Function at 0x403e50
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Delete file
Persist via lnk shortcut
Read .ini file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4415d7
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x451bf0]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push edi
mov eax, dword [0x451bf0]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
test byte [0x4583b4], 1
mov esi, 0x4583b0
jne 0x403ed1
or dword [0x4583b4], 1
mov dword [esp + 0x420], edi
call fcn.0043ea10
push eax
mov ecx, esi
call fcn.00402853
push 0x441a11
call fcn.004216bb
or dword [esp + 0x424], 0xffffffff
pop ecx
mov eax, dword [ebx + 0x78]
cmp eax, 0x14
ja case.0x403edd.4
jmp dword [eax*4 + 0x4052f0]
push 0x8c
mov ecx, ebx
call fcn.004034f5
push str.zzk_NCSTUDIO_7000F87C04A0_D4EA_11d4_88B8_0050FC09F3B0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403f18
mov dword [ebx + 0x78], 1
jmp 0x4052ca
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4052ca
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x8d
mov ecx, ebx
call fcn.004034f5
call fcn.0041901a
push eax
lea ecx, [esp + 0x14]
call fcn.00401eb1
mov esi, 0x104
push esi
lea eax, [esp + 0xf8]
push edi
push eax
mov dword [esp + 0x42c], 1
call fcn.00425b80
add esp, 0xc
lea eax, [esp + 0xf4]
push esi
push eax
call fcn.0043ea10
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov eax, 0x453790
cmp dword [0x456b70], edi
je 0x403f93
mov eax, str.Warning:_n_nSetup_program_will_delete_all_files_in_directory__s___nPlease_save_parameters_for_recover_later.__nClick_OK_to_continue.
lea ecx, [esp + 0xf4]
push ecx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004020be
mov esi, dword [esp + 0x1c]
add esp, 0xc
cmp byte [esp + 0xf4], 0
je 0x403fdb
push edi
push 0x31
push esi
call fcn.00418ce7
cmp eax, 2
jne 0x403fdb
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x94], 1
call dword [eax + 0x15c]
jmp 0x403fe2
mov dword [ebx + 0x78], 2
push edi
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esi - 0x10]
call fcn.00401ef4
jmp 0x4052ca
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.00403531
xor eax, eax
cmp dword [ebx + 0xa4], edi
sete al
lea eax, [eax + eax + 3]
mov dword [ebx + 0x78], eax
push edi
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4052ca
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, 0x44789c
lea edi, [esp + 0xec]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0xec]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0043ee70
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea eax, [esp + 0x204]
push eax
call esi
call fcn.0041901a
push eax
lea ecx, [esp + 0x14]
call fcn.00401eb1
mov dword [esp + 0x420], 2
cmp byte [ebx + 0x9c], 0
je 0x4040c1
push 0x44789c
lea eax, [ebx + 0xa0]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.004084c1
add esp, 0xc
mov byte [esp + 0x420], 3
mov dword [esp + 0xc], 1
jmp 0x404114
call fcn.0043e8f0
test al, al
je 0x4040d3
lea eax, [esp + 0x1fc]
jmp 0x4040fa
lea eax, [esp + 0xec]
push eax
lea edi, [esp + 0x68]
call fcn.00403080
pop ecx
mov dword [esp + 0x420], 4
mov eax, dword [eax]
mov dword [esp + 0xc], 2
push eax
lea ecx, [esp + 0x6c]
call fcn.00402853
mov dword [esp + 0x420], 5
or dword [esp + 0xc], 4
push eax
lea ecx, [esp + 0x14]
call fcn.0040992c
test byte [esp + 0xc], 4
je 0x404136
mov ecx, dword [esp + 0x68]
and dword [esp + 0xc], 0xfffffffb
add ecx, 0xfffffff0
call fcn.00401ef4
test byte [esp + 0xc], 2
je 0x40414e
mov ecx, dword [esp + 0x64]
and dword [esp + 0xc], 0xfffffffd
add ecx, 0xfffffff0
call fcn.00401ef4
mov dword [esp + 0x420], 2
test byte [esp + 0xc], 1
je 0x40416c
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.00401ef4
lea ecx, [esp + 0x10]
call fcn.00408587
lea edx, [esp + 0xf4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x40417c
mov eax, dword [esp + 0x10]
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
call fcn.00409979
lea eax, [esp + 0xec]
push eax
push str.D:NcStudioTemp_
lea eax, [esp + 0x30c]
push eax
call esi
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4043bc
lea eax, [esp + 0x304]
push eax
call fcn.00406cde
lea eax, [esp + 0x308]
mov dword [esp], 0x215
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.0043e6b0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.004086fb
mov byte [esp + 0x420], 6
and dword [esp + 0xc], 0
lea eax, [esp + 0x18]
call fcn.0040866b
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x45372c]
lea eax, [esp + 0x30c]
push eax
call fcn.00403170
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
add esp, 0xc
sar eax, 2
xor edi, edi
test eax, eax
jbe 0x404260
lea esi, [esp + 0x18]
call fcn.004085f3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
inc edi
sar eax, 2
cmp edi, eax
jb 0x40423f
add dword [esp + 0xc], 4
cmp dword [esp + 0xc], 0x1c
jb 0x404206
and dword [esp + 0xc], 0
lea eax, [esp + 0x18]
call fcn.0040866b
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x453748]
lea eax, [esp + 0x30c]
push eax
call fcn.0040327e
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
add esp, 0xc
sar eax, 2
xor edi, edi
test eax, eax
jbe 0x4042cb
lea esi, [esp + 0x18]
call fcn.004085f3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
inc edi
sar eax, 2
cmp edi, eax
jb 0x4042aa
add dword [esp + 0xc], 4
cmp dword [esp + 0xc], 8
jb 0x404271
and dword [esp + 0xc], 0
lea eax, [esp + 0x18]
call fcn.0040866b
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x453754]
push dword [eax + 0x453750]
lea eax, [esp + 0x310]
push eax
call fcn.004033ac
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x34]
add esp, 0x10
sar eax, 2
xor edi, edi
test eax, eax
jbe 0x40433c
lea esi, [esp + 0x18]
call fcn.004085f3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
inc edi
sar eax, 2
cmp edi, eax
jb 0x40431b
add dword [esp + 0xc], 8
cmp dword [esp + 0xc], 0x28
jb 0x4042dc
and dword [esp + 0xc], 0
lea eax, [esp + 0x18]
call fcn.0040866b
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x453778]
lea eax, [esp + 0x30c]
push eax
call fcn.00403170
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
add esp, 0xc
sar eax, 2
xor edi, edi
test eax, eax
jbe 0x4043a7
lea esi, [esp + 0x18]
call fcn.004085f3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
inc edi
sar eax, 2
cmp edi, eax
jb 0x404386
add dword [esp + 0xc], 4
cmp dword [esp + 0xc], 0xc
jb 0x40434d
lea esi, [esp + 0x18]
call fcn.004025db
mov dword [ebx + 0x78], 5
push 0
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
jmp 0x403ff6
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043e8f0
test al, al
je 0x404416
call fcn.0043ee70
mov esi, eax
cmp esi, edi
je 0x404439
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x404439
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
jmp 0x404433
cmp byte [ebx + 0x9c], 0
je 0x404439
lea esi, [ebx + 0xa0]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x404439
push dword [esi]
call fcn.0043e4b0
pop ecx
call fcn.0043ea10
lea edx, [esp + 0x1fc]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x404445
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
cmp byte [esp + 0x1fc], 0
je 0x404496
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x404496
push edi
lea eax, [esp + 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1fc]
push eax
call fcn.0043e4b0
pop ecx
call fcn.0043ecf0
cmp byte [eax], 0
je 0x4044bc
call fcn.0043efd0
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x4044bc
call fcn.0043efd0
push eax
call fcn.0043e4b0
pop ecx
push str.D:NcFilesWizards_
call fcn.0043e4b0
pop ecx
call fcn.00405344
push eax
lea ecx, [esp + 0x10]
call fcn.00402853
push str.Nc_studio.lnk
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x42c], 7
call fcn.004084c1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.00401ef4
mov edi, 0x447980
push edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.004084c1
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.00401ef4
call fcn.00402b60
push eax
lea ecx, [esp + 0x10]
call fcn.004029d1
push str.Nc_studio.lnk
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004084c1
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.00401ef4
push edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.004084c1
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.00401ef4
call fcn.004053ff
push eax
lea ecx, [esp + 0x10]
call fcn.004029d1
push str.Nc_studio.lnk
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.004084c1
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.00401ef4
push edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.004084c1
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.00401ef4
push 0
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x78], 6
mov ecx, dword [esp + 0xc]
jmp 0x4043d9
push 0x91
mov ecx, ebx
call fcn.004034f5
lea eax, [ebx + 0x74]
push eax
call fcn.00407dd3
pop ecx
test eax, eax
je 0x4052ca
mov dword [ebx + 0x78], 7
jmp 0x4052ca
call fcn.0040583e
lea esi, [ebx + 0x90]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40465a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.00402903
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043e8f0
push 8
pop esi
test al, al
je 0x404741
call fcn.0043e220
test al, al
jne 0x404741
call fcn.0043eb10
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x17], 1
call fcn.00407a3c
test al, al
jne 0x4046f2
mov eax, dword [0x456b70]
push dword [eax*4 + 0x453958]
lea ecx, [esp + 0x14]
call fcn.00402853
mov dword [esp + 0x420], esi
mov eax, dword [0x456b70]
push dword [eax*4 + 0x453960]
lea ecx, [esp + 0x14]
call fcn.00402623
push edi
push edi
push dword [esp + 0x18]
call fcn.00418ce7
or dword [esp + 0x420], 0xffffffff
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
mov byte [esp + 0x17], 0
call fcn.00401ef4
call fcn.0043e900
lea edx, [esp + 0xf4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4046fe
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x404736
lea eax, [esp + 0xf4]
push eax
call fcn.0043e4b0
pop ecx
cmp byte [esp + 0x17], 0
je 0x4052ca
push edi
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x78], esi
jmp 0x4052ca
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push edi
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x78], 0xa
jmp 0x4052ca
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, 0x44789c
lea edi, [esp + 0xec]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0xec]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0043ee70
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea eax, [esp + 0x30c]
push eax
call esi
cmp byte [ebx + 0x9d], 0
je 0x4047f2
push 0x44789c
lea eax, [ebx + 0xa0]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.004084c1
add esp, 0xc
mov dword [esp + 0x420], 0xc
mov dword [esp + 0xc], 8
jmp 0x404845
call fcn.0043e8f0
test al, al
je 0x404804
lea eax, [esp + 0x304]
jmp 0x40482b
lea eax, [esp + 0xec]
push eax
lea edi, [esp + 0x34]
call fcn.00403080
pop ecx
mov dword [esp + 0x420], 0xd
mov eax, dword [eax]
mov dword [esp + 0xc], 0x10
push eax
lea ecx, [esp + 0x58]
call fcn.00402853
mov dword [esp + 0x420], 0xe
or dword [esp + 0xc], 0x20
push eax
lea ecx, [esp + 0x14]
call fcn.004098a1
mov dword [esp + 0x420], 0xf
test byte [esp + 0xc], 0x20
je 0x404872
mov ecx, dword [esp + 0x54]
and dword [esp + 0xc], 0xffffffdf
add ecx, 0xfffffff0
call fcn.00401ef4
test byte [esp + 0xc], 0x10
je 0x40488a
mov ecx, dword [esp + 0x30]
and dword [esp + 0xc], 0xffffffef
add ecx, 0xfffffff0
call fcn.00401ef4
mov byte [esp + 0x420], 0x12
test byte [esp + 0xc], 8
je 0x4048a5
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.00401ef4
lea ecx, [esp + 0x10]
call fcn.00408587
lea edx, [esp + 0xf4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4048b5
mov edi, dword [esp + 0x10]
push dword [edi - 0xc]
lea ecx, [esp + 0x14]
call fcn.00409979
push 0x44789c
push str.D:NcStudioTemp_
lea eax, [esp + 0x204]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [esp + 0x1fc]
push eax
call esi
test eax, eax
je 0x40493b
lea eax, [esp + 0xf4]
push eax
call esi
test eax, eax
jne 0x404913
lea eax, [esp + 0xf4]
push eax
call fcn.00406cde
pop ecx
push 0x215
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x204]
push eax
call fcn.0043e6b0
add esp, 0xc
push str.D:NcStudioTemp_
call fcn.0043e4b0
pop ecx
push 0
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0043e8f0
xor ecx, ecx
test al, al
sete cl
lea ecx, [ecx*4 + 0x10]
mov dword [ebx + 0x78], ecx
lea ecx, [edi - 0x10]
jmp 0x403ff6
push 0x92
mov ecx, ebx
call fcn.004034f5
call fcn.0043e8f0
test al, al
jne 0x404a2d
call fcn.0043ecf0
lea edx, [esp + 0xf4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x404990
call fcn.0041901a
push eax
lea ecx, [esp + 0x10]
call fcn.00401eb1
mov dword [esp + 0x420], 0x13
lea ecx, [esp + 0xc]
cmp dword [ebx + 0x74], edi
je 0x4049c9
push 0x44777c
call fcn.004029d1
jmp 0x4049cf
push esi
call fcn.0040992c
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0x10]
call fcn.00402623
push 0x447990
lea ecx, [esp + 0x10]
call fcn.00402623
push str.langlang.ini
lea ecx, [esp + 0x10]
call fcn.00402623
push dword [esp + 0xc]
mov eax, str.ActiveLang
cmp dword [0x456b70], edi
jne 0x404a14
push 0x4479a4
jmp 0x404a19
push 0x4479b4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebx + 0x78], 0xc
jmp 0x404601
mov eax, 0x4479a4
cmp dword [0x456b70], edi
je 0x404a3f
mov eax, 0x4479b4
push eax
call fcn.0043f0e0
pop ecx
mov dword [ebx + 0x78], 0xf
jmp 0x4052ca
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x103
lea eax, [esp + 0xf9]
push edi
push eax
mov byte [esp + 0x100], 0
call fcn.00425b80
add esp, 0xc
call fcn.0043ecf0
lea ecx, [esp + 0xf4]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x404a87
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x38]
push esi
push eax
call fcn.004084c1
add esp, 0xc
push 0x447990
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x42c], 0x14
call fcn.004084c1
add esp, 0xc
mov byte [esp + 0x420], 0x16
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.00401ef4
lea eax, [esp + 0x10]
push eax
call fcn.00405d6e
pop ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401ef4
push edi
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x78], 0xd
jmp 0x4052ca
push 0x93
mov ecx, ebx
call fcn.004034f5
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push str.setup.cfg
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.004084c1
add esp, 0xc
push dword [eax]
mov esi, 0x104
push esi
lea eax, [esp + 0x30c]
push eax
push 0x448068
push str.BACKUPPATH
push str.SETTINGS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.00401ef4
lea eax, [esp + 0x304]
push eax
lea ecx, [esp + 0x14]
call fcn.00402853
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x424], 0x17
call fcn.00406da9
mov eax, dword [esp + 0x14]
pop ecx
cmp dword [eax - 0xc], edi
je 0x404c17
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x404bad
push dword [esp + 0x10]
call fcn.00406cde
pop ecx
push esi
lea eax, [esp + 0x200]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov cl, byte [esp + eax + 0x1fc]
mov byte [esp + eax + 0xf4], cl
inc eax
test cl, cl
jne 0x404bbf
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004084c1
add esp, 0xc
push edi
push dword [eax]
lea eax, [esp + 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.00401ef4
push edi
push 0x1f4
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x78], 0x13
jmp 0x4043d5
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x4479c4
lea ecx, [esp + 0x14]
call fcn.00402853
mov dword [esp + 0x420], 0x18
cmp dword [0x456b70], edi
je 0x404c6e
push str.Would_you_put_generate_files_and_executive_files_separately_
lea ecx, [esp + 0x14]
call fcn.004029d1
push edi
push 4
push dword [esp + 0x18]
call fcn.00418ce7
cmp eax, 6
jne 0x404c9e
call fcn.004065e6
lea eax, [ebx + 0xa0]
push eax
lea esi, [ebx + 0x9d]
push ebx
mov byte [esi], 1
call fcn.004068ac
mov byte [esi], al
jmp 0x404cb5
push 0x448068
lea ecx, [ebx + 0xa0]
mov byte [ebx + 0x9d], 0
call fcn.004029d1
mov dword [ebx + 0x78], 0xf
push edi
jmp 0x4043c5
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.00403b6b
cmp dword [ebx + 0xa4], edi
je 0x404cfb
call fcn.0043f140
push eax
push edi
push str.Packup
push str.Operation
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x404f70
push str.User
call fcn.0043ea10
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea eax, [esp + 0xfc]
push eax
call esi
call fcn.0043ecf0
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x30c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [esp + 0x304]
push eax
mov byte [esp + 0x1b], 0
call esi
test eax, eax
jne 0x404da9
mov esi, 0x104
push esi
lea eax, [esp + 0xf8]
push edi
push eax
call fcn.00425b80
add esp, 0xc
push esi
lea eax, [esp + 0x308]
push edi
push eax
call fcn.00425b80
add esp, 0xc
push str.User_
call fcn.0043ea10
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea eax, [esp + 0xfc]
push eax
call esi
push 0x44789c
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x30c]
push eax
call esi
mov byte [esp + 0x17], 1
jmp 0x404dd9
lea eax, [esp + 0x304]
push eax
call esi
test eax, eax
je 0x404dd9
cmp byte [ebx + 0x9d], 0
je 0x404dd9
lea edi, [esp + 0x304]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404dc8
mov esi, str.config
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
lea eax, [esp + 0x304]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404f70
mov esi, 0x44789c
lea edi, [esp + 0xec]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.0043ee70
lea edx, [esp + 0x1fc]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x404e0b
cmp byte [ebx + 0x9d], cl
je 0x404e4e
lea eax, [esp + 0xec]
push eax
lea eax, [ebx + 0xa0]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004084c1
add esp, 0xc
mov dword [esp + 0x420], 0x19
mov dword [esp + 0xc], 0x40
jmp 0x404e97
cmp byte [esp + 0x17], 0
je 0x404e73
lea edi, [esp + 0x1fc]
dec edi
lea ecx, [edi + 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404e60
mov esi, str.config
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, ecx
jmp 0x404e7a
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402853
mov dword [esp + 0x420], 0x1a
mov dword [esp + 0xc], 0x80
push eax
lea ecx, [esp + 0x14]
call fcn.004098a1
mov dword [esp + 0x420], 0x1b
test byte [esp + 0xc], 0x80
je 0x404ec7
mov ecx, dword [esp + 0x48]
and dword [esp + 0xc], 0xffffff7f
add ecx, 0xfffffff0
call fcn.00401ef4
mov byte [esp + 0x420], 0x1d
test byte [esp + 0xc], 0x40
je 0x404ee2
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.00401ef4
mov eax, dword [esp + 0x10]
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
call fcn.00401ffc
lea edx, [esp + 0x1fc]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x404ef9
mov esi, dword [esp + 0x10]
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.00409979
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x404f33
lea eax, [esp + 0x1fc]
push eax
call fcn.00406cde
pop ecx
push 0x215
lea eax, [esp + 0x200]
push eax
lea eax, [esp + 0x30c]
push eax
call fcn.0043e6b0
lea eax, [esp + 0x100]
add esp, 0xc
push eax
call fcn.0043e4b0
or dword [esp + 0x424], 0xffffffff
pop ecx
lea ecx, [esi - 0x10]
call fcn.00401ef4
xor edi, edi
cmp dword [ebx + 0xa4], edi
je 0x404f9f
mov eax, dword [0x456b70]
mov eax, dword [eax*4 + 0x453700]
add eax, 0x94
push eax
mov ecx, ebx
call fcn.004034f5
mov ecx, ebx
call fcn.0040371b
mov ecx, ebx
call fcn.00403b6b
call fcn.0043e460
test eax, eax
jne 0x404fcf
call fcn.0043f140
push eax
push edi
push str.Packup
push str.Operation
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x404fcf
mov dword [ebx + 0x78], 0x14
jmp 0x404024
cmp dword [ebx + 0xa4], edi
je 0x404fe3
mov dword [ebx + 0x78], 9
jmp 0x404024
call fcn.0043e8f0
xor ecx, ecx
test al, al
sete cl
lea ecx, [ecx*4 + 0x10]
mov dword [ebx + 0x78], ecx
jmp 0x404024
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043f140
push eax
push edi
push str.Packup
mov esi, str.Operation
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esp + 0x10], eax
call fcn.0043e460
test eax, eax
jne 0x405062
cmp dword [esp + 0x10], edi
jne 0x405062
push 0x95
mov ecx, ebx
call fcn.004034f5
call fcn.0043ef50
push eax
push 0x447a44
push str.InstallDriver
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x447a58
call fcn.004025c8
pop ecx
push str.netshinstall.bat
call fcn.0043ea10
push eax
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4050d7
push 0x3c
pop esi
push esi
lea eax, [esp + 0x78]
push edi
push eax
call fcn.00425b80
lea eax, [esp + 0x100]
mov dword [esp + 0x90], eax
add esp, 0xc
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], esi
mov dword [esp + 0x8c], 0x448068
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4050d7
push edi
push edi
push 0x447a84
call fcn.00418ce7
mov dword [ebx + 0x78], 0x11
jmp 0x404024
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043f140
push eax
push edi
push str.Packup
mov esi, str.Operation
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esp + 0x10], eax
call fcn.0043e460
test eax, eax
jne 0x404fc3
cmp dword [esp + 0x10], edi
jne 0x404fc3
call fcn.0043ef50
push eax
push 0x447a44
push str.Commit
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str._FirstRun
call fcn.004025c8
pop ecx
push 0x3c
pop esi
push esi
lea eax, [esp + 0x78]
push edi
push eax
call fcn.00425b80
add esp, 0xc
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], 0x400
mov dword [esp + 0x88], str.ewfmgr
mov dword [esp + 0x8c], str.c:__commit
mov dword [esp + 0x94], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4051a8
push edi
push edi
push 0x447ae0
call fcn.00418ce7
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x15c]
jmp 0x404fc3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404fc3
push 0x70
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043f140
push eax
push edi
push str.Packup
push str.Operation
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
call fcn.0043e8f0
test al, al
je 0x405260
call fcn.0043e460
test eax, eax
jne 0x405260
cmp esi, edi
jne 0x405260
push 0x96
mov ecx, ebx
call fcn.004034f5
push 0x3c
pop esi
push esi
lea eax, [esp + 0xb4]
push edi
push eax
call fcn.00425b80
add esp, 0xc
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], 0x400
call fcn.0043ee30
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xb0]
push eax
mov dword [esp + 0xd0], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4052b6
push edi
push edi
mov esi, 0x447b08
push esi
call fcn.00418ce7
push esi
call fcn.004025c8
pop ecx
jmp 0x4052b6
push 0x97
mov ecx, ebx
call fcn.004034f5
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x456b70]
mov eax, dword [eax*4 + 0x453950]
push edi
push 0x34
push eax
call fcn.00418ce7
cmp eax, 6
jne 0x4052b6
call fcn.00405ca3
jmp 0x4052b6
push 0x70
push dword [ebx + 0x20]
mov dword [ebx + 0x78], 0x14
call dword [sym.imp.USER32.dll_KillTimer]
push edi
push edi
push str.Invalid_state_
call fcn.00418ce7
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x94], 1
call dword [eax + 0x15c]
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0042116f
mov esp, ebp
pop ebp
ret