Function at 0x401585
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Resolve function by parsing pe exports
Set current directory
Set file attributes
Set registry value

Disassembly:
sub esp, 0x2e4
mov eax, dword [0x40d0fc]
xor eax, esp
mov dword [esp + 0x2e0], eax
mov eax, dword [0x473558]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2f4]
xor ebp, ebp
push edi
push 7
pop ecx
lea edi, [esp + 0x74]
mov dword [esp + 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x78]
mov eax, section..ndata
mov edx, dword [esp + 0x7c]
mov edi, ecx
mov esi, edx
shl edi, 0xe
add edi, eax
shl esi, 0xe
add esi, eax
mov dword [esp + 0x34], ecx
lea eax, [esp + 0x78]
mov dword [esp + 0x18], edi
mov dword [0x40d104], eax
mov ebx, ebp
mov eax, dword [esp + 0x74]
add eax, 0xfffffffe
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], eax
cmp eax, 0x45
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x90], edx
mov dword [esp + 0x24], esi
ja case.0x401611.20
mov ebx, dword [esp + 0x20]
jmp dword [ebx*4 + 0x4035f5]
push ecx
push str.Jump:__d
call fcn.0040744b
mov eax, dword [esp + 0x80]
pop ecx
pop ecx
jmp 0x4035da
push ebp
call fcn.00403781
push eax
push str.Aborting:___s_
call fcn.0040744b
pop ecx
pop ecx
push ebp
push dword [esp + 0x7c]
call fcn.004068ba
mov eax, 0x7fffffff
jmp 0x4035da
inc dword [0x47354c]
test eax, eax
je 0x40164e
push ebp
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40164e
push ecx
call fcn.00403840
lea esi, [eax - 1]
push esi
push str.Call:__d
call fcn.0040744b
pop ecx
pop ecx
push ebp
push esi
call fcn.004013c0
jmp 0x4035da
push ebp
call fcn.00403781
push eax
push str.DetailPrint:__s
call fcn.0040744b
pop ecx
pop ecx
push ebp
push dword [esp + 0x7c]
call fcn.004068ba
jmp case.0x401611.20
push ebp
call fcn.00403745
mov esi, eax
push esi
push str.Sleep__d_
call fcn.0040744b
xor eax, eax
add esp, 0xc
inc eax
cmp esi, eax
cmovg eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x401611.20
push str.BringToFront
call fcn.0040744b
mov eax, dword [esp + 0x20]
pop ecx
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x401611.20
mov eax, dword [esp + 0x80]
test eax, eax
jg 0x40172f
jne 0x40170f
mov eax, dword [ecx*4 + 0x47b620]
mov dword [ecx*4 + 0x47b5e0], eax
push 1
call fcn.00403745
mov ecx, eax
mov eax, dword [esp + 0x7c]
push ecx
push eax
push str.SetFlag:__d_d
mov dword [eax*4 + 0x47b620], ecx
jmp 0x40243b
mov eax, dword [ecx*4 + 0x47b5e0]
mov dword [ecx*4 + 0x47b620], eax
jmp case.0x401611.20
mov ecx, dword [esp + 0x80]
push 4
mov edx, dword [ecx*4 + 0x47b620]
mov eax, edx
and eax, dword [esp + 0x88]
mov dword [ecx*4 + 0x47b620], eax
xor eax, eax
test edx, edx
pop ecx
cmove eax, ecx
mov eax, dword [esp + eax + 0x78]
jmp 0x4035da
push dword [edx*4 + 0x47b620]
push edi
call fcn.004073b6
jmp case.0x401611.20
mov eax, dword [0x473544]
test eax, eax
je 0x40179a
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x78]
mov eax, dword [0x473548]
test eax, eax
je case.0x401611.20
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x401611.20
push 0xfffffffffffffff0
call fcn.00403781
push dword [esp + 0x7c]
mov esi, eax
push esi
push str.SetFileAttributes:___s_:_08X
call fcn.0040744b
add esp, 0xc
push dword [esp + 0x7c]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x401611.20
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
push str.SetFileAttributes_failed.
call fcn.0040744b
pop ecx
jmp case.0x401611.20
push 0xfffffffffffffff0
call fcn.00403781
push dword [esp + 0x7c]
mov esi, eax
push esi
push str.CreateDirectory:___s____d_
call fcn.0040744b
add esp, 0xc
push esi
call fcn.00407b0c
mov ebx, dword [esp + 0x10]
mov edi, eax
test edi, edi
je 0x4018b5
push 0x5c
push edi
call fcn.0040738d
mov edi, eax
xor eax, eax
movzx ebp, word [edi]
mov word [edi], ax
test bp, bp
jne 0x401859
cmp dword [esp + 0x80], eax
je 0x401859
call fcn.004070ec
test eax, eax
je 0x401859
push esi
call fcn.004069d2
jmp 0x40185f
push esi
call fcn.004069b2
test eax, eax
je 0x401895
cmp eax, 0xb7
je 0x40187c
push eax
push esi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.0040744b
add esp, 0xc
inc ebx
jmp 0x4018a2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4018a2
push esi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.0040744b
inc ebx
jmp 0x4018a0
push esi
push str.CreateDirectory:___s__created
call fcn.0040744b
pop ecx
pop ecx
mov word [edi], bp
add edi, 2
test bp, bp
jne 0x401828
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x7c], 0
push 0x411108
je 0x4018fd
push 0xffffffffffffffe6
call fcn.004068ba
push esi
push 0x4d4000
call fcn.00407a7a
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne case.0x401611.20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.SetCurrentDirectory__s__failed___d_
call fcn.0040744b
add esp, 0xc
inc ebx
jmp 0x401a98
push 0xfffffffffffffff5
jmp 0x4016a5
push ebp
call fcn.00403781
mov esi, eax
push esi
call fcn.00407366
test eax, eax
je 0x401931
push dword [esp + 0x7c]
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.0040744b
add esp, 0xc
mov eax, dword [esp + 0x7c]
jmp 0x4035da
push dword [esp + 0x80]
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.0040744b
add esp, 0xc
mov eax, dword [esp + 0x80]
jmp 0x4035da
push 0xffffffffffffffd0
call fcn.00403781
push 0xffffffffffffffdf
mov edi, eax
call fcn.00403781
push 0x13
mov ebp, eax
call fcn.00403781
mov esi, eax
push esi
push str.Rename:__s
call fcn.0040744b
pop ecx
pop ecx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x401992
push 0x411108
push 0xffffffffffffffe3
jmp 0x4016a5
cmp dword [esp + 0x80], 0
je 0x4019c1
push edi
call fcn.00407366
test eax, eax
je 0x4019c1
push ebp
push edi
call fcn.00406e0e
push 0x411108
push 0xffffffffffffffe4
call fcn.004068ba
push esi
push str.Rename_on_reboot:__s
jmp 0x4019ce
push esi
push str.Rename_failed:__s
xor ebx, ebx
inc ebx
mov dword [esp + 0x18], ebx
call fcn.0040744b
pop ecx
jmp 0x4017f3
push ebp
call fcn.00403781
mov edi, eax
lea eax, [esp + 0x18]
push eax
push esi
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x401a1d
mov eax, dword [esp + 0x18]
cmp eax, edi
jbe 0x401a29
cmp word [eax], bp
je 0x401a29
push edi
call fcn.00407366
test eax, eax
je 0x401a1d
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call fcn.00407a7a
jmp 0x401a29
xor ebx, ebx
inc ebx
xor eax, eax
mov word [esi], ax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x80], ebp
jne case.0x401611.20
push 0x2000
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp case.0x401611.20
push 0xffffffffffffffff
call fcn.00403781
lea ecx, [esp + 0x90]
push ecx
push edi
push 0x2000
push ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x401611.20
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [esp + 0x10], ebx
mov word [edi], ax
jmp case.0x401611.20
push 0xffffffffffffffef
call fcn.00403781
push eax
push edi
call fcn.0040799e
test eax, eax
jne case.0x401611.20
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp case.0x401611.20
push 0x31
call fcn.00403781
mov ecx, dword [esp + 0x78]
mov esi, eax
mov eax, ecx
mov dword [esp + 0x18], esi
sar ecx, 3
and eax, 7
push esi
and ecx, 2
mov dword [esp + 0x20], eax
push ecx
push eax
push str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
call fcn.0040744b
add esp, 0x10
push esi
call fcn.00407d5c
mov edi, 0x40d108
push esi
test eax, eax
je 0x401ae9
push edi
call fcn.00407a7a
jmp 0x401b00
push 0x4d4000
push edi
call fcn.00407a7a
push eax
call fcn.004072ed
push eax
call sub.KERNEL32.dll_lstrcatW
push edi
call fcn.00407c90
xor esi, esi
inc esi
mov eax, dword [esp + 0x1c]
cmp eax, 3
jl 0x401b49
push edi
call fcn.00407366
mov ecx, ebp
test eax, eax
je 0x401b32
lea ecx, [esp + 0x84]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffd
or eax, 0x80000000
and eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x401b53
push edi
call fcn.00407ae4
xor eax, eax
cmp dword [esp + 0x1c], esi
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.00407862
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x401c48
cmp dword [esp + 0x1c], ebp
jne 0x401c1c
push edi
push str.File:_error_creating___s_
call fcn.0040744b
pop ecx
pop ecx
push section..ndata
push 0x415108
call fcn.00407a7a
push edi
push section..ndata
call fcn.00407a7a
push dword [esp + 0x8c]
push 0x411108
call fcn.00406a2d
push 0x415108
push section..ndata
call fcn.00407a7a
mov eax, dword [esp + 0x78]
sar eax, 3
push eax
push 0x411108
call fcn.00407a08
sub eax, 4
jne 0x401bee
push str.File:_error__user_retry
call fcn.0040744b
pop ecx
jmp 0x401b09
sub eax, 1
je 0x401c06
push str.File:_error__user_abort
call fcn.0040744b
pop ecx
push edi
push 0xfffffffffffffffa
jmp 0x401649
push str.File:_error__user_cancel
call fcn.0040744b
inc dword [0x47b628]
pop ecx
jmp 0x4035d8
mov esi, dword [esp + 0x18]
push esi
push 0xffffffffffffffe2
call fcn.004068ba
mov ebp, dword [esp + 0x1c]
push ebp
push edi
push str.File:_skipped:___s___overwriteflag_d_
call fcn.0040744b
add esp, 0xc
xor ebx, ebx
cmp ebp, 2
sete bl
jmp 0x401a98
mov esi, dword [esp + 0x18]
push esi
push 0xffffffffffffffea
call fcn.004068ba
inc dword [0x47b654]
push ebp
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x8c]
call fcn.00403a29
dec dword [0x47b654]
push edi
push eax
push str.File:_wrote__d_to___s_
mov dword [esp + 0x2c], eax
call fcn.0040744b
add esp, 0xc
cmp dword [esp + 0x84], 0xffffffff
jne 0x401c99
cmp dword [esp + 0x88], 0xffffffff
je 0x401cad
lea eax, [esp + 0x84]
push eax
push ebp
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
test eax, eax
jns case.0x401611.20
cmp eax, 0xfffffffe
jne 0x401cd9
push 0xffffffffffffffe9
push edi
call fcn.00406a2d
push esi
push edi
call sub.KERNEL32.dll_lstrcatW
jmp 0x401ce1
push 0xffffffffffffffee
push edi
call fcn.00406a2d
push edi
push 0x40a8c8
call fcn.0040744b
pop ecx
pop ecx
push 0x200010
push edi
call fcn.00407a08
jmp 0x40164e
push ebp
call fcn.00403781
mov esi, eax
push esi
push str.Delete:___s_
call fcn.0040744b
pop ecx
pop ecx
push dword [esp + 0x7c]
push esi
call fcn.004075de
jmp case.0x401611.20
push 0x31
call fcn.00403781
mov esi, eax
push esi
push dword [esp + 0x7c]
push str.MessageBox:__d___s_
call fcn.0040744b
add esp, 0xc
push dword [esp + 0x78]
push esi
call fcn.00407a08
test eax, eax
je 0x401a95
cmp eax, dword [esp + 0x80]
je 0x401ecb
cmp eax, dword [esp + 0x88]
jne case.0x401611.20
mov eax, dword [esp + 0x8c]
jmp 0x4035da
push 0xfffffffffffffff0
call fcn.00403781
mov esi, eax
push esi
push str.RMDir:___s_
jmp 0x401d0c
push 1
call fcn.00403781
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
jmp 0x40177a
push 2
call fcn.00403745
push 3
mov ebp, eax
mov esi, edx
call fcn.00403745
pop ecx
pop ecx
push 1
mov dword [esp + 0x24], eax
call fcn.00403781
push eax
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_lstrlenW
mov ecx, eax
xor eax, eax
test esi, esi
mov word [edi], ax
cmove ebp, ecx
test ebp, ebp
je case.0x401611.20
mov eax, dword [esp + 0x20]
test eax, eax
jns 0x401de6
add eax, ecx
js case.0x401611.20
cmp eax, ecx
cmovg eax, ecx
mov ecx, dword [esp + 0x18]
lea eax, [ecx + eax*2]
push eax
push edi
call fcn.00407a7a
test ebp, ebp
jns 0x401e05
push edi
call sub.KERNEL32.dll_lstrlenW
add ebp, eax
xor eax, eax
test ebp, ebp
cmovns eax, ebp
cmp eax, 0x2000
jge case.0x401611.20
xor ecx, ecx
mov word [edi + eax*2], cx
jmp case.0x401611.20
push 0x20
call fcn.00403781
push 0x31
mov esi, eax
call fcn.00403781
push eax
push esi
cmp dword [esp + 0x90], ebp
jne 0x401e45
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x401e4b
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401ecb
jmp 0x401946
xor ebp, ebp
inc ebp
push ebp
call fcn.00403781
push 0x2000
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x401e86
cmp dword [esp + 0x80], 0
je 0x401e91
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401e91
mov ebx, ebp
xor eax, eax
mov dword [esp + 0x10], ebx
mov word [edi], ax
xor eax, eax
mov word [edi + 0x3ffe], ax
jmp case.0x401611.20
mov esi, dword [esp + 0x8c]
push ebp
call fcn.00403745
push 1
mov edi, eax
call fcn.00403745
pop ecx
pop ecx
test esi, esi
jne 0x401ec7
cmp edi, eax
jl 0x401ecb
jle 0x401946
jmp 0x401edd
cmp edi, eax
jae 0x401ed7
mov eax, dword [esp + 0x84]
jmp 0x4035da
jbe 0x401946
mov eax, dword [esp + 0x88]
jmp 0x4035da
push 1
call fcn.00403745
push 2
mov esi, eax
call fcn.00403745
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x84]
cmp eax, 0xd
ja case.default.0x401f09
jmp dword [eax*4 + 0x40370d]
add esi, ecx
jmp case.default.0x401f09
sub esi, ecx
jmp case.default.0x401f09
imul esi, ecx
jmp case.default.0x401f09
test ecx, ecx
je 0x401f2a
mov eax, esi
cdq
idiv ecx
mov esi, eax
jmp 0x401f2c
mov esi, ebp
xor ebx, ebx
test ecx, ecx
sete bl
mov dword [esp + 0x10], ebx
jmp case.default.0x401f09
or esi, ecx
jmp case.default.0x401f09
and esi, ecx
jmp case.default.0x401f09
xor esi, ecx
jmp case.default.0x401f09
xor eax, eax
test esi, esi
sete al
mov esi, eax
jmp case.default.0x401f09
test esi, esi
jne 0x401f58
test ecx, ecx
je 0x401f61
xor esi, esi
inc esi
jmp case.default.0x401f09
test esi, esi
jne 0x401f54
mov esi, ebp
jmp case.default.0x401f09
test ecx, ecx
je 0x401f2a
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp 0x401f2c
shl esi, cl
jmp case.default.0x401f09
sar esi, cl
jmp case.default.0x401f09
shr esi, cl
push esi
jmp 0x40177a
push 1
call fcn.00403781
push 2
mov esi, eax
call fcn.00403745
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp case.0x401611.20
mov eax, dword [esp + 0x80]
mov esi, dword [0x40d100]
test eax, eax
je 0x402016
dec eax
test esi, esi
je 0x401ff0
mov esi, dword [esi]
test eax, eax
jne 0x401fb4
test esi, esi
je 0x401ff0
add esi, 4
mov edi, 0x40d108
push esi
push edi
call fcn.00407a7a
mov eax, dword [0x40d100]
add eax, 4
push eax
push esi
call fcn.00407a7a
mov eax, dword [0x40d100]
push edi
add eax, 4
push eax
jmp 0x403220
push dword [esp + 0x80]
push str.Exch:_stack____d_elements
call fcn.0040744b
pop ecx
pop ecx
push 0x200010
push 0xffffffffffffffe8
push ebp
call fcn.00406a2d
push eax
jmp 0x401cf4
test edx, edx
je 0x402045
test esi, esi
jne 0x40202e
push str.Pop:_stack_empty
call fcn.0040744b
pop ecx
jmp 0x401a95
lea eax, [esi + 4]
push eax
push edi
call fcn.00407a7a
mov eax, dword [esi]
mov dword [0x40d100], eax
push esi
jmp 0x4025d4
push 0x4004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [esp + 0x78]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.00406a2d
mov eax, dword [0x40d100]
mov dword [esi], eax
mov dword [0x40d100], esi
jmp case.0x401611.20
push 3
call fcn.00403745
push 4
mov dword [esp + 0x2c], eax
call fcn.00403745
mov esi, eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x20], esi
pop ecx
pop ecx
test al, 1
je 0x4020aa
push 0x33
call fcn.00403781
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x8c]
test al, 2
je 0x4020bb
push 0x44
call fcn.00403781
mov esi, eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x74], 0x22
push 1
jne 0x40211c
call fcn.00403745
push 2
mov dword [esp + 0x20], eax
call fcn.00403745
pop ecx
pop ecx
mov ecx, dword [esp + 0x8c]
sar ecx, 2
test ecx, ecx
je 0x40210a
lea edx, [esp + 0x14]
push edx
push ecx
push ebp
push esi
push dword [esp + 0x34]
push eax
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb ebx, ebx
mov eax, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x40214e
push esi
push dword [esp + 0x28]
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40214a
call fcn.00403781
push 0x12
mov esi, eax
call fcn.00403781
xor ecx, ecx
cmp word [eax], bp
cmovne ecx, eax
push ecx
xor ecx, ecx
cmp word [esi], bp
cmovne ecx, esi
push ecx
push dword [esp + 0x20]
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x78], ebp
jl case.0x401611.20
jmp 0x401d93
push ebp
call fcn.00403745
pop ecx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401946
jmp 0x401928
push 2
call fcn.00403745
push 1
mov esi, eax
call fcn.00403745
pop ecx
pop ecx
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401d93
mov esi, dword [0x47b5a8]
push ebp
add esi, edx
call fcn.00403745
pop ecx
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x401611.20
test dword [esp + 0x84], 0x100
je 0x4021cc
push 2
call fcn.00403745
pop ecx
jmp 0x4021da
push dword [esp + 0x80]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x84]
mov ecx, eax
and ecx, 4
mov ebp, eax
mov dword [esp + 0x30], ecx
mov esi, eax
shr ebp, 0x1e
mov ecx, eax
shr ecx, 0x1f
and esi, 3
and ebp, 1
mov dword [esp + 0x20], ecx
test eax, 0x10000
je 0x402214
push 0x11
call fcn.00403781
jmp 0x402219
movzx eax, word [esp + 0x7c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x84]
and eax, 0xfef0
push eax
mov eax, dword [esp + 0xa0]
imul eax, ebp
push eax
mov eax, dword [esp + 0xa0]
imul eax, dword [esp + 0x28]
push eax
xor eax, eax
cmp dword [esp + 0x3c], eax
push esi
push dword [esp + 0x28]
cmovne eax, dword [0x473554]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebp, eax
push ebp
push esi
push 0x172
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40228f
test esi, esi
jne 0x40228f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x78], 0
jl case.0x401611.20
push ebp
jmp 0x40177a
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 2
mov edi, eax
call fcn.00403745
pop ecx
push 0x48
push 0x5a
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x421108], eax
mov eax, dword [esp + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
call fcn.00403745
pop ecx
mov ecx, dword [esp + 0x88]
push dword [esp + 0x7c]
mov dword [0x421118], eax
mov al, cl
and al, 1
mov byte [0x42111f], 1
mov byte [0x42111c], al
mov al, cl
and al, 2
and cl, 4
push 0x421124
mov byte [0x42111d], al
mov byte [0x42111e], cl
call fcn.00406a2d
push 0x421108
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ebp, dword [esp + 0x18]
push eax
push ebp
jmp 0x40177b
push ebp
call fcn.00403745
push 1
mov esi, eax
call fcn.00403745
mov edi, eax
pop ecx
pop ecx
cmp dword [esp + 0x80], ebp
je 0x40235a
push str.HideWindow
call fcn.0040744b
pop ecx
push edi
push esi
cmp dword [esp + 0x8c], ebp
je 0x4017a9
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x401611.20
push ebp
call fcn.00403781
push 0x31
mov esi, eax
call fcn.00403781
push 0x22
mov dword [esp + 0x18], eax
call fcn.00403781
push 0x15
mov edi, eax
call fcn.00403781
push 0x411108
push 0xffffffffffffffec
call fcn.004068ba
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x40], eax
xor eax, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x54], ecx
cmp word [esi], bp
cmovne eax, esi
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
xor eax, eax
cmp word [edi], bp
mov dword [esp + 0x50], 0x4d4000
cmovne eax, edi
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
push eax
call fcn.0040793b
test eax, eax
jne 0x402416
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [esp + 0x1c]
push esi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.0040744b
add esp, 0x14
jmp 0x401a95
test byte [esp + 0x3c], 0x40
je 0x402430
push dword [esp + 0x70]
call fcn.00407111
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [esp + 0x18]
push esi
push str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.0040744b
jmp 0x401f9b
push ebp
call fcn.00403781
mov edi, eax
push edi
push str.Exec:_command__s_
call fcn.0040744b
pop ecx
pop ecx
push edi
push 0xffffffffffffffeb
call fcn.004068ba
push edi
call fcn.0040759b
mov ebx, dword [esp + 0x10]
mov ebp, eax
push edi
test ebp, ebp
je 0x4024b1
push str.Exec:_success____s__
call fcn.0040744b
cmp dword [esp + 0x88], 0
pop ecx
pop ecx
je 0x4024ab
push ebp
call fcn.00407111
cmp dword [esp + 0x7c], 0
jl 0x40249f
push eax
push esi
call fcn.004073b6
jmp 0x4024ab
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
mov dword [esp + 0x10], ebx
push ebp
jmp 0x402e78
push str.Exec:_failed_createprocess____s__
jmp 0x4019c7
push 2
call fcn.00403781
push eax
call fcn.00407366
mov ebp, eax
test ebp, ebp
je 0x4024df
push dword [ebp + 0x14]
push esi
call fcn.004073b6
push dword [ebp + 0x18]
jmp 0x40177a
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x401a95
push 0xffffffffffffffee
call fcn.00403781
lea ecx, [esp + 0x90]
mov dword [esp + 0x30], eax
push ecx
push eax
push 0xb
call fcn.0040782d
mov esi, eax
mov ecx, eax
call dword [0x40a2dc]
call esi
xor ecx, ecx
mov dword [esp + 0x20], eax
mov word [edi], cx
xor ebx, ebx
mov ecx, dword [esp + 0x24]
xor edx, edx
inc ebx
mov dword [esp + 0x10], ebx
mov word [ecx], dx
test eax, eax
je case.0x401611.20
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je case.0x401611.20
push 0xc
call fcn.0040782d
push 0xd
mov esi, eax
call fcn.0040782d
push dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 0x30], eax
push dword [esp + 0x24]
push ebp
push dword [esp + 0x3c]
call dword [0x40a2dc]
call esi
test eax, eax
je 0x4025d0
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push 0x40ab14
push dword [esp + 0x20]
call dword [0x40a2dc]
call esi
test eax, eax
je 0x4025d0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x84]
push dword [ecx + eax*4 + 8]
push edi
call fcn.004073b6
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x18]
push dword [eax + ecx*4 + 0xc]
push dword [esp + 0x28]
call fcn.004073b6
mov ebx, ebp
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x401611.20
xor esi, esi
inc esi
mov ebx, esi
mov dword [esp + 0x10], ebx
cmp dword [0x47b5c0], ebp
jl 0x402711
push 0xfffffffffffffff0
call fcn.00403781
mov edi, eax
push esi
mov dword [esp + 0x18], edi
call fcn.00403781
mov dword [esp + 0x30], eax
cmp dword [esp + 0x88], ebp
je 0x402625
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x402639
mov edi, dword [esp + 0x14]
push 8
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4026f7
push dword [esp + 0x30]
push edi
call fcn.00406e3a
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4026b1
mov ebx, ebp
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x80], ebx
je 0x402687
push 0x411108
push dword [esp + 0x84]
call fcn.004068ba
mov ebp, dword [esp + 0x18]
mov ecx, ebp
call dword [0x40a2dc]
call ebp
test eax, eax
je 0x4026cf
mov ebx, esi
mov dword [esp + 0x10], ebx
jmp 0x4026cf
mov eax, dword [esp + 0x1c]
push section..data
push 0x40d100
push section..ndata
push 0x2000
push eax
call dword [0x40a2dc]
mov ebp, dword [esp + 0x2c]
call ebp
add esp, 0x14
jmp 0x4026cf
mov ebp, dword [esp + 0x30]
push ebp
push 0xfffffffffffffff7
call fcn.004068ba
push dword [esp + 0x14]
push ebp
push 0x40ab18
call fcn.0040744b
add esp, 0xc
cmp dword [esp + 0x84], 0
jne case.0x401611.20
push edi
call fcn.00404660
test eax, eax
je case.0x401611.20
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x401611.20
push 0x411108
push 0xfffffffffffffff6
call fcn.004068ba
push dword [esp + 0x14]
push str.Error_registering_DLL:_Could_not_load__s
jmp 0x4019ce
push 0x411108
push 0xffffffffffffffe7
call fcn.004068ba
push str.Error_registering_DLL:_Could_not_initialize_OLE
jmp 0x4017ee
push 0xfffffffffffffff0
call fcn.00403781
push 0xffffffffffffffdf
mov dword [esp + 0x30], eax
call fcn.00403781
push 2
mov dword [esp + 0x18], eax
call fcn.00403781
push 0xffffffffffffffcd
mov dword [esp + 0x34], eax
call fcn.00403781
mov esi, eax
push 0x45
mov dword [esp + 0x20], esi
call fcn.00403781
mov ecx, dword [esp + 0x88]
mov edi, ecx
push dword [esp + 0x14]
mov dword [esp + 0x94], eax
mov ebx, ecx
mov eax, ecx
sar ebx, 0xc
and eax, 0x8000
sar ecx, 0x10
mov dword [esp + 0x24], eax
and edi, 0xfff
movzx eax, cx
and ebx, 7
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
call fcn.00407d5c
test eax, eax
jne 0x4027ab
push 0x21
call fcn.00403781
push dword [esp + 0x18]
push ebx
push edi
push esi
push dword [esp + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x44]
push str.CreateShortcut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
call fcn.0040744b
add esp, 0x20
lea eax, [esp + 0x10]
xor edi, edi
inc edi
push eax
push 0x40bd38
push edi
push ebp
push 0x40bd58
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x402920
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push 0x40bd48
push eax
mov esi, dword [eax]
mov esi, dword [esi]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov ebx, eax
test ebx, ebx
js 0x40290c
mov eax, dword [esp + 0x10]
push dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov ebx, eax
cmp dword [esp + 0x20], ebp
jne 0x40284f
mov eax, dword [esp + 0x10]
push 0x4d4000
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov edx, dword [esp + 0x28]
test edx, edx
je 0x40286c
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x3c]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov eax, dword [esp + 0x10]
push dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x34]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov edx, dword [esp + 0x1c]
cmp word [edx], bp
je 0x4028a6
mov eax, dword [esp + 0x10]
push dword [esp + 0x34]
push edx
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x44]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov eax, dword [esp + 0x10]
push dword [esp + 0x30]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x2c]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov eax, dword [esp + 0x10]
push dword [esp + 0x90]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x40a2dc]
call esi
test ebx, ebx
js 0x4028f8
mov eax, dword [esp + 0x24]
push edi
push dword [esp + 0x30]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov ebx, eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40a2dc]
call esi
mov eax, ebx
sar eax, 0x1f
and eax, 0xfffffffc
push 0x411108
sub eax, 0xc
push eax
call fcn.004068ba
shr ebx, 0x1f
jmp 0x401a98
push ebp
call fcn.00403781
push 0x11
mov esi, eax
call fcn.00403781
push 0x23
mov edi, eax
call fcn.00403781
push edi
push esi
push str.CopyFiles___s_____s_
mov dword [esp + 0x9c], eax
call fcn.0040744b
add esp, 0xc
push esi
call fcn.00407366
test eax, eax
jne 0x402983
push ebp
push 0xfffffffffffffff9
call fcn.004068ba
jmp 0x401a95
mov eax, dword [esp + 0x1c]
push esi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 2
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push edi
mov word [esi + eax*2 + 2], cx
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
mov ecx, dword [esp + 0x90]
mov ax, word [esp + 0x80]
push ecx
push ebp
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x5a], ecx
mov word [esp + 0x50], ax
call fcn.004068ba
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x401611.20
jmp 0x402976
cmp ecx, 0xbadf00d
jne 0x402003
inc dword [0x47b634]
jmp case.0x401611.20
push str._RM_
mov esi, 0x411108
mov dword [esp + 0x18], ebp
push esi
mov dword [esp + 0x20], ebp
call fcn.00407a7a
push esi
mov edi, 0x415108
push edi
call fcn.00407a7a
cmp dword [esp + 0x78], ebp
je 0x402a32
push ebp
call fcn.00403781
mov ebp, eax
cmp dword [esp + 0x7c], 0
je 0x402a44
push 0x11
call fcn.00403781
mov dword [esp + 0x14], eax
cmp dword [esp + 0x88], 0
je 0x402a59
push 0x22
call fcn.00403781
mov dword [esp + 0x18], eax
push 0xffffffffffffffcd
call fcn.00403781
mov esi, eax
push esi
push edi
push 0x411108
push 0x40d108
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.0040744b
add esp, 0x14
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x401a8d
push 1
mov dword [esp + 0x94], 0xa
call fcn.00403781
push 0x12
mov edi, eax
call fcn.00403781
push 0xffffffffffffffdd
mov esi, eax
call fcn.00403781
mov ebp, dword [esp + 0x18]
push eax
push 0x1fff
push ebp
lea eax, [esp + 0x9c]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
pop eax
cmp word [ebp], ax
jne case.0x401611.20
xor esi, esi
xor eax, eax
mov word [ebp], ax
lea ebx, [esi + 1]
mov dword [esp + 0x10], ebx
jmp case.0x401611.20
xor ebp, ebp
push edx
inc ebp
call fcn.004071cf
cmp dword [esp + 0x8c], 0
mov ebx, eax
pop ecx
jne 0x402b43
push 2
call fcn.00403804
mov edi, eax
test edi, edi
je 0x402b74
push 0x33
call fcn.00403781
mov esi, eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push 0x415108
push ebx
push str.DeleteRegValue:___s_s____s_
mov ebp, eax
call fcn.0040744b
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402b74
push 0x22
call fcn.00403781
mov esi, eax
push esi
push ebx
push str.DeleteRegKey:___s_s_
call fcn.0040744b
mov ecx, dword [esp + 0x94]
add esp, 0xc
sar ecx, 1
push ecx
push esi
push dword [esp + 0x98]
call fcn.004037bf
mov ebp, eax
xor ebx, ebx
test ebp, ebp
setne bl
jmp 0x401a98
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x8c]
push 2
mov dword [esp + 0x18], eax
call fcn.00403781
push 0x11
mov dword [esp + 0x28], eax
call fcn.00403781
mov edi, dword [esp + 0x34]
push edi
mov dword [esp + 0x20], eax
call fcn.004071cf
pop ecx
mov dword [esp + 0x28], eax
xor esi, esi
lea eax, [esp + 0x90]
inc esi
push eax
push 0x100022
push dword [esp + 0x24]
mov ebx, esi
push edi
mov dword [esp + 0x20], ebx
call fcn.00403766
push eax
call fcn.00406e8e
mov edi, dword [esp + 0x90]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
mov dword [esp + 0x18], edi
test edi, edi
je 0x402d43
mov ecx, dword [esp + 0x20]
mov edi, 0x415108
cmp ecx, esi
jne 0x402c4d
push 0x23
call fcn.00403781
push edi
call sub.KERNEL32.dll_lstrlenW
cmp dword [esp + 0x14], esi
mov esi, dword [esp + 0x1c]
push edi
push dword [esp + 0x28]
lea eax, [eax*2 + 2]
push esi
push dword [esp + 0x34]
mov dword [esp + 0x3c], eax
jne 0x402c46
push str.WriteRegStr:___s_s____s___s_
call fcn.0040744b
add esp, 0x14
jmp 0x402cfc
push str.WriteRegExpandStr:___s_s____s___s_
jmp 0x402c39
push 4
pop eax
mov dword [esp + 0x2c], eax
cmp ecx, eax
jne 0x402c81
push 3
call fcn.00403745
mov esi, dword [esp + 0x20]
push eax
push dword [esp + 0x2c]
mov dword [0x415108], eax
push esi
push dword [esp + 0x38]
push str.WriteRegDWORD:___s_s____s__0x_08x_
call fcn.0040744b
add esp, 0x18
jmp 0x402cfc
mov dword [esp + 0x2c], ebp
cmp ecx, 3
jne 0x402cf8
push 0xc000
push edi
push ebp
push dword [esp + 0x90]
call fcn.00403a29
push eax
push edi
mov dword [esp + 0x34], eax
lea eax, [esp + 0xa8]
push 0x80
push eax
call fcn.00407153
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xb0]
mov esi, dword [esp + 0x2c]
cmp edx, 7
push eax
push dword [esp + 0x38]
mov eax, str.WriteRegBin
mov ecx, str.WriteRegMultiStr
cmovne ecx, eax
mov eax, str.WriteRegNone
push esi
push dword [esp + 0x44]
test edx, edx
cmovne eax, ecx
push eax
push str._s:___s_s____s___s_
call fcn.0040744b
add esp, 0x28
jmp 0x402cfc
mov esi, dword [esp + 0x1c]
push dword [esp + 0x2c]
push edi
push dword [esp + 0x1c]
mov edi, dword [esp + 0x30]
push ebp
push edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402d21
mov ebx, ebp
mov dword [esp + 0x10], ebx
jmp 0x402d34
push edi
push esi
push dword [esp + 0x30]
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.0040744b
add esp, 0x10
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401611.20
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push str.WriteReg:_error_creating_key___s_s_
call fcn.0040744b
add esp, 0xc
jmp case.0x401611.20
push 0x20019
call fcn.00403804
push 0x33
mov esi, eax
call fcn.00403781
xor ecx, ecx
mov word [edi], cx
test esi, esi
je 0x401a95
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], 0x4000
push ecx
push edi
lea ecx, [esp + 0x1c]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x402de6
cmp dword [esp + 0x14], 4
je 0x402dcc
cmp dword [esp + 0x14], ecx
je 0x402dba
cmp dword [esp + 0x14], 2
jne 0x402de6
mov ebx, dword [esp + 0x88]
xor eax, eax
mov word [edi + 0x3ffe], ax
jmp 0x402ded
push dword [edi]
xor ebx, ebx
cmp dword [esp + 0x8c], ebx
push edi
sete bl
mov dword [esp + 0x18], ebx
call fcn.004073b6
jmp 0x402df1
xor eax, eax
mov ebx, ecx
mov word [edi], ax
mov dword [esp + 0x10], ebx
push esi
jmp 0x402d38
push 0x20019
call fcn.00403804
push 3
mov esi, eax
call fcn.00403745
mov ebx, dword [esp + 0x14]
pop ecx
xor ecx, ecx
mov word [edi], cx
test esi, esi
je 0x401a95
mov ecx, 0x1fff
mov dword [esp + 0x90], ecx
cmp dword [esp + 0x88], ebp
je 0x402e3d
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x402e5e
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0xa0]
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
mov dword [esp + 0x10], ebx
xor eax, eax
mov word [edi + 0x3ffe], ax
jmp 0x402df1
push edi
call fcn.00407b70
test eax, eax
je case.0x401611.20
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401611.20
push 0xffffffffffffffed
call fcn.00403781
push dword [esp + 0x80]
push dword [esp + 0x80]
push eax
call fcn.00407862
cmp eax, 0xffffffff
jne 0x401d93
xor eax, eax
mov word [edi], ax
jmp 0x401a95
mov ecx, dword [esp + 0x74]
xor eax, eax
mov edx, dword [esp + 0x80]
cmp ecx, 0x39
mov dword [esp + 0x90], edx
sete al
xor esi, esi
inc esi
mov dword [esp + 0x18], eax
test edx, edx
je 0x402eec
push esi
call fcn.00403745
mov word [0x411108], ax
mov eax, dword [esp + 0x1c]
xor eax, esi
pop ecx
inc eax
jmp 0x402f2b
cmp ecx, 0x39
jne 0x402f1c
push 0x21
call fcn.00403781
push 0x2000
push 0x411108
push 0x415108
call fcn.00407054
add esp, 0xc
push 0x411108
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x402f2b
push 0x11
call fcn.00403781
push eax
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov dword [esp + 0x14], eax
cmp word [edi], bp
je 0x402f74
push edi
call fcn.00407b70
mov edi, eax
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x90]
jne 0x402f5d
cmp dword [esp + 0x84], ebp
je 0x402f5d
push edi
push edi
call fcn.0040706f
test eax, eax
js 0x402f74
push dword [esp + 0x14]
push 0x411108
push edi
call fcn.00407953
test eax, eax
jne case.0x401611.20
mov ebx, esi
jmp 0x401a98
push 2
pop ecx
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x2c], ecx
call fcn.00403745
xor esi, esi
inc esi
pop ecx
cmp eax, esi
jl case.0x401611.20
mov ecx, 0x1fff
cmp eax, ecx
cmovg eax, ecx
mov dword [esp + 0x20], eax
cmp word [edi], bp
je 0x40311d
push edi
mov dword [esp + 0x34], ebp
call fcn.00407b70
mov ecx, eax
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x20], ebp
jbe 0x40311d
mov ebx, dword [esp + 0x24]
mov edi, ebp
mov dword [esp + 0x34], 0xd
cmp dword [esp + 0x74], 0x3a
jne 0x4030a7
push ebp
lea eax, [esp + 0x30]
push eax
push 2
pop eax
sub eax, dword [esp + 0x8c]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40311d
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x40311d
movzx eax, byte [esp + 0x10]
mov word [esp + 0x1c], ax
cmp dword [esp + 0x84], ebp
jne 0x403163
push esi
lea eax, [esp + 0x20]
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
push 8
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4030d4
mov ecx, dword [esp + 0x28]
mov edx, ecx
neg edx
sub dword [esp + 0x2c], 1
mov eax, 0xfffd
mov word [esp + 0x1c], ax
je 0x4030dd
push esi
dec ecx
inc edx
push ebp
push edx
push dword [esp + 0x20]
mov dword [esp + 0x38], ecx
mov dword [esp + 0xa0], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x1c]
push eax
push 8
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x90]
test eax, eax
je 0x403053
jmp 0x4030d4
cmp dword [esp + 0x84], ebp
jne 0x4030c3
test edi, edi
jne 0x4030c3
push ebp
push ecx
call fcn.0040706f
test eax, eax
js 0x40311d
mov ecx, dword [esp + 0x14]
push 2
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.0040788f
test eax, eax
je 0x40311d
mov ecx, dword [esp + 0x28]
mov ax, word [esp + 0x1c]
cmp dword [esp + 0x84], ebp
jne 0x403163
push 0xd
pop edx
cmp word [esp + 0x30], dx
push 0xa
pop edx
je 0x403134
cmp word [esp + 0x30], dx
je 0x403134
mov word [ebx + edi*2], ax
inc edi
movzx eax, ax
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
test ax, ax
je 0x40311d
mov ecx, dword [esp + 0x14]
cmp edi, dword [esp + 0x20]
jl 0x402fd7
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x24]
xor ebx, ebx
test ecx, ecx
mov word [eax + ecx*2], dx
jmp 0x401c40
cmp word [esp + 0x30], ax
je 0x403152
cmp ax, word [esp + 0x34]
je 0x403147
cmp ax, dx
jne 0x403152
mov word [ebx + edi*2], ax
inc edi
mov dword [esp + 0x18], edi
jmp 0x40311d
push esi
push ebp
neg ecx
push ecx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40311d
movzx eax, ax
push eax
push ebx
call fcn.004073b6
jmp 0x4035d8
cmp word [edi], bp
je case.0x401611.20
push 2
call fcn.00403745
pop ecx
push dword [esp + 0x84]
push ebp
push eax
push edi
call fcn.00407b70
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x7c], ebp
jl case.0x401611.20
push eax
push esi
jmp 0x40177b
push edi
call fcn.00407b70
test eax, eax
je case.0x401611.20
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x401611.20
push esi
call fcn.00407b70
test eax, eax
je 0x401a6e
lea ecx, [esp + 0xa0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x401a6e
jmp 0x403217
push 2
call fcn.00403781
lea ecx, [esp + 0xa0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x403210
xor eax, eax
mov word [esi], ax
jmp 0x402ea7
push eax
push esi
call fcn.004073b6
lea eax, [esp + 0xcc]
push eax
push edi
call fcn.00407a7a
jmp case.0x401611.20
push 0xfffffffffffffff0
call fcn.00403781
mov esi, eax
push esi
mov dword [esp + 0x94], esi
call fcn.00407d5c
test eax, eax
jne 0x40324b
push 0xffffffffffffffed
call fcn.00403781
push esi
call fcn.00407ae4
push 2
push 0x40000000
push esi
call fcn.00407862
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, 0xffffffff
je 0x40334d
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x80], ebp
je 0x403339
mov eax, dword [0x47b568]
push eax
push 0x40
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x403331
push ebp
call fcn.00403874
push dword [esp + 0x20]
push edi
call fcn.0040385e
push dword [esp + 0x80]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x34], edi
test edi, edi
je 0x403313
push dword [esp + 0x80]
push edi
push ebp
push dword [esp + 0x88]
call fcn.00403a29
cmp byte [edi], 0
je 0x403309
mov ebx, dword [esp + 0x14]
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebx
push eax
call fcn.00407579
add edi, esi
cmp byte [edi], 0
jne 0x4032e9
mov esi, dword [esp + 0x90]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push edi
push dword [esp + 0x20]
call fcn.00407953
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or eax, 0xffffffff
jmp 0x403335
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
push ebp
push ebp
push edi
push eax
call fcn.00403a29
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403352
mov ebp, 0xfffffd66
push esi
push ebp
push str.created_uninstaller:__d____s_
call fcn.0040744b
add esp, 0xc
push 0xfffffffffffffff3
pop edi
test ebp, ebp
jns 0x403379
push 0xffffffffffffffef
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
push 0x411108
push edi
jmp 0x4016a5
test ecx, ecx
je 0x4033c9
push edx
push str.settings_logging_to__d
call fcn.0040744b
mov eax, dword [esp + 0x84]
push eax
push str.logging_set_to__d
mov dword [0x46a4e0], eax
call fcn.0040744b
add esp, 0x10
cmp dword [esp + 0x7c], ebp
je 0x4033bd
call fcn.0040635c
jmp case.0x401611.20
push 1
call fcn.004074df
jmp case.0x401611.20
push 1
call fcn.00403781
push eax
push 0x40a8c8
jmp 0x4019ce
push ebp
call fcn.00403745
mov ebp, eax
pop ecx
cmp ebp, dword [0x47b58c]
jae 0x401a95
mov ecx, dword [esp + 0x80]
imul edi, ebp, 0x4018
add edi, dword [0x47b588]
test ecx, ecx
js 0x40341a
mov eax, dword [edi + ecx*4]
jne 0x4031a3
lea eax, [edi + 0x18]
push eax
push esi
jmp 0x403220
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x80], eax
je 0x403438
push 1
call fcn.00403745
pop ecx
mov ecx, eax
mov dword [esp + 0x7c], ecx
jmp 0x403453
push dword [esp + 0x88]
lea eax, [edi + 0x18]
push eax
call fcn.00406a2d
or dword [edi + 8], 0x100
mov ecx, dword [esp + 0x7c]
mov eax, dword [esp + 0x80]
mov dword [edi + eax*4], ecx
cmp dword [esp + 0x84], 0
je case.0x401611.20
push ebp
call fcn.00401243
jmp case.0x401611.20
push ebp
call fcn.00403745
mov edx, eax
pop ecx
cmp edx, 0x20
jae 0x401a95
cmp dword [esp + 0x84], ebp
je 0x4034b7
cmp dword [esp + 0x80], ebp
je 0x4034ac
push edx
call fcn.004012b2
push ebp
push ebp
call fcn.004012ff
jmp case.0x401611.20
push ebp
call fcn.004011c2
jmp 0x4031a3
mov eax, dword [0x47b570]
cmp dword [esp + 0x80], ebp
je 0x4034d5
mov ecx, dword [esp + 0x7c]
mov dword [eax + edx*4 + 0x94], ecx
jmp case.0x401611.20
push dword [eax + edx*4 + 0x94]
push esi
call fcn.00406a2d
jmp case.0x401611.20
mov eax, dword [esp + 0x84]
sub eax, ebp
je 0x40353c
sub eax, 1
jne case.0x401611.20
push 2
call fcn.00403745
push 4
mov esi, eax
call fcn.00403745
pop ecx
movzx edx, al
pop ecx
shr eax, 0x18
mov ecx, 0x47b620
test esi, esi
mov dword [esp + 0x20], ebp
push edx
cmovne ecx, esi
add eax, ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00407579
push dword [esp + 0x20]
push dword [esp + 0x28]
jmp 0x40177b
push 5
call fcn.0040782d
push 0x22
mov edi, eax
call fcn.00403781
test edi, edi
je 0x40359c
lea ecx, [esp + 0x90]
push ecx
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x40359c
lea eax, [esp + 0x20]
mov ecx, edi
push eax
push ebp
push dword [esp + 0x8c]
lea eax, [esp + 0x9c]
push eax
call dword [0x40a2dc]
call edi
test eax, eax
js 0x40359c
push dword [esp + 0x20]
push esi
call fcn.00407a7a
push dword [esp + 0x20]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp case.0x401611.20
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [esp + 0x10], ebx
mov word [esi], ax
jmp case.0x401611.20
and ecx, dword [0x43ed50]
push ebp
push ecx
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x78], ebp
je case.0x401611.20
mov eax, dword [esp + 0x1c]
push ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [esp + 0x10]
add dword [0x47b628], ebx
xor eax, eax
mov ecx, dword [esp + 0x2f0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408fb1
add esp, 0x2e4
ret 4