113e4
call fcn.0040dfa0
push dword [0x4113e4]
push 1
call fcn.0040b890
and eax, eax
je 0x401cb3
push str._shift__0
push 1
call fcn.0040baf0
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1e0
inc dword [0x411738]
mov edx, dword [0x410348]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x411738]
push eax
call fcn.0040b1e0
inc dword [0x411738]
push str.b2eargs
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040849d
pop dword [0x411738]
push dword [0x4113e0]
push 1
call fcn.0040baf0
push 0x41008d
push dword [0x4113cc]
call fcn.00403beb
and eax, eax
je 0x401ca7
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
mov ebp, 0x410345
mov ebx, ebp
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
sub ebx, ebp
push ebx
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
push ebp
call fcn.0040b230
inc dword [0x411738]
push 1
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040baf0
pop dword [0x411738]
push 1
call fcn.0040b670
jmp 0x401cee
push dword [0x4113e4]
call fcn.0040b4dc
call fcn.00403f7c
push 0x10
push dword [0x4113e8]
push dword [0x41143c]
call fcn.00407fa0
push dword [0x411438]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401fd5
mov edx, dword [0x41139c]
xor ecx, ecx
call fcn.0040e020
jne 0x401d08
push dword [0x41139c]
call fcn.004034cf
push 0x400
call fcn.0040b2d0
mov dword [0x41142c], eax
mov edx, dword [0x411738]
push edx
push edx
call fcn.0040b44d
push 0x411390
call fcn.0040dfa0
push dword [0x41142c]
push 0
push 0x41001e
push dword [0x411390]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x411738]
push edx
push edx
push dword [0x41142c]
call fcn.0040b1e0
push 0x411444
call fcn.0040dfa0
mov edx, dword [0x411738]
push edx
push edx
push 0x800
call fcn.004050f0
push 0x4113fc
call fcn.0040dfa0
push dword [0x411738]
push 0x800
push dword [0x4113fc]
mov edx, dword [0x411738]
push edx
push edx
call fcn.00408442
inc dword [0x411738]
mov edx, dword [0x410348]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x411738]
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call fcn.00408442
inc dword [0x411738]
push str.b2eprogramname
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040849d
pop dword [0x411738]
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call fcn.00408442
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b608
inc dword [0x411738]
push str.b2eprogramfilename
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040849d
pop dword [0x411738]
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call fcn.00408442
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3d7
inc dword [0x411738]
push str.b2eprogrampathname
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040849d
pop dword [0x411738]
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
push dword [0x4113fc]
call fcn.004051f0
inc dword [0x411738]
push str.b2eprogramshortname
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040849d
pop dword [0x411738]
mov edx, dword [0x4113d8]
push dword [0x411738]
call fcn.0040e050
push 0x41144c
call fcn.0040dfa0
push dword [0x41144c]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x41144c]
push 0x410076
call fcn.0040849d
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
mov eax, dword [0x41138c]
cdq
push edx
push eax
call fcn.00405380
inc dword [0x411738]
push str.b2eincfilecount
mov edx, dword [0x410348]
add dword [esp + 4], edx
call fcn.0040849d
pop dword [0x411738]
push dword [0x411444]
push str.b2etempfile
call fcn.0040849d
push dword [0x4113c4]
push dword [0x4113d8]
push dword [0x4113e4]
call fcn.004032be
call fcn.00403f7c
push dword [0x4113e4]
call fcn.0040b4dc
push dword [0x411444]
call fcn.0040b4dc
push dword [0x4113d4]
call fcn.0040b4dc
mov edx, dword [0x411738]
push edx
push edx
mov edx, dword [0x411738]
push edx
push edx
push dword [0x411738]
call fcn.00408442
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3d7
mov edx, dword [0x410348]
add dword [esp], edx
call fcn.0040b3c5
pop dword [0x411738]
push dword [0x411434]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x411438]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
push 0
call 0x401fef
call fcn.0040df70
push dword [0x411368]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00408650
call fcn.00408b21
call fcn.00409889
call fcn.0040a8ff
call fcn.0040b0fd
call fcn.0040b61a
call fcn.0040b6e0
call fcn.0040c10e
call fcn.0040b1d0
ret