Function at 0x40164b
Capabilities:
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x2c]
sub esp, 0x224
mov eax, dword [0x424d20]
mov esi, dword [ebp + 8]
cld
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1ec], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 0xa
lea edi, [eax + section..ndata]
mov eax, edx
shl eax, 0xa
lea esi, [eax + section..ndata]
lea eax, [ebp - 0x28]
mov dword [0x40cc50], eax
mov eax, dword [ebp - 0x2c]
sub eax, 2
cmp eax, 0x41
ja case.0x4016ad.65
jmp dword [eax*4 + 0x4016b4]
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
push 0
push dword [ebp - 0x28]
call fcn.0040559d
mov eax, 0x7fffffff
jmp 0x4017be
inc dword [0x425540]
cmp dword [ebp - 0x1e8], 0
je 0x4017d2
push 0
call sub.USER32.dll_PostQuitMessage
jmp 0x4017d2
push dword [ebp - 0x28]
call fcn.004013e0
dec eax
push 0
push eax
call fcn.00401403
jmp 0x4017be
cmp dword [ebp - 0x20], 0
je 0x401824
mov eax, dword [0x40a00c]
mov dword [0x40a03c], eax
mov edx, dword [ebp - 0x1ec]
add dword [0x424c38], edx
xor eax, eax
jmp 0x4017be
test edx, edx
je 0x40183a
mov eax, dword [0x40a03c]
mov dword [0x40a03c], edx
mov dword [0x40a00c], eax
jmp case.0x4016ad.65
push 0
push dword [ebp - 0x28]
call fcn.0040559d
jmp case.0x4016ad.65
push 0
call fcn.004014c3
cmp eax, 1
jl 0x40185a
push eax
call sub.KERNEL32.dll_Sleep
jmp case.0x4016ad.65
mov eax, 1
jmp 0x401852
push dword [ebp - 0x1e8]
call sub.USER32.dll_SetForegroundWindow
jmp case.0x4016ad.65
mov eax, dword [0x425550]
test eax, eax
jne 0x40188b
mov eax, dword [0x425560]
test eax, eax
je case.0x4016ad.65
push dword [ebp - 0x28]
push eax
call sub.USER32.dll_ShowWindow
jmp case.0x4016ad.65
push dword [ebp - 0x24]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x401877
push 0xfffffffffffffff0
call fcn.004014e2
push dword [ebp - 0x24]
push eax
call sub.KERNEL32.dll_SetFileAttributesA
test eax, eax
jne case.0x4016ad.65
mov dword [ebp - 0x1ec], 1
jmp case.0x4016ad.65
push 0xfffffffffffffff0
call fcn.004014e2
mov esi, eax
push eax
call fcn.0040625d
mov ebx, eax
test eax, eax
je 0x401900
push 0x5c
push ebx
call fcn.004061d9
mov ebx, eax
mov dl, byte [eax]
mov byte [ebp - 0x1ed], dl
mov byte [eax], 0
push 0
push esi
call sub.KERNEL32.dll_CreateDirectoryA
test eax, eax
je 0x40192f
mov al, byte [ebp - 0x1ed]
mov byte [ebx], al
inc ebx
test al, al
jne 0x4018d2
cmp dword [ebp - 0x24], 0
je 0x401923
push 0xffffffffffffffe6
call fcn.004014af
push esi
push 0x42d800
call fcn.0040678e
push esi
call sub.KERNEL32.dll_SetCurrentDirectoryA
jmp case.0x4016ad.65
push 0xfffffffffffffff5
call fcn.004014af
jmp case.0x4016ad.65
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x401943
inc dword [ebp - 0x1ec]
jmp 0x4018f3
push esi
call sub.KERNEL32.dll_GetFileAttributesA
and eax, 0x10
jne 0x4018f3
jmp 0x40193b
push 0
call fcn.004014e2
push eax
call fcn.00406b8f
test eax, eax
je 0x401969
mov eax, dword [ebp - 0x24]
jmp 0x4017be
mov eax, dword [ebp - 0x20]
jmp 0x4017be
push 1
call fcn.004014c3
mov edx, dword [ebp - 0x28]
mov dword [edx*4 + 0x424c30], eax
jmp case.0x4016ad.65
mov ebx, dword [ebp - 0x20]
mov ecx, 0x424c30
xor eax, eax
mov edx, dword [ecx + ebx*4]
test edx, edx
sete al
and edx, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ecx + ebx*4], edx
jmp 0x4017be
push dword [edx*4 + 0x424c30]
push edi
call fcn.004066c9
jmp case.0x4016ad.65
push 0xffffffffffffffd0
call fcn.004014e2
mov ebx, eax
push 0xffffffffffffffdf
call fcn.004014e2
mov esi, eax
push 0x13
call fcn.004014e2
push esi
push ebx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x401a04
cmp dword [ebp - 0x20], 0
je 0x4018ae
push ebx
call fcn.00406b8f
test eax, eax
je 0x4018ae
push esi
push ebx
call fcn.00406496
push 0xffffffffffffffe4
jmp 0x401925
push 0xffffffffffffffe3
jmp 0x401925
push 0
call fcn.004014e2
mov ebx, eax
lea eax, [ebp - 0x1a0]
push eax
push esi
push 0x400
push ebx
call sub.KERNEL32.dll_GetFullPathNameA
test eax, eax
je 0x401a70
mov eax, dword [ebp - 0x1a0]
cmp eax, ebx
jbe 0x401a3a
cmp byte [eax], 0
jne 0x401a55
cmp dword [ebp - 0x20], 0
jne case.0x4016ad.65
push 0x400
push esi
push esi
call sub.KERNEL32.dll_GetShortPathNameA
jmp case.0x4016ad.65
push ebx
call fcn.00406b8f
test eax, eax
je 0x401a70
add eax, 0x2c
push eax
push dword [ebp - 0x1a0]
call fcn.0040678e
jmp 0x401a3a
mov dword [ebp - 0x1ec], 1
mov byte [esi], 0
jmp 0x401a3a
push 0xffffffffffffffff
call fcn.004014e2
lea edx, [ebp - 0x1a4]
push edx
push edi
push 0x400
push 0
push eax
push 0
call sub.KERNEL32.dll_SearchPathA
test eax, eax
jne case.0x4016ad.65
mov dword [ebp - 0x1ec], 1
mov byte [edi], 0
jmp case.0x4016ad.65
push 0xffffffffffffffef
call fcn.004014e2
push eax
push edi
call fcn.0040642a
jmp 0x4018a6
push 0x31
call fcn.004014e2
mov esi, dword [ebp - 0x28]
mov edi, eax
and esi, 7
push eax
call fcn.0040622f
test eax, eax
je 0x401c84
push edi
push 0x40b850
call fcn.0040678e
push 0x40b850
call fcn.00406ad3
cmp esi, 2
jg 0x401c4e
test esi, esi
je 0x401c3f
xor eax, eax
cmp esi, 1
setne al
inc eax
push eax
push 0x40000000
push 0x40b850
call fcn.004063fa
mov ebx, eax
cmp eax, 0xffffffff
jne 0x401bb5
test esi, esi
jne 0x401ba5
push section..ndata
push 0x40c050
call fcn.0040678e
push 0x40b850
push section..ndata
call fcn.0040678e
push dword [ebp - 0x14]
push 0x40bc50
call fcn.0040683a
push 0x40c050
push section..ndata
call fcn.0040678e
mov eax, dword [ebp - 0x28]
sar eax, 3
push eax
push 0x40bc50
call fcn.00405f1e
cmp eax, 4
je 0x401afc
cmp eax, 5
je 0x401b9a
push 0x40b850
push 0xfffffffffffffffa
jmp 0x4017cd
inc dword [0x424c38]
jmp 0x401820
push edi
push 0xffffffffffffffe2
call fcn.0040559d
cmp esi, 2
jmp 0x4018a8
push edi
push 0xffffffffffffffea
call fcn.0040559d
inc dword [0x40a03c]
push 0
push 0
push ebx
push dword [ebp - 0x20]
call fcn.004036e5
dec dword [0x40a03c]
mov esi, eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x401c37
lea eax, [ebp - 0x1c]
push eax
push 0
push eax
push ebx
call sub.KERNEL32.dll_SetFileTime
push ebx
call sub.KERNEL32.dll_CloseHandle
test esi, esi
jns case.0x4016ad.65
cmp esi, 0xfffffffe
je 0x401c1e
push 0xffffffffffffffee
push 0x40b850
call fcn.0040683a
push 0x200010
push 0x40b850
call fcn.00405f1e
jmp 0x4017d2
push 0xffffffffffffffe9
push 0x40b850
call fcn.0040683a
push edi
push 0x40b850
call fcn.004067ae
jmp 0x401c0a
cmp dword [ebp - 0x18], 0xffffffff
jne 0x401bde
jmp 0x401beb
push 0x40b850
call fcn.004063d7
jmp 0x401b0d
push 0x40b850
call fcn.00406b8f
xor ecx, ecx
mov edx, eax
test eax, eax
je 0x401c6f
lea eax, [ebp - 0x1c]
push eax
lea eax, [edx + 0x14]
push eax
call sub.KERNEL32.dll_CompareFileTime
mov ecx, eax
lea eax, [esi - 3]
or eax, 0x80000000
test eax, ecx
sete al
movzx esi, al
jmp 0x401b05
push edi
push 0x42d800
push 0x40b850
call fcn.0040678e
push eax
call fcn.004061a9
push eax
call fcn.004067ae
jmp 0x401af2
push 0
call fcn.004014e2
push dword [ebp - 0x24]
push eax
call fcn.00405f8a
jmp case.0x4016ad.65
push 0x31
call fcn.004014e2
push dword [ebp - 0x28]
push eax
call fcn.00405f1e
test eax, eax
je 0x4018ae
cmp eax, dword [ebp - 0x20]
je 0x401ce8
cmp eax, dword [ebp - 0x18]
jne case.0x4016ad.65
mov eax, dword [ebp - 0x14]
jmp 0x4017be
mov eax, dword [ebp - 0x1c]
jmp 0x4017be
push 0xfffffffffffffff0
jmp 0x401ca7
push 1
call fcn.004014e2
push eax
call fcn.004067a5
push eax
jmp 0x4019af
push 2
call fcn.004014c3
mov esi, eax
push 3
call fcn.004014c3
mov ebx, eax
push 1
call fcn.004014e2
mov dword [ebp - 0x1f4], eax
mov byte [edi], 0
cmp dword [ebp - 0x20], 0
je 0x401d37
test esi, esi
je case.0x4016ad.65
push dword [ebp - 0x1f4]
call fcn.004067a5
test ebx, ebx
js 0x401d8a
cmp ebx, eax
jle 0x401d4c
mov ebx, eax
mov eax, dword [ebp - 0x1f4]
add eax, ebx
push eax
push edi
call fcn.0040678e
test esi, esi
je case.0x4016ad.65
test esi, esi
js 0x401d7c
cmp esi, 0x3ff
jg case.0x4016ad.65
mov byte [esi + edi], 0
jmp case.0x4016ad.65
push edi
call fcn.004067a5
add esi, eax
jns 0x401d67
xor esi, esi
jmp 0x401d67
add ebx, eax
jns 0x401d46
jmp case.0x4016ad.65
push 0x20
call fcn.004014e2
mov ebx, eax
push 0x31
call fcn.004014e2
cmp dword [ebp - 0x18], 0
jne 0x401dbd
push eax
push ebx
call sub.KERNEL32.dll_lstrcmpiA
test eax, eax
je 0x401969
jmp 0x401ce8
push eax
push ebx
call sub.KERNEL32.dll_lstrcmpA
jmp 0x401db0
push 1
call fcn.004014e2
mov ebx, eax
push 0x400
push edi
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x401dfc
cmp dword [ebp - 0x20], 0
jne 0x401df1
mov byte [edi + 0x3ff], 0
jmp case.0x4016ad.65
push edi
push ebx
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
jne 0x401de5
mov dword [ebp - 0x1ec], 1
mov byte [edi], 0
jmp 0x401de5
push 0
call fcn.004014c3
mov ebx, eax
push 1
call fcn.004014c3
cmp dword [ebp - 0x14], 0
jne 0x401e39
cmp ebx, eax
jl 0x401ce8
cmp ebx, eax
jle 0x401969
mov eax, dword [ebp - 0x18]
jmp 0x4017be
cmp ebx, eax
jb 0x401ce8
cmp ebx, eax
jbe 0x401969
jmp 0x401e31
push 1
call fcn.004014c3
mov ebx, eax
push 2
call fcn.004014c3
mov ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xc
ja case.default.0x401e65
jmp dword [eax*4 + 0x401e6c]
add ebx, ecx
push ebx
jmp 0x4019af
sub ebx, ecx
jmp case.default.0x401e65
imul ebx, ecx
jmp case.default.0x401e65
test ecx, ecx
je 0x401ebe
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
jmp case.default.0x401e65
xor ebx, ebx
mov dword [ebp - 0x1ec], 1
jmp case.default.0x401e65
or ebx, ecx
jmp case.default.0x401e65
and ebx, ecx
jmp case.default.0x401e65
xor ebx, ecx
jmp case.default.0x401e65
test ebx, ebx
sete al
movzx ebx, al
jmp case.default.0x401e65
xor eax, eax
test ebx, ebx
jne 0x401eec
test ecx, ecx
je 0x401eba
mov eax, 1
jmp 0x401eba
xor eax, eax
test ebx, ebx
je 0x401eba
jmp 0x401ee8
test ecx, ecx
je 0x401ebe
mov eax, ebx
cdq
idiv ecx
mov ebx, edx
jmp case.default.0x401e65
shl ebx, cl
jmp case.default.0x401e65
sar ebx, cl
jmp case.default.0x401e65
push 1
call fcn.004014e2
mov ebx, eax
push 2
call fcn.004014c3
push eax
push ebx
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp case.0x4016ad.65
mov eax, dword [ebp - 0x20]
mov ebx, dword [0x40b840]
test eax, eax
je 0x401fa0
dec eax
cmp eax, 0xffffffff
je 0x401f67
test ebx, ebx
je 0x401f53
dec eax
mov ebx, dword [ebx]
cmp eax, 0xffffffff
je 0x401f67
test ebx, ebx
jne 0x401f47
push 0x200010
push 0xffffffffffffffe8
push 0
call fcn.0040683a
push eax
jmp 0x401c14
test ebx, ebx
je 0x401f53
add ebx, 4
push ebx
push 0x40b850
call fcn.0040678e
mov eax, dword [0x40b840]
add eax, 4
push eax
push ebx
call fcn.0040678e
mov eax, dword [0x40b840]
add eax, 4
push 0x40b850
push eax
call fcn.0040678e
jmp case.0x4016ad.65
test edx, edx
je 0x401fc8
test ebx, ebx
je 0x4018ae
lea eax, [ebx + 4]
push eax
push edi
call fcn.0040678e
mov eax, dword [ebx]
mov dword [0x40b840], eax
push ebx
call sub.KERNEL32.dll_GlobalFree
jmp case.0x4016ad.65
push 0x404
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
push dword [ebp - 0x28]
lea eax, [eax + 4]
push eax
call fcn.0040683a
mov eax, dword [0x40b840]
mov dword [ebx], eax
mov dword [0x40b840], ebx
jmp case.0x4016ad.65
push 3
call fcn.004014c3
push 4
mov dword [ebp - 0x1f8], eax
call fcn.004014c3
test byte [ebp - 0x14], 1
mov esi, eax
jne 0x4020d1
test byte [ebp - 0x14], 2
jne 0x4020c3
cmp dword [ebp - 0x2c], 0x21
je 0x40206f
push 1
call fcn.004014e2
mov ebx, eax
push 0x12
call fcn.004014e2
cmp byte [eax], 0
jne 0x40203b
xor eax, eax
push eax
cmp byte [ebx], 0
je 0x40206b
mov eax, ebx
push eax
push esi
push dword [ebp - 0x1f8]
call sub.USER32.dll_FindWindowExA
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x28], 0
js case.0x4016ad.65
push dword [ebp - 0x1a8]
jmp 0x4019af
xor eax, eax
jmp 0x402043
push 1
call fcn.004014c3
mov ebx, eax
push 2
call fcn.004014c3
mov ecx, eax
mov eax, dword [ebp - 0x14]
mov edx, eax
sar edx, 2
je 0x4020b3
lea eax, [ebp - 0x1a8]
push eax
push edx
push 0
push esi
push dword [ebp - 0x1f8]
push ecx
push ebx
call sub.USER32.dll_SendMessageTimeoutA
test eax, eax
jne 0x402056
mov dword [ebp - 0x1ec], 1
jmp 0x402056
push esi
push dword [ebp - 0x1f8]
push ecx
push ebx
call sub.USER32.dll_SendMessageA
jmp 0x402050
push 0x44
call fcn.004014e2
mov esi, eax
jmp 0x40201e
push 0x33
call fcn.004014e2
mov dword [ebp - 0x1f8], eax
jmp 0x402014
push 0
call fcn.004014c3
push eax
call sub.USER32.dll_IsWindow
jmp 0x40195d
push 2
call fcn.004014c3
push eax
push 1
call fcn.004014c3
push eax
call sub.USER32.dll_GetDlgItem
jmp 0x401d01
add edx, dword [0x424cc8]
push edx
push 0xffffffffffffffeb
push 0
call fcn.004014c3
push eax
call sub.USER32.dll_SetWindowLongA
jmp case.0x4016ad.65
push dword [ebp - 0x24]
push dword [ebp - 0x1e8]
call sub.USER32.dll_GetDlgItem
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
push ebx
call sub.USER32.dll_GetClientRect
mov eax, dword [ebp - 0x20]
mov edx, eax
imul edx, dword [ebp - 0x30]
imul eax, dword [ebp - 0x34]
push 0x10
push edx
push eax
push 0
push 0
call fcn.004014e2
push eax
push 0
call sub.USER32.dll_LoadImageA
push eax
push 0
push 0x172
push ebx
call sub.USER32.dll_SendMessageA
test eax, eax
je case.0x4016ad.65
push eax
call sub.GDI32.dll_DeleteObject
jmp case.0x4016ad.65
push 0x48
push 0x5a
push dword [ebp - 0x1e8]
call sub.USER32.dll_GetDC
push eax
call sub.GDI32.dll_GetDeviceCaps
push eax
push 2
call fcn.004014c3
push eax
call sub.KERNEL32.dll_MulDiv
neg eax
push 3
mov dword [section..bss], eax
call fcn.004014c3
mov dl, byte [ebp - 0x18]
mov dword [0x40b010], eax
mov al, dl
and eax, 1
push dword [ebp - 0x24]
mov byte [0x40b014], al
push 0x40b01c
mov al, dl
and edx, 4
and eax, 2
mov byte [0x40b016], dl
mov byte [0x40b015], al
mov byte [0x40b017], 1
call fcn.0040683a
push section..bss
call sub.GDI32.dll_CreateFontIndirectA
jmp 0x401d01
push 0
call fcn.004014c3
mov ebx, eax
push 1
call fcn.004014c3
cmp dword [ebp - 0x1c], 0
jne 0x40221d
push eax
push ebx
jmp 0x401884
push eax
push ebx
call sub.USER32.dll_EnableWindow
jmp case.0x4016ad.65
push 0
call fcn.004014e2
mov esi, eax
push 0x31
call fcn.004014e2
mov edi, eax
push 0x22
call fcn.004014e2
mov ebx, eax
push 0x15
call fcn.004014e2
push 0xffffffffffffffec
call fcn.004014af
push dword [ebp - 0x1c]
push 0x42d800
cmp byte [ebx], 0
je 0x402288
mov eax, ebx
push eax
push edi
cmp byte [esi], 0
je 0x402284
mov eax, esi
push eax
push dword [ebp - 0x1e8]
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jg case.0x4016ad.65
jmp 0x4018ae
xor eax, eax
jmp 0x40226a
xor eax, eax
jmp 0x402261
push 0
call fcn.004014e2
mov ebx, eax
push eax
push 0xffffffffffffffeb
call fcn.0040559d
push ebx
call fcn.00405eb0
mov ebx, eax
test eax, eax
je 0x4018ae
cmp dword [ebp - 0x20], 0
je 0x4022ea
push 0x64
push ebx
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4022cb
push 0xf
call fcn.00406cc1
jmp 0x4022b3
lea eax, [ebp - 0x1ac]
push eax
push ebx
call sub.KERNEL32.dll_GetExitCodeProcess
cmp dword [ebp - 0x24], 0
js 0x4022f5
push dword [ebp - 0x1ac]
push esi
call fcn.004066c9
push ebx
call sub.KERNEL32.dll_CloseHandle
jmp case.0x4016ad.65
cmp dword [ebp - 0x1ac], 0
je 0x4022ea
mov dword [ebp - 0x1ec], 1
jmp 0x4022ea
push 2
call fcn.004014e2
push eax
call fcn.00406b8f
mov ebx, eax
test eax, eax
je 0x40232e
push dword [eax + 0x14]
push esi
call fcn.004066c9
push dword [ebx + 0x18]
jmp 0x4019af
mov byte [edi], 0
mov byte [esi], 0
jmp 0x4018ae
push 0xffffffffffffffee
call fcn.004014e2
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x1b0]
push eax
push dword [ebp - 0x1fc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov byte [edi], 0
mov ebx, eax
test eax, eax
mov byte [esi], 0
mov dword [ebp - 0x1ec], 1
je case.0x4016ad.65
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
mov dword [ebp - 0x200], eax
je case.0x4016ad.65
push eax
push ebx
push 0
push dword [ebp - 0x1fc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4023a6
push dword [ebp - 0x200]
jmp 0x401fbe
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x1b8]
push eax
push 0x401649
push dword [ebp - 0x200]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40239b
mov eax, dword [ebp - 0x1b8]
push dword [eax + 8]
push edi
call fcn.004066c9
mov eax, dword [ebp - 0x1b8]
push dword [eax + 0xc]
push esi
call fcn.004066c9
mov dword [ebp - 0x1ec], 0
jmp 0x40239b
mov dword [ebp - 0x1ec], 1
cmp dword [0x424c70], 0
js 0x4024c7
push 0xfffffffffffffff0
xor esi, esi
call fcn.004014e2
mov ebx, eax
push 1
call fcn.004014e2
mov edi, eax
cmp dword [ebp - 0x18], 0
jne 0x4024ba
test esi, esi
je 0x40249f
push edi
push esi
call sub.KERNEL32.dll_GetProcAddress
mov ebx, eax
test eax, eax
je 0x402495
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1ec], 0
test eax, eax
je 0x402474
push eax
call fcn.004014af
call ebx
test eax, eax
je 0x40245f
mov dword [ebp - 0x1ec], 1
cmp dword [ebp - 0x1c], 0
jne case.0x4016ad.65
push esi
call sub.KERNEL32.dll_FreeLibrary
jmp case.0x4016ad.65
push section..data
push 0x40b840
push section..ndata
push 0x400
push dword [ebp - 0x1e8]
call ebx
add esp, 0x14
jmp 0x40245f
push edi
push 0xfffffffffffffff7
call fcn.0040559d
jmp 0x40245f
push 8
push 0
push ebx
call sub.KERNEL32.dll_LoadLibraryExA
mov esi, eax
test eax, eax
jne 0x40242b
push 0xfffffffffffffff6
jmp 0x401925
push ebx
call sub.KERNEL32.dll_GetModuleHandleA
mov esi, eax
jmp 0x402427
push 0xffffffffffffffe7
jmp 0x401925
push 0xfffffffffffffff0
call fcn.004014e2
push 0xffffffffffffffdf
mov dword [ebp - 0x204], eax
call fcn.004014e2
mov esi, eax
push 2
call fcn.004014e2
push 0xffffffffffffffcd
mov dword [ebp - 0x208], eax
call fcn.004014e2
mov edi, eax
push 0x45
call fcn.004014e2
push esi
mov dword [ebp - 0x20c], eax
call fcn.0040622f
test eax, eax
je 0x40265e
lea eax, [ebp - 0x1bc]
push eax
push 0x408400
push 1
push 0
push 0x4082f0
call sub.OLE32.dll_CoCreateInstance
test eax, eax
js 0x40260d
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1c0]
mov ecx, dword [eax]
push edx
push 0x4095b0
push eax
call dword [ecx]
mov ebx, eax
test eax, eax
js 0x4025f6
mov eax, dword [ebp - 0x1bc]
mov edx, dword [eax]
push esi
push eax
call dword [edx + 0x50]
mov ebx, eax
mov eax, dword [ebp - 0x1bc]
mov edx, dword [eax]
push 0x42d800
push eax
call dword [edx + 0x24]
movzx ecx, byte [ebp - 0x17]
test ecx, ecx
jne 0x40264c
mov eax, dword [ebp - 0x1bc]
movzx edx, word [ebp - 0x16]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
cmp byte [edi], 0
jne 0x402635
mov eax, dword [ebp - 0x1bc]
mov edx, dword [eax]
push dword [ebp - 0x208]
push eax
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x1bc]
mov edx, dword [eax]
push dword [ebp - 0x20c]
push eax
call dword [edx + 0x1c]
test ebx, ebx
js 0x4025ea
push 0x400
mov ebx, 0x80004005
push 0x40b040
push 0xffffffffffffffff
push dword [ebp - 0x204]
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
test eax, eax
jne 0x40261e
mov eax, dword [ebp - 0x1c0]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x1bc]
mov edx, dword [eax]
push eax
call dword [edx + 8]
test ebx, ebx
js 0x40260d
push 0xfffffffffffffff4
jmp 0x401925
push 0xfffffffffffffff0
mov dword [ebp - 0x1ec], 1
jmp 0x401925
mov eax, dword [ebp - 0x1c0]
mov edx, dword [eax]
push 1
push 0x40b040
push eax
call dword [edx + 0x18]
mov ebx, eax
jmp 0x4025ea
mov eax, dword [ebp - 0x1bc]
movzx edx, byte [ebp - 0x18]
mov ecx, dword [eax]
push edx
push edi
push eax
call dword [ecx + 0x44]
jmp 0x40259e
mov eax, dword [ebp - 0x1bc]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x3c]
jmp 0x402584
push 0x21
call fcn.004014e2
jmp 0x402515
push 0
call fcn.004014e2
mov ebx, eax
push 0x11
call fcn.004014e2
mov esi, eax
push 0x23
call fcn.004014e2
mov edi, eax
push ebx
call fcn.00406b8f
test eax, eax
je 0x4026de
mov eax, dword [ebp - 0x1e8]
push ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 2
call fcn.004067a5
mov byte [eax + ebx + 1], 0
push esi
call fcn.004067a5
mov byte [eax + esi + 1], 0
push edi
mov eax, dword [ebp - 0x20]
mov word [ebp - 0x4c], ax
push 0
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x42], edi
call fcn.0040559d
lea eax, [ebp - 0x5c]
push eax
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
je case.0x4016ad.65
push 0
push 0xfffffffffffffff9
call fcn.0040559d
jmp 0x4018ae
cmp ecx, 0xbadf00d
jne 0x401f53
inc dword [0x424c44]
jmp case.0x4016ad.65
xor edi, edi
xor esi, esi
xor ebx, ebx
test ecx, ecx
jne 0x402744
cmp dword [ebp - 0x24], 0
jne 0x402739
cmp dword [ebp - 0x18], 0
jne 0x40272e
push 0xffffffffffffffcd
call fcn.004014e2
push eax
push ebx
push esi
push edi
call sub.KERNEL32.dll_WritePrivateProfileStringA
jmp 0x4018a6
push 0x22
call fcn.004014e2
mov ebx, eax
jmp 0x402719
push 0x11
call fcn.004014e2
mov esi, eax
jmp 0x402713
push 0
call fcn.004014e2
mov edi, eax
jmp 0x40270d
push 1
mov dword [ebp - 0x1c4], 0x7e4e21
call fcn.004014e2
mov esi, eax
push 0x12
call fcn.004014e2
mov ebx, eax
push 0xffffffffffffffdd
call fcn.004014e2
push eax
lea eax, [ebp - 0x1c4]
push 0x3ff
push edi
push eax
push ebx
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov eax, dword [ebp - 0x1c4]
cmp dword [edi], eax
jmp 0x401a9f
mov esi, 1
cmp dword [ebp - 0x18], 0
jne 0x4027cf
push 2
call fcn.0040160c
mov ebx, eax
test eax, eax
je 0x4027c2
push 0x33
call fcn.004014e2
push eax
push ebx
call sub.ADVAPI32.DLL_RegDeleteValueA
mov esi, eax
push ebx
call sub.ADVAPI32.DLL_RegCloseKey
test esi, esi
je case.0x4016ad.65
jmp 0x4018ae
push 0x22
call fcn.004014e2
mov edx, dword [ebp - 0x18]
and edx, 2
push edx
push eax
push dword [ebp - 0x24]
call fcn.004015f4
push eax
call fcn.0040152d
mov esi, eax
jmp 0x4027c2
push dword [ebp - 0x28]
call fcn.004015f4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x210], edx
mov ebx, eax
push 2
mov esi, dword [ebp - 0x18]
call fcn.004014e2
mov edi, eax
push 0x11
call fcn.004014e2
lea edx, [ebp - 0x1c8]
mov dword [ebp - 0x1ec], 1
push 0
push edx
mov edx, dword [0x424c60]
push 0
or edx, 2
push edx
push 0
push 0
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne case.0x4016ad.65
xor eax, eax
cmp esi, 1
je 0x4028bc
cmp esi, 4
je 0x4028a9
cmp esi, 3
je 0x402893
push eax
push 0x40c050
push dword [ebp - 0x210]
push 0
push edi
push dword [ebp - 0x1c8]
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
jne 0x402883
mov dword [ebp - 0x1ec], 0
push dword [ebp - 0x1c8]
call sub.ADVAPI32.DLL_RegCloseKey
jmp case.0x4016ad.65
push 0xc00
push 0x40c050
push 0
push dword [ebp - 0x1c]
call fcn.004036e5
jmp 0x40285b
push 3
call fcn.004014c3
mov dword [0x40c050], eax
mov eax, 4
jmp 0x402856
push 0x23
call fcn.004014e2
push 0x40c050
call fcn.004067a5
inc eax
jmp 0x402851
push 0x20019
call fcn.0040160c
mov ebx, eax
push 0x33
call fcn.004014e2
test ebx, ebx
mov edx, eax
mov byte [edi], 0
je 0x4018ae
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d0]
push edi
push eax
push 0
push edx
push ebx
mov dword [ebp - 0x1cc], 0x3ff
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40292b
mov eax, dword [ebp - 0x1d0]
cmp eax, 4
je 0x402958
cmp eax, 1
je 0x40293e
cmp eax, 2
je 0x40293e
mov byte [edi], 0
mov dword [ebp - 0x1ec], 1
push ebx
jmp 0x402889
cmp eax, 4
je 0x402958
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1cc]
mov byte [eax + edi], 0
jmp 0x402938
cmp dword [ebp - 0x18], 0
jne 0x402968
mov dword [ebp - 0x1ec], 1
push dword [edi]
push edi
call fcn.004066c9
jmp 0x402938
push 0x20019
call fcn.0040160c
mov ebx, eax
push 3
call fcn.004014c3
test ebx, ebx
mov edx, eax
mov byte [edi], 0
je 0x4018ae
mov dword [ebp - 0x1d4], 0x3ff
cmp dword [ebp - 0x18], 0
je 0x4029b8
push 0x3ff
push edi
push eax
push ebx
call sub.ADVAPI32.DLL_RegEnumKeyA
mov byte [edi + 0x3ff], 0
jmp 0x402938
push 0
lea eax, [ebp - 0x1d4]
push 0
push 0
push 0
push eax
push edi
push edx
push ebx
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x4018ae
jmp 0x4029af
cmp byte [edi], 0
je case.0x4016ad.65
push edi
call fcn.004066e0
push eax
jmp 0x4022eb
push 0xffffffffffffffed
call fcn.004014e2
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push eax
call fcn.004063fa
cmp eax, 0xffffffff
jne 0x401d01
mov byte [edi], 0
jmp 0x4018ae
cmp dword [ebp - 0x20], 0
je 0x402a52
push 1
call fcn.004014c3
mov edx, 1
mov byte [0x40bc50], al
cmp byte [edi], 0
je 0x4018ae
push 0
lea eax, [ebp - 0x1d8]
push eax
push edx
push 0x40bc50
push edi
call fcn.004066e0
push eax
call sub.KERNEL32.dll_WriteFile
jmp 0x4018a6
push 0x11
call fcn.004014e2
push eax
call fcn.004067a5
mov edx, eax
jmp 0x402a29
push 2
mov dword [ebp - 0x214], 0
call fcn.004014c3
mov ebx, eax
test eax, eax
jle case.0x4016ad.65
cmp eax, 0x3ff
jle 0x402a8a
mov ebx, 0x3ff
cmp byte [edi], 0
jne 0x402a9e
mov eax, dword [ebp - 0x214]
mov byte [eax + esi], 0
jmp 0x4018a6
push edi
mov byte [ebp - 0x215], 0
call fcn.004066e0
cmp dword [ebp - 0x214], ebx
mov edi, eax
jge 0x402a8f
push 0
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1dd]
push 1
push eax
push edi
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x402a8f
cmp dword [ebp - 0x1dc], 1
jne 0x402a8f
cmp dword [ebp - 0x1c], 0
jne 0x402b5b
cmp byte [ebp - 0x215], 0xd
je 0x402b1f
cmp byte [ebp - 0x215], 0xa
je 0x402b1f
mov edx, dword [ebp - 0x214]
mov al, byte [ebp - 0x1dd]
mov byte [edx + esi], al
mov byte [ebp - 0x215], al
inc edx
test al, al
mov dword [ebp - 0x214], edx
je 0x402a8f
cmp edx, ebx
jl 0x402ab5
jmp 0x402a8f
mov al, byte [ebp - 0x1dd]
cmp byte [ebp - 0x215], al
je 0x402b35
cmp al, 0xd
je 0x402b46
cmp al, 0xa
je 0x402b46
push 1
push 0
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_SetFilePointer
jmp 0x402a8f
mov edx, dword [ebp - 0x214]
mov byte [edx + esi], al
inc edx
mov dword [ebp - 0x214], edx
jmp 0x402a8f
movzx eax, byte [ebp - 0x1dd]
push eax
push esi
call fcn.004066c9
jmp 0x401820
cmp byte [edi], 0
je case.0x4016ad.65
push dword [ebp - 0x1c]
push 0
push 2
call fcn.004014c3
push eax
push edi
call fcn.004066e0
push eax
call sub.KERNEL32.dll_SetFilePointer
cmp dword [ebp - 0x24], 0
js case.0x4016ad.65
push eax
push esi
jmp 0x4019b0
cmp byte [edi], 0
je case.0x4016ad.65
push edi
call fcn.004066e0
push eax
call sub.KERNEL32.dll_FindClose
jmp case.0x4016ad.65
cmp byte [esi], 0
je 0x401aa5
lea eax, [ebp - 0x19c]
push eax
push esi
call fcn.004066e0
push eax
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
je 0x401aa5
lea eax, [ebp - 0x170]
push eax
push edi
jmp 0x401f96
push 2
call fcn.004014e2
lea edx, [ebp - 0x19c]
push edx
push eax
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x402c0e
push eax
push esi
call fcn.004066c9
jmp 0x402bdf
mov byte [esi], 0
jmp 0x402a0a
push 0xfffffffffffffff0
mov esi, 0xfffffd66
call fcn.004014e2
push eax
mov dword [ebp - 0x220], eax
call fcn.0040622f
test eax, eax
je 0x402d6c
push dword [ebp - 0x220]
call fcn.004063d7
push 2
push 0x40000000
push dword [ebp - 0x220]
call fcn.004063fa
mov dword [ebp - 0x21c], eax
inc eax
je 0x402d1d
mov edx, dword [0x424d00]
push edx
mov dword [ebp - 0x228], edx
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
mov dword [ebp - 0x224], eax
je 0x402d12
push 0
call fcn.00403855
push dword [ebp - 0x228]
push dword [ebp - 0x224]
call fcn.0040381a
push dword [ebp - 0x20]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov edi, eax
test eax, eax
mov dword [ebp - 0x22c], eax
je 0x402cd4
push dword [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
call fcn.004036e5
mov eax, dword [ebp - 0x22c]
cmp byte [eax], 0
jne 0x402d48
push dword [ebp - 0x22c]
call sub.KERNEL32.dll_GlobalFree
push 0
lea eax, [ebp - 0x1e4]
push eax
push dword [ebp - 0x228]
push dword [ebp - 0x224]
push dword [ebp - 0x21c]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 0x224]
call sub.KERNEL32.dll_GlobalFree
push 0
push 0
push dword [ebp - 0x21c]
push 0xffffffffffffffff
call fcn.004036e5
mov esi, eax
push dword [ebp - 0x21c]
call sub.KERNEL32.dll_CloseHandle
mov ebx, 0xfffffff3
test esi, esi
js 0x402d2c
push ebx
jmp 0x401925
push dword [ebp - 0x220]
mov ebx, 0xffffffef
call sub.KERNEL32.dll_DeleteFileA
mov dword [ebp - 0x1ec], 1
jmp 0x402d26
mov ebx, dword [edi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 0x224]
add edi, 8
push ebx
add eax, esi
push edi
add edi, ebx
push eax
call fcn.004063b1
cmp byte [edi], 0
jne 0x402d48
jmp 0x402cc9
push 0xffffffffffffffed
call fcn.004014e2
jmp 0x402c36
push 0
call fcn.004014c3
mov edi, eax
cmp eax, dword [0x424cac]
jae 0x4018ae
mov ebx, eax
mov eax, dword [ebp - 0x20]
imul ebx, ebx, 0x418
add ebx, dword [0x424ca8]
test eax, eax
js 0x402db9
mov edx, dword [ebx + eax*4]
test eax, eax
jne 0x402db3
lea eax, [ebx + 0x18]
push eax
push esi
jmp 0x401f96
push edx
jmp 0x402b9b
not eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x402dea
push 1
call fcn.004014c3
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [ebx + eax*4], edx
cmp dword [ebp - 0x1c], 0
je case.0x4016ad.65
push edi
call fcn.004011a0
jmp case.0x4016ad.65
push dword [ebp - 0x18]
lea eax, [ebx + 0x18]
push eax
call fcn.0040683a
or dword [ebx + 8], 0x100
jmp 0x402dcc
push 0
call fcn.004014c3
mov ecx, eax
cmp eax, 0x1f
ja 0x4018ae
cmp dword [ebp - 0x1c], 0
je 0x402e3d
cmp dword [ebp - 0x20], 0
je 0x402e31
push eax
call fcn.004012ed
push 0
push 0
call fcn.00401226
jmp case.0x4016ad.65
push 0
call fcn.00401347
jmp 0x402b9a
cmp dword [ebp - 0x20], 0
je 0x402e57
mov eax, dword [0x424c90]
mov edx, dword [ebp - 0x24]
mov dword [eax + ecx*4 + 0x94], edx
jmp case.0x4016ad.65
mov eax, dword [0x424c90]
push dword [eax + ecx*4 + 0x94]
push esi
call fcn.0040683a
jmp case.0x4016ad.65
and ecx, dword [0x40a020]
push 0
push ecx
push 0xb
push dword [ebp - 0x1e8]
call sub.USER32.dll_SendMessageA
cmp dword [ebp - 0x28], 0
je case.0x4016ad.65
push 0
push 0
push dword [ebp - 0x1e8]
call sub.USER32.dll_InvalidateRect
jmp case.0x4016ad.65