Function at 0x401534
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set current directory
Set file attributes
Set registry value

Disassembly:
sub esp, 0x1c4
push ebx
push ebp
mov edx, dword [0x7a2418]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1d4]
push edi
push 7
pop ecx
lea edi, [esp + 0x24]
mov dword [esp + 0x14], edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x28]
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov edi, ecx
shl eax, 0xa
mov dword [esp + 0x1c], eax
shl edi, 0xa
add edi, section..ndata
mov dword [esp + 0x10], ebx
lea ebp, [eax + section..ndata]
mov dword [esp + 0x50], ecx
lea eax, [esp + 0x28]
mov dword [0x40a0c4], eax
mov eax, dword [esp + 0x24]
dec eax
cmp eax, 0x42
ja case.0x40159b.5
jmp dword [eax*4 + 0x402bc8]
mov eax, esi
jmp 0x402bb8
push ebx
push esi
call fcn.00405a50
mov eax, 0x7fffffff
jmp 0x402bb8
inc dword [0x7a240c]
test edx, edx
je 0x4015b0
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4015b0
test esi, esi
jns 0x4015e7
mov eax, section..ndata
sub eax, dword [esp + 0x1c]
sub eax, 0x400
push eax
call fcn.004068ff
mov esi, eax
push ebx
lea eax, [esi - 1]
push eax
call fcn.004013d4
jmp 0x402bb8
push ebx
push esi
call fcn.00405a50
jmp case.0x40159b.5
push ebx
call fcn.00402d0c
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovg ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40159b.5
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x40159b.5
cmp dword [esp + 0x30], ebx
jne 0x401657
mov eax, dword [esi*4 + 0x7a2ce0]
push 1
mov dword [esi*4 + 0x7a2ca0], eax
call fcn.00402d0c
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x28]
mov dword [eax*4 + 0x7a2ce0], ecx
jmp case.0x40159b.5
mov eax, dword [esi*4 + 0x7a2ca0]
mov dword [esi*4 + 0x7a2ce0], eax
jmp case.0x40159b.5
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push 4
mov edx, dword [ecx*4 + 0x7a2ce0]
and eax, edx
mov dword [ecx*4 + 0x7a2ce0], eax
xor eax, eax
test edx, edx
pop ecx
cmove eax, ecx
mov eax, dword [esp + eax + 0x28]
jmp 0x402bb8
push dword [ecx*4 + 0x7a2ce0]
push ebp
call fcn.004062ab
jmp case.0x40159b.5
mov eax, dword [0x7a2404]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4016be
push ecx
push eax
call edi
mov esi, dword [esp + 0x28]
mov eax, dword [0x7a2408]
test eax, eax
je case.0x40159b.5
push esi
push eax
call edi
jmp case.0x40159b.5
push 0xfffffffffffffff0
call fcn.00402d2d
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne case.0x40159b.5
xor eax, eax
inc eax
jmp 0x402bb0
push 0xfffffffffffffff0
call fcn.00402d2d
mov edi, eax
push edi
call fcn.004068a2
mov esi, eax
test esi, esi
je 0x401763
push 0x5c
push esi
call fcn.00406287
mov esi, eax
mov al, byte [esi]
mov byte [esp + 0x14], al
mov byte [esi], bl
test al, al
jne 0x401738
cmp dword [esp + 0x30], ebx
je 0x401738
call fcn.00406174
test eax, eax
je 0x401738
push edi
call fcn.00405b55
jmp 0x40173e
push edi
call fcn.00405b35
test eax, eax
je 0x401758
cmp eax, 0xb7
jne 0x401754
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x401758
inc dword [esp + 0x10]
mov al, byte [esp + 0x14]
mov byte [esi], al
inc esi
test al, al
jne 0x40170b
push 0x40a4c8
cmp dword [esp + 0x30], ebx
je 0x401799
push 0xffffffffffffffe6
call fcn.00405a50
push edi
push 0x7a8800
call fcn.004067f7
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x402bb0
inc eax
jmp 0x402bb0
push 0xfffffffffffffff5
jmp 0x4015f8
push ebx
call fcn.00402d2d
push eax
call fcn.00406260
jmp 0x401e7a
push 0xffffffffffffffd0
call fcn.00402d2d
push 0xffffffffffffffdf
mov esi, eax
call fcn.00402d2d
push 0x13
mov edi, eax
call fcn.00402d2d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4017e2
push 0x40a4c8
push 0xffffffffffffffe3
jmp 0x4015f8
cmp dword [esp + 0x30], ebx
je 0x4016ee
push esi
call fcn.00406260
test eax, eax
je 0x4016ee
push edi
push esi
call fcn.00405f72
push 0x40a4c8
push 0xffffffffffffffe4
jmp 0x4015f8
push ebx
call fcn.00402d2d
mov esi, eax
mov ebp, 0x400
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x401837
xor eax, eax
mov byte [edi], bl
inc eax
mov dword [esp + 0x10], eax
jmp 0x40185e
mov eax, dword [esp + 0x18]
cmp eax, esi
jbe 0x40185a
cmp byte [eax], bl
je 0x40185a
push esi
call fcn.00406260
test eax, eax
je 0x40182c
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call fcn.004067f7
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x30], ebx
jne 0x402bb0
push ebp
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp case.0x40159b.5
push 0xffffffffffffffff
call fcn.00402d2d
lea ecx, [esp + 0x50]
push ecx
push ebp
push 0x400
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne case.0x40159b.5
xor eax, eax
inc eax
mov byte [ebp], bl
jmp 0x402bb0
push 0xffffffffffffffef
call fcn.00402d2d
push eax
push ebp
call fcn.0040673e
jmp 0x4016e6
push 0x31
call fcn.00402d2d
mov ebp, dword [esp + 0x28]
mov esi, eax
push esi
mov dword [esp + 0x1c], esi
and ebp, 7
call fcn.00406a7e
mov edi, 0x40a0c8
push esi
test eax, eax
je 0x4018e3
push edi
call fcn.004067f7
jmp 0x4018fa
push 0x7a8800
push edi
call fcn.004067f7
push eax
call fcn.004061e9
push eax
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.004069cc
xor esi, esi
inc esi
cmp ebp, 3
jl 0x401935
push edi
call fcn.00406260
mov ecx, ebx
test eax, eax
je 0x401925
lea ecx, [esp + 0x34]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
add ebp, 0xfffffffd
or ebp, 0x80000000
and ebp, ecx
neg ebp
sbb ebp, ebp
inc ebp
test ebp, ebp
jne 0x40193f
push edi
call fcn.0040687a
xor eax, eax
cmp ebp, esi
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.00406607
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x4019e7
test ebp, ebp
jne 0x4019ce
push section..ndata
push 0x40a8c8
call fcn.004067f7
push edi
push section..ndata
call fcn.004067f7
push dword [esp + 0x3c]
push 0x40a4c8
call fcn.00405bd1
push 0x40a8c8
push section..ndata
call fcn.004067f7
mov eax, dword [esp + 0x28]
sar eax, 3
push eax
push 0x40a4c8
call fcn.00406785
sub eax, 4
je 0x401903
sub eax, 1
je 0x4019c3
push edi
push 0xfffffffffffffffa
jmp 0x4015ab
inc dword [0x7a2ce8]
jmp 0x402bb6
mov esi, dword [esp + 0x18]
push esi
push 0xffffffffffffffe2
call fcn.00405a50
xor eax, eax
cmp ebp, 2
sete al
jmp 0x402bb0
mov esi, dword [esp + 0x18]
push esi
push 0xffffffffffffffea
call fcn.00405a50
mov ebp, dword [esp + 0x1c]
inc dword [0x7a2d14]
push ebx
push ebx
push ebp
push dword [esp + 0x3c]
call fcn.00402fba
dec dword [0x7a2d14]
cmp dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x401a21
cmp dword [esp + 0x38], 0xffffffff
je 0x401a2f
lea eax, [esp + 0x34]
push eax
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
jns case.0x40159b.5
cmp eax, 0xfffffffe
jne 0x401a58
push 0xffffffffffffffe9
push edi
call fcn.00405bd1
push esi
push edi
call sub.KERNEL32.dll_lstrcatA
jmp 0x401a60
push 0xffffffffffffffee
push edi
call fcn.00405bd1
push 0x200010
push edi
call fcn.00406785
jmp 0x4015b0
push ebx
call fcn.00402d2d
push dword [esp + 0x2c]
push eax
call fcn.004063b9
jmp case.0x40159b.5
push 0x31
call fcn.00402d2d
push dword [esp + 0x28]
push eax
call fcn.00406785
test eax, eax
je 0x4016ee
cmp eax, dword [esp + 0x30]
je 0x401bf3
cmp eax, dword [esp + 0x38]
jne case.0x40159b.5
mov eax, dword [esp + 0x3c]
jmp 0x402bb8
push 0xfffffffffffffff0
jmp 0x401a71
push 1
call fcn.00402d2d
push eax
call sub.KERNEL32.dll_lstrlenA
push eax
jmp 0x40169c
push 2
call fcn.00402d0c
push 3
mov edi, eax
mov esi, edx
call fcn.00402d0c
pop ecx
pop ecx
push 1
mov dword [esp + 0x20], eax
call fcn.00402d2d
push eax
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_lstrlenA
test esi, esi
mov byte [ebp], bl
cmove edi, eax
test edi, edi
je case.0x40159b.5
mov edx, dword [esp + 0x1c]
test edx, edx
lea ecx, [eax + edx]
cmovns ecx, edx
test ecx, ecx
js case.0x40159b.5
cmp ecx, eax
cmovg ecx, eax
mov eax, dword [esp + 0x18]
add eax, ecx
push eax
push ebp
call fcn.004067f7
test edi, edi
jns 0x401b3d
push ebp
call sub.KERNEL32.dll_lstrlenA
add edi, eax
xor eax, eax
test edi, edi
cmovns eax, edi
cmp eax, 0x400
jge case.0x40159b.5
mov byte [eax + ebp], bl
jmp case.0x40159b.5
push 0x20
call fcn.00402d2d
push 0x31
mov esi, eax
call fcn.00402d2d
push eax
push esi
cmp dword [esp + 0x40], ebx
jne 0x401b77
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x401b7d
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401bf3
mov eax, dword [esp + 0x30]
jmp 0x402bb8
xor esi, esi
inc esi
push esi
call fcn.00402d2d
push 0x400
mov edi, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x401bb8
cmp dword [esp + 0x30], ebx
je 0x401bbf
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401bbf
mov eax, esi
mov byte [ebp], bl
jmp 0x401bc3
mov eax, dword [esp + 0x10]
mov byte [ebp + 0x3ff], bl
jmp 0x402bb0
mov esi, dword [esp + 0x3c]
push ebx
call fcn.00402d0c
push 1
mov edi, eax
call fcn.00402d0c
pop ecx
pop ecx
test esi, esi
jne 0x401bef
cmp edi, eax
jl 0x401bf3
jle 0x401b81
jmp 0x401bfe
cmp edi, eax
jae 0x401bfc
mov eax, dword [esp + 0x34]
jmp 0x402bb8
jbe 0x401b81
mov eax, dword [esp + 0x38]
jmp 0x402bb8
xor esi, esi
inc esi
push esi
call fcn.00402d0c
push 2
mov dword [esp + 0x20], eax
mov edi, eax
call fcn.00402d0c
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x34]
cmp eax, 0xd
ja case.default.0x401c2e
jmp dword [eax*4 + 0x402cd4]
lea edx, [edi + ecx]
jmp 0x401cb3
mov edx, edi
sub edx, ecx
jmp 0x401cb3
mov edx, edi
imul edx, ecx
jmp 0x401cb3
test ecx, ecx
je 0x401c54
mov eax, edi
cdq
idiv ecx
mov edx, eax
jmp 0x401c56
mov edx, ebx
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
jmp 0x401cb3
mov edx, edi
or edx, ecx
jmp 0x401cb3
mov edx, edi
and edx, ecx
jmp 0x401cb3
mov edx, edi
xor edx, ecx
jmp 0x401cb3
xor edx, edx
test edi, edi
sete dl
jmp 0x401cb3
test edi, edi
jne 0x401c86
test ecx, ecx
je 0x401c8e
mov edx, esi
jmp 0x401cb3
test edi, edi
jne 0x401c82
mov edx, ebx
jmp 0x401cb3
test ecx, ecx
je 0x401c54
mov eax, edi
cdq
idiv ecx
jmp 0x401c56
mov edx, edi
shl edx, cl
jmp 0x401cb3
mov edx, edi
sar edx, cl
jmp 0x401cb3
mov edx, edi
shr edx, cl
jmp 0x401cb3
mov edx, dword [esp + 0x18]
push edx
jmp 0x40169c
push 1
call fcn.00402d2d
push 2
mov esi, eax
call fcn.00402d0c
push eax
push esi
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.0x40159b.5
mov eax, dword [esp + 0x30]
mov esi, dword [0x40a0c0]
test eax, eax
je 0x401d3c
dec eax
test esi, esi
je 0x401d29
mov esi, dword [esi]
test eax, eax
jne 0x401ce8
test esi, esi
je 0x401d29
add esi, 4
mov edi, 0x40a0c8
push esi
push edi
call fcn.004067f7
mov eax, dword [0x40a0c0]
add eax, 4
push eax
push esi
call fcn.004067f7
mov eax, dword [0x40a0c0]
push edi
add eax, 4
push eax
call fcn.004067f7
jmp case.0x40159b.5
push 0x200010
push 0xffffffffffffffe8
push ebx
call fcn.00405bd1
push eax
jmp 0x401a66
test ecx, ecx
je 0x401d65
test esi, esi
je 0x4016ee
lea eax, [esi + 4]
push eax
push ebp
call fcn.004067f7
mov eax, dword [esi]
mov dword [0x40a0c0], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x40159b.5
push 0x404
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [esp + 0x28]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.00405bd1
mov eax, dword [0x40a0c0]
mov dword [esi], eax
mov dword [0x40a0c0], esi
jmp case.0x40159b.5
push 3
call fcn.00402d0c
mov esi, eax
push 4
mov dword [esp + 0x20], esi
call fcn.00402d0c
mov edi, eax
mov eax, dword [esp + 0x44]
pop ecx
pop ecx
test al, 1
je 0x401dc4
push 0x33
call fcn.00402d2d
mov esi, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
test al, 2
je 0x401dd1
push 0x44
call fcn.00402d2d
mov edi, eax
cmp dword [esp + 0x24], 0x21
push 1
jne 0x401e29
call fcn.00402d0c
push 2
mov dword [esp + 0x20], eax
call fcn.00402d0c
pop ecx
pop ecx
mov ecx, dword [esp + 0x3c]
sar ecx, 2
test ecx, ecx
je 0x401e1a
lea edx, [esp + 0x14]
push edx
push ecx
push ebx
push edi
push esi
push eax
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov ecx, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
jmp 0x401e5c
push edi
push esi
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x401e52
call fcn.00402d2d
push 0x12
mov esi, eax
call fcn.00402d2d
xor ecx, ecx
cmp byte [eax], cl
cmovne ecx, eax
push ecx
xor ecx, ecx
cmp byte [esi], cl
cmovne ecx, esi
push ecx
push edi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x28], ebx
jl 0x402bb0
push ecx
jmp 0x40169c
push ebx
call fcn.00402d0c
pop ecx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401b81
mov eax, dword [esp + 0x2c]
jmp 0x402bb8
push 2
call fcn.00402d0c
push 1
mov esi, eax
call fcn.00402d0c
pop ecx
pop ecx
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401acc
mov esi, dword [0x7a2c68]
push ebx
add esi, ecx
call fcn.00402d0c
pop ecx
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x40159b.5
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x50]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x30]
mov ecx, edx
imul ecx, dword [esp + 0x5c]
imul edx, dword [esp + 0x58]
push 0x10
push ecx
push edx
push ebx
push ebx
call fcn.00402d2d
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push ebx
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je case.0x40159b.5
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x40159b.5
push edx
call dword [sym.imp.USER32.dll_GetDC]
push 2
mov edi, eax
call fcn.00402d0c
pop ecx
push 0x48
push 0x5a
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x40b4c8], eax
mov eax, dword [esp + 0x14]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
call fcn.00402d0c
pop ecx
mov ecx, dword [esp + 0x38]
push dword [esp + 0x2c]
mov dword [0x40b4d8], eax
mov al, cl
and al, 1
mov byte [0x40b4df], 1
mov byte [0x40b4dc], al
mov al, cl
and al, 2
and cl, 4
push 0x40b4e4
mov byte [0x40b4dd], al
mov byte [0x40b4de], cl
call fcn.00405bd1
push 0x40b4c8
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x401acc
push ebx
call fcn.00402d0c
push 1
mov esi, eax
call fcn.00402d0c
pop ecx
pop ecx
push eax
push esi
cmp dword [esp + 0x3c], ebx
jne 0x401fd1
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x40159b.5
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x40159b.5
push ebx
call fcn.00402d2d
push 0x31
mov ebx, eax
call fcn.00402d2d
push 0x22
mov esi, eax
call fcn.00402d2d
push 0x15
mov edi, eax
call fcn.00402d2d
push 0x40a4c8
push 0xffffffffffffffec
call fcn.00405a50
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x6c], ecx
cmp byte [ebx], al
mov dword [esp + 0x60], esi
cmovne eax, ebx
mov dword [esp + 0x5c], eax
xor eax, eax
cmp byte [edi], al
mov dword [esp + 0x68], 0x7a8800
cmovne eax, edi
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
push eax
call fcn.004066db
test eax, eax
je 0x4016ee
test byte [esp + 0x54], 0x40
je case.0x40159b.5
push dword [esp + 0x88]
call fcn.0040618c
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40159b.5
push ebx
call fcn.00402d2d
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.00405a50
push esi
call fcn.00406376
mov esi, eax
test esi, esi
je 0x4016ee
cmp dword [esp + 0x30], ebx
je 0x4020cb
push esi
call fcn.0040618c
mov ecx, eax
cmp dword [esp + 0x2c], ebx
jl 0x4020bb
push ecx
push edi
call fcn.004062ab
jmp 0x4020cb
mov eax, dword [esp + 0x10]
xor edx, edx
inc edx
test ecx, ecx
cmovne eax, edx
mov dword [esp + 0x10], eax
push esi
jmp 0x402073
push 2
call fcn.00402d2d
push eax
call fcn.00406260
mov esi, eax
test esi, esi
je 0x4020f2
push dword [esi + 0x14]
push edi
call fcn.004062ab
push dword [esi + 0x18]
jmp 0x40169c
mov byte [ebp], bl
mov byte [edi], bl
jmp 0x4016ee
push 0xffffffffffffffee
call fcn.00402d2d
lea ecx, [esp + 0x50]
mov dword [esp + 0x44], eax
push ecx
push eax
push 9
call fcn.004065d2
call eax
mov ecx, eax
mov byte [ebp], bl
xor eax, eax
mov dword [esp + 0x1c], ecx
inc eax
mov byte [edi], bl
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x402bb0
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je case.0x40159b.5
push 0xa
call fcn.004065d2
push 0xb
mov esi, eax
call fcn.004065d2
push dword [esp + 0x14]
mov dword [esp + 0x4c], eax
push dword [esp + 0x20]
push ebx
push dword [esp + 0x50]
call esi
test eax, eax
je 0x4021a5
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x4082a0
push dword [esp + 0x20]
call dword [esp + 0x58]
test eax, eax
je 0x4021a5
mov eax, dword [esp + 0x18]
push dword [eax + 8]
push ebp
call fcn.004062ab
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push edi
call fcn.004062ab
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
jmp 0x401d5a
xor ebp, ebp
inc ebp
mov dword [esp + 0x10], ebp
cmp dword [0x7a2c80], ebx
jl 0x402297
push 0xfffffffffffffff0
call fcn.00402d2d
mov esi, eax
push ebp
mov dword [esp + 0x4c], esi
call fcn.00402d2d
mov edi, eax
mov dword [esp + 0x44], edi
cmp dword [esp + 0x38], ebx
je 0x4021f1
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x402205
mov esi, dword [esp + 0x48]
push 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x40228b
push edi
push esi
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
test edi, edi
je 0x402258
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x30], ebx
je 0x402238
push 0x40a4c8
push dword [esp + 0x34]
call fcn.00405a50
call edi
test eax, eax
je 0x402263
mov eax, ebp
mov dword [esp + 0x10], eax
jmp 0x402267
mov eax, dword [esp + 0x14]
push section..data
push 0x40a0c0
push section..ndata
push 0x400
push eax
call edi
add esp, 0x14
jmp 0x402263
push dword [esp + 0x44]
push 0xfffffffffffffff7
call fcn.00405a50
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x34], ebx
jne 0x402bb0
push esi
call fcn.004039cc
test eax, eax
je case.0x40159b.5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x40159b.5
push 0x40a4c8
push 0xfffffffffffffff6
jmp 0x4015f8
push 0x40a4c8
push 0xffffffffffffffe7
jmp 0x4015f8
push 0xfffffffffffffff0
call fcn.00402d2d
push 0xffffffffffffffdf
mov dword [esp + 0x54], eax
call fcn.00402d2d
push 2
mov esi, eax
call fcn.00402d2d
push 0xffffffffffffffcd
mov dword [esp + 0x50], eax
call fcn.00402d2d
push 0x45
mov dword [esp + 0x20], eax
call fcn.00402d2d
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x38]
mov ecx, eax
and ecx, 0xfff
mov edi, eax
mov dword [esp + 0x8c], ecx
mov ecx, eax
and ecx, 0x8000
sar eax, 0x10
sar edi, 0xc
push esi
mov dword [esp + 0x4c], ecx
and edi, 7
mov dword [esp + 0x48], eax
call fcn.00406a7e
test eax, eax
jne 0x402317
push 0x21
call fcn.00402d2d
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 0x408748
inc ebp
push ebp
push ebx
push 0x408768
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402421
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x408758
push eax
mov ecx, dword [eax]
call dword [ecx]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402413
mov eax, dword [esp + 0x14]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x48], ebx
jne 0x402380
mov eax, dword [esp + 0x14]
push 0x7a8800
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test edi, edi
je 0x40238f
mov eax, dword [esp + 0x14]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x14]
push dword [esp + 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [esp + 0x1c]
cmp byte [edx], bl
je 0x4023b7
mov eax, dword [esp + 0x14]
push dword [esp + 0x8c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x14]
push dword [esp + 0x4c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x14]
push dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [esp + 0x10], ebx
jl 0x402409
push 0x400
push esi
push 0xffffffffffffffff
push dword [esp + 0x5c]
mov dword [esp + 0x20], 0x80004005
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x402409
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
sar eax, 0x1f
and eax, 0xfffffffc
sub eax, 0xc
push 0x40a4c8
push eax
call fcn.00405a50
mov eax, dword [esp + 0x10]
shr eax, 0x1f
jmp 0x402bb0
push ebx
call fcn.00402d2d
push 0x11
mov esi, eax
call fcn.00402d2d
push 0x23
mov edi, eax
call fcn.00402d2d
push esi
mov ebp, eax
call fcn.00406260
test eax, eax
jne 0x402472
push ebx
push 0xfffffffffffffff9
call fcn.00405a50
jmp 0x4016ee
mov eax, dword [esp + 0x14]
push esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 2
call sub.KERNEL32.dll_lstrlenA
push edi
mov byte [eax + esi + 1], bl
call sub.KERNEL32.dll_lstrlenA
push ebp
push ebx
mov byte [eax + edi + 1], bl
mov ax, word [esp + 0x38]
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], edi
mov dword [esp + 0x72], ebp
mov word [esp + 0x68], ax
call fcn.00405a50
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je case.0x40159b.5
jmp 0x402465
cmp esi, 0xbadf00d
jne 0x401d29
inc dword [0x7a2cf4]
jmp case.0x40159b.5
mov edi, ebx
mov ebp, ebx
test esi, esi
je 0x4024f3
push ebx
call fcn.00402d2d
mov ecx, dword [esp + 0x2c]
mov ebx, eax
test ecx, ecx
je 0x402500
push 0x11
call fcn.00402d2d
mov edi, eax
cmp dword [esp + 0x38], ebp
je 0x40250f
push 0x22
call fcn.00402d2d
mov ebp, eax
push 0xffffffffffffffcd
call fcn.00402d2d
push eax
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4016e6
push 0xa
pop eax
push 1
mov word [esp + 0x18], ax
call fcn.00402d2d
push 0x12
mov edi, eax
call fcn.00402d2d
push 0xffffffffffffffdd
mov esi, eax
call fcn.00402d2d
push eax
push 0x3ff
push ebp
lea eax, [esp + 0x20]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp], 0xa
jne case.0x40159b.5
xor esi, esi
lea eax, [esi + 1]
jmp 0x40189c
xor edi, edi
inc edi
cmp dword [esp + 0x38], ebx
jne 0x40259e
push 2
call fcn.00402dba
mov esi, eax
test esi, esi
je 0x4025b8
push 0x33
call fcn.00402d2d
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4025b8
push 0x22
call fcn.00402d2d
mov ecx, dword [esp + 0x38]
sar ecx, 1
push ecx
push eax
push dword [esp + 0x58]
call fcn.00402d6b
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x402bb0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
push 2
mov dword [esp + 0x44], eax
call fcn.00402d2d
push 0x11
mov dword [esp + 0x50], eax
call fcn.00402d2d
xor ebp, ebp
mov ecx, eax
inc ebp
mov dword [esp + 0x10], ebp
test esi, esi
js 0x4025ff
add esi, 0x80000001
add esi, dword [0x7a2ce4]
lea eax, [esp + 0x50]
push eax
push 0x100022
push ecx
push esi
call fcn.00405fa4
mov edi, dword [esp + 0x50]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
test edi, edi
je case.0x40159b.5
mov eax, ebx
mov esi, 0x40a8c8
cmp dword [esp + 0x18], ebp
jne 0x40263e
push 0x23
call fcn.00402d2d
push esi
call sub.KERNEL32.dll_lstrlenA
inc eax
mov ebp, dword [esp + 0x18]
cmp ebp, 4
jne 0x402656
push 3
call fcn.00402d0c
pop ecx
push ebp
mov dword [0x40a8c8], eax
pop eax
cmp ebp, 3
jne 0x40266b
push 0xc00
push esi
push ebx
push dword [esp + 0x40]
call fcn.00402fba
push eax
push esi
push dword [esp + 0x48]
push ebx
push dword [esp + 0x5c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
push edi
sbb eax, eax
and dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40159b.5
push 0x20019
call fcn.00402dba
push 0x33
mov esi, eax
call fcn.00402d2d
mov byte [ebp], bl
test esi, esi
je 0x4016ee
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0x400
push ecx
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x40270e
cmp dword [esp + 0x14], 4
je 0x4026f6
cmp dword [esp + 0x14], ecx
je 0x4026e6
cmp dword [esp + 0x14], 2
jne 0x40270e
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov byte [ebp + 0x3ff], bl
jmp 0x402715
push dword [ebp]
xor eax, eax
cmp dword [esp + 0x3c], eax
push ebp
sete al
mov dword [esp + 0x18], eax
call fcn.004062ab
jmp 0x402715
mov byte [ebp], bl
mov dword [esp + 0x10], ecx
push esi
jmp 0x402686
push 0x20019
call fcn.00402dba
push 3
mov esi, eax
call fcn.00402d0c
mov dword [esp + 0x58], edx
mov byte [ebp], bl
pop ecx
test esi, esi
je 0x4016ee
mov ecx, 0x3ff
mov dword [esp + 0x50], ecx
cmp dword [esp + 0x38], ebx
je 0x402759
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x4026ee
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x60]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
test eax, eax
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x4026ee
push ebp
call fcn.004068ff
test eax, eax
je case.0x40159b.5
push eax
jmp 0x402073
push 0xffffffffffffffed
call fcn.00402d2d
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
call fcn.00406607
cmp eax, 0xffffffff
jne 0x401acc
mov byte [ebp], bl
jmp 0x4016ee
xor ebx, ebx
inc ebx
cmp dword [esp + 0x30], 0
je 0x4027d4
push ebx
call fcn.00402d0c
pop ecx
mov byte [0x40a4c8], al
mov esi, ebx
jmp 0x4027e3
push 0x11
call fcn.00402d2d
push eax
call sub.KERNEL32.dll_lstrlenA
mov esi, eax
cmp byte [ebp], 0
je 0x402803
push ebp
call fcn.004068ff
push esi
push 0x40a4c8
push eax
call fcn.004066f3
test eax, eax
jne case.0x40159b.5
mov eax, ebx
jmp 0x402bb0
push 2
mov dword [esp + 0x1c], ebx
call fcn.00402d0c
xor esi, esi
inc esi
pop ecx
cmp eax, esi
jl case.0x40159b.5
mov ecx, 0x3ff
cmp eax, ecx
cmovg eax, ecx
mov dword [esp + 0x10], eax
cmp byte [ebp], bl
je 0x40288a
push ebp
mov byte [esp + 0x18], bl
call fcn.004068ff
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], ebx
jle 0x40288a
mov ebp, ebx
push esi
lea ecx, [esp + 0x27]
push ecx
push eax
call fcn.00406634
test eax, eax
je 0x40288a
cmp dword [esp + 0x34], ebx
jne 0x4028c6
mov al, byte [esp + 0x14]
cmp al, 0xd
je 0x40289a
cmp al, 0xa
je 0x40289a
mov al, byte [esp + 0x23]
mov byte [edi + ebp], al
inc ebp
mov byte [esp + 0x14], al
mov dword [esp + 0x18], ebp
test al, al
je 0x40288a
mov eax, dword [esp + 0x1c]
cmp ebp, dword [esp + 0x10]
jl 0x40284a
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
mov byte [ecx + edi], bl
jmp 0x4019df
mov cl, byte [esp + 0x23]
cmp al, cl
je 0x4028b6
cmp cl, 0xd
je 0x4028ac
cmp cl, 0xa
jne 0x4028b6
mov byte [edi + ebp], cl
inc ebp
mov dword [esp + 0x18], ebp
jmp 0x40288a
push esi
push ebx
push 0xffffffffffffffff
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40288a
movzx eax, byte [esp + 0x23]
push eax
push edi
call fcn.004062ab
jmp 0x402bb6
cmp byte [ebp], bl
je case.0x40159b.5
push 2
call fcn.00402d0c
pop ecx
push dword [esp + 0x34]
push ebx
push eax
push ebp
call fcn.004068ff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x2c], ebx
jl case.0x40159b.5
push eax
push edi
jmp 0x40169d
push ebp
call fcn.004068ff
test eax, eax
je case.0x40159b.5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x40159b.5
push edi
call fcn.004068ff
test eax, eax
je 0x401899
lea ecx, [esp + 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401899
lea eax, [esp + 0xc0]
push eax
push ebp
jmp 0x401d1f
push 2
call fcn.00402d2d
lea ecx, [esp + 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40297b
mov byte [edi], bl
jmp 0x4027b2
push eax
push edi
call fcn.004062ab
jmp 0x40294b
push 0xfffffffffffffff0
mov dword [esp + 0x14], 0xfffffd66
call fcn.00402d2d
mov ebp, eax
push ebp
mov dword [esp + 0x54], ebp
call fcn.00406a7e
test eax, eax
jne 0x4029aa
push 0xffffffffffffffed
call fcn.00402d2d
push ebp
call fcn.0040687a
push 2
push 0x40000000
push ebp
call fcn.00406607
mov edi, eax
mov dword [esp + 0x4c], edi
cmp edi, 0xffffffff
je 0x402a84
mov eax, dword [0x7a2c2c]
push eax
push 0x40
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x402a75
push ebx
call fcn.00402e19
push dword [esp + 0x18]
push esi
call fcn.00402e03
push dword [esp + 0x30]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x40], edi
test edi, edi
je 0x402a51
push dword [esp + 0x30]
push edi
push ebx
push dword [esp + 0x38]
call fcn.00402fba
cmp byte [edi], bl
je 0x402a47
mov ebp, esi
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebp
push eax
call fcn.00406354
add edi, esi
cmp byte [edi], bl
jne 0x402a27
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x1c]
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x18]
mov edi, dword [esp + 0x50]
push esi
push edi
call fcn.004066f3
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push ebx
push edi
push 0xffffffffffffffff
call fcn.00402fba
mov dword [esp + 0x10], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x402a8f
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
sar eax, 0x1f
and eax, 0xfffffffc
sub eax, 0xd
jmp 0x40242a
push ebx
call fcn.00402d0c
mov ebx, eax
pop ecx
cmp ebx, dword [0x7a2c4c]
jae 0x4016ee
mov ecx, dword [esp + 0x30]
imul esi, ebx, 0x418
add esi, dword [0x7a2c48]
test ecx, ecx
js 0x402ad9
mov eax, dword [esi + ecx*4]
jne 0x402905
lea eax, [esi + 0x18]
push eax
push edi
jmp 0x401d1f
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x30], eax
je 0x402af4
push 1
call fcn.00402d0c
pop ecx
mov ecx, eax
mov dword [esp + 0x2c], ecx
jmp 0x402b0c
push dword [esp + 0x38]
lea eax, [esi + 0x18]
push eax
call fcn.00405bd1
or dword [esi + 8], 0x100
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi + eax*4], ecx
cmp dword [esp + 0x34], 0
je case.0x40159b.5
push ebx
call fcn.00401249
jmp case.0x40159b.5
push ebx
call fcn.00402d0c
mov esi, eax
pop ecx
cmp esi, 0x20
jae 0x4016ee
cmp dword [esp + 0x34], ebx
je 0x402b61
cmp dword [esp + 0x30], ebx
je 0x402b56
push esi
call fcn.004012b8
push ebx
push ebx
call fcn.00401305
jmp case.0x40159b.5
push ebx
call fcn.004011c8
jmp 0x402905
mov eax, dword [0x7a2c34]
cmp dword [esp + 0x30], ebx
je 0x402b79
mov ecx, dword [esp + 0x2c]
mov dword [eax + esi*4 + 0x94], ecx
jmp case.0x40159b.5
push dword [eax + esi*4 + 0x94]
push edi
call fcn.00405bd1
jmp case.0x40159b.5
and esi, dword [0x79e1f8]
push ebx
push esi
push 0xb
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x28], ebx
je case.0x40159b.5
mov eax, dword [esp + 0x14]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0x10]
add dword [0x7a2ce8], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c4
ret 4