Function at 0x40219e
Capabilities:
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Get file version info
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov edx, dword [0x44e3c8]
lea eax, [ebp - 0x28]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 7
pop ecx
lea edi, [ebp - 0x2c]
mov dword [0x41dce4], eax
rep movsd dword es:[edi], dword [esi]
imul esi, dword [ebp - 0x24], 0x4008
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
imul edi, ecx, 0x4008
mov dword [ebp - 8], edx
add esi, section..ndata
mov dword [ebp - 4], ebx
mov dword [ebp + 8], esi
add edi, section..ndata
dec eax
mov dword [ebp - 0x30], edi
cmp eax, 0x45
ja case.0x4021fa.11
jmp dword [eax*4 + 0x4038a2]
mov eax, ecx
jmp 0x40389b
push ebx
push ecx
call fcn.004086e6
mov eax, 0x7fffffff
jmp 0x40389b
inc dword [0x452530]
test edx, edx
je 0x40220f
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40220f
push ecx
call fcn.00403b4e
dec eax
push ebx
push eax
call fcn.004020fe
jmp 0x40389b
push ebx
push ecx
call fcn.004086e6
jmp case.0x4021fa.11
push ebx
call fcn.004039ee
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovg ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4021fa.11
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x4021fa.11
cmp dword [ebp - 0x20], ebx
jne 0x40229a
mov eax, dword [ecx*4 + 0x41dc68]
push 1
mov dword [ecx*4 + 0x41dca0], eax
call fcn.004039ee
mov ecx, dword [ebp - 0x28]
mov dword [ecx*4 + 0x41dc68], eax
jmp case.0x4021fa.11
mov eax, dword [ecx*4 + 0x41dca0]
jmp 0x40228e
mov ecx, dword [ebp - 0x20]
push 4
mov edx, dword [ecx*4 + 0x41dc68]
mov eax, edx
and eax, dword [ebp - 0x1c]
mov dword [ecx*4 + 0x41dc68], eax
xor eax, eax
test edx, edx
pop ecx
cmove eax, ecx
mov eax, dword [ebp + eax - 0x28]
jmp 0x40389b
mov eax, dword [ebp - 0x24]
push dword [eax*4 + 0x41dc68]
jmp 0x40388a
mov eax, dword [0x452538]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4022f3
push dword [ebp - 0x24]
push eax
call esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [0x452534]
test eax, eax
je case.0x4021fa.11
push ecx
push eax
call esi
jmp case.0x4021fa.11
push 0xfffffffffffffff0
call fcn.00403a0d
push dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x4021fa.11
xor eax, eax
inc eax
jmp 0x403893
push 0xfffffffffffffff0
call fcn.00403a0d
mov edi, eax
push edi
call fcn.00409b7b
mov esi, eax
test esi, esi
je 0x402389
push 0x5c
push esi
call fcn.00409523
mov esi, eax
push ebx
push edi
movzx eax, word [esi]
mov dword [ebp + 8], eax
xor eax, eax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40237b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402378
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40237b
inc dword [ebp - 4]
mov eax, dword [ebp + 8]
mov word [esi], ax
add esi, 2
test ax, ax
jne 0x40233f
push 0x421cf0
cmp dword [ebp - 0x24], ebx
je 0x4023b1
push 0xffffffffffffffe6
call fcn.004086e6
push edi
push 0x4de0b0
call fcn.00409ad1
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp case.0x4021fa.11
push 0xfffffffffffffff5
jmp 0x402241
push ebx
call fcn.00403a0d
push eax
call fcn.004094f9
jmp 0x402a74
push 0xffffffffffffffd0
call fcn.00403a0d
push 0xffffffffffffffdf
mov esi, eax
call fcn.00403a0d
push 0x13
mov edi, eax
call fcn.00403a0d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4023fa
push 0x421cf0
push 0xffffffffffffffe3
jmp 0x402241
cmp dword [ebp - 0x20], ebx
je 0x402322
push esi
call fcn.004094f9
test eax, eax
je 0x402322
push edi
push esi
call fcn.004091a0
push 0x421cf0
push 0xffffffffffffffe4
jmp 0x402241
push ebx
call fcn.00403a0d
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], eax
push ecx
push esi
mov edi, 0x2004
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x402450
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x402478
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jbe 0x402475
cmp word [ecx], bx
je 0x402475
push eax
call fcn.004094f9
test eax, eax
je 0x402443
add eax, 0x2c
push eax
push dword [ebp + 8]
call fcn.00409ad1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x20], ebx
jne 0x403893
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp case.0x4021fa.11
push 0xffffffffffffffff
call fcn.00403a0d
lea ecx, [ebp + 8]
push ecx
push edi
push 0x2004
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x4021fa.11
xor eax, eax
inc eax
xor ecx, ecx
mov word [edi], cx
jmp 0x403893
push 0xffffffffffffffef
call fcn.00403a0d
push eax
push edi
call fcn.004098f0
jmp 0x40231a
push 0x31
call fcn.00403a0d
mov esi, eax
mov eax, dword [ebp - 0x28]
and eax, 7
mov dword [ebp - 0xc], esi
push esi
mov dword [ebp + 8], eax
call fcn.00409cdf
mov edi, 0x41dce8
push esi
test eax, eax
je 0x4024fe
push edi
call fcn.00409ad1
jmp 0x402515
push 0x4de0b0
push edi
call fcn.00409ad1
push eax
call fcn.00409455
push eax
call fcn.00409ac7
push edi
call fcn.00409c0f
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
cmp eax, 3
jl 0x402557
push edi
call fcn.004094f9
mov ecx, ebx
test eax, eax
je 0x402542
lea ecx, [ebp - 0x1c]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffd
or eax, 0x80000000
and eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 8], eax
test eax, eax
jne 0x402561
push edi
call fcn.00409b59
xor eax, eax
cmp dword [ebp + 8], esi
setne al
inc eax
push eax
push 0x40000000
push edi
call fcn.00409826
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x402608
cmp dword [ebp + 8], ebx
jne 0x4025ef
push section..ndata
push 0x425cf8
call fcn.00409ad1
push edi
push section..ndata
call fcn.00409ad1
push dword [ebp - 0x14]
push 0x421cf0
call fcn.00408ecc
push 0x425cf8
push section..ndata
call fcn.00409ad1
mov eax, dword [ebp - 0x28]
sar eax, 3
push eax
push 0x421cf0
call fcn.00409944
sub eax, 4
je 0x40251e
sub eax, 1
je 0x4025e4
push edi
push 0xfffffffffffffffa
jmp 0x40220a
inc dword [0x41dc70]
jmp 0x403899
mov esi, dword [ebp - 0xc]
push esi
push 0xffffffffffffffe2
call fcn.004086e6
xor eax, eax
cmp dword [ebp + 8], 2
sete al
jmp 0x403893
mov esi, dword [ebp - 0xc]
push esi
push 0xffffffffffffffea
call fcn.004086e6
inc dword [0x41dc9c]
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x20]
call fcn.00404ed8
dec dword [0x41dc9c]
cmp dword [ebp - 0x1c], 0xffffffff
mov dword [ebp + 8], eax
jne 0x40263b
cmp dword [ebp - 0x18], 0xffffffff
je 0x40264a
lea eax, [ebp - 0x1c]
push eax
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
test eax, eax
jns case.0x4021fa.11
cmp eax, 0xfffffffe
jne 0x402674
push 0xffffffffffffffe9
push edi
call fcn.00408ecc
push esi
push edi
call fcn.00409ac7
jmp 0x40267c
push 0xffffffffffffffee
push edi
call fcn.00408ecc
push 0x200010
push edi
call fcn.00409944
jmp 0x40220f
push ebx
call fcn.00403a0d
push dword [ebp - 0x24]
push eax
call fcn.0040960c
jmp case.0x4021fa.11
push 0x31
call fcn.00403a0d
push dword [ebp - 0x28]
push eax
call fcn.00409944
test eax, eax
je 0x402322
cmp eax, dword [ebp - 0x20]
je 0x402802
cmp eax, dword [ebp - 0x18]
jne case.0x4021fa.11
mov eax, dword [ebp - 0x14]
jmp 0x40389b
push 0xfffffffffffffff0
jmp 0x40268d
push 1
call fcn.00403a0d
push eax
call fcn.00409ae9
jmp 0x403889
push 2
call fcn.004039ee
push 3
mov esi, eax
call fcn.004039ee
push 1
mov ebx, eax
call fcn.00403a0d
xor ecx, ecx
mov dword [ebp + 8], eax
mov word [edi], cx
cmp dword [ebp - 0x20], ecx
je 0x402716
test esi, esi
je case.0x4021fa.11
push eax
call fcn.00409ae9
test ebx, ebx
jns 0x402728
add ebx, eax
js case.0x4021fa.11
cmp ebx, eax
cmovg ebx, eax
mov eax, dword [ebp + 8]
lea eax, [eax + ebx*2]
push eax
push edi
call fcn.00409ad1
test esi, esi
je case.0x4021fa.11
jns 0x40274c
push edi
call fcn.00409ae9
add esi, eax
xor eax, eax
test esi, esi
cmovns eax, esi
cmp eax, 0x2004
jge case.0x4021fa.11
xor ecx, ecx
mov word [edi + eax*2], cx
jmp case.0x4021fa.11
push 0x20
call fcn.00403a0d
push 0x31
mov esi, eax
call fcn.00403a0d
push eax
push esi
cmp dword [ebp - 0x18], ebx
jne 0x402788
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x40278e
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402802
mov eax, dword [ebp - 0x20]
jmp 0x40389b
xor ebx, ebx
inc ebx
push ebx
call fcn.00403a0d
push 0x2004
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4027c8
cmp dword [ebp - 0x20], 0
je 0x4027d1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4027d1
xor ecx, ecx
mov eax, ebx
mov word [edi], cx
jmp 0x4027d4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov word [edi + 0x4006], cx
jmp 0x403893
push ebx
call fcn.004039ee
push 1
mov esi, eax
call fcn.004039ee
cmp dword [ebp - 0x14], ebx
jne 0x4027fe
cmp esi, eax
jl 0x402802
jle 0x402792
jmp 0x40280c
cmp esi, eax
jae 0x40280a
mov eax, dword [ebp - 0x1c]
jmp 0x40389b
jbe 0x402792
mov eax, dword [ebp - 0x18]
jmp 0x40389b
xor esi, esi
inc esi
push esi
call fcn.004039ee
push 2
mov dword [ebp + 8], eax
call fcn.004039ee
mov ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xc
ja case.default.0x402835
jmp dword [eax*4 + 0x4039ba]
mov edx, dword [ebp + 8]
add edx, ecx
jmp 0x4028b9
mov edx, dword [ebp + 8]
sub edx, ecx
jmp 0x4028b9
mov edx, dword [ebp + 8]
imul edx, ecx
jmp 0x4028b9
test ecx, ecx
je 0x40285e
mov eax, dword [ebp + 8]
cdq
idiv ecx
jmp 0x402882
mov edx, ebx
mov dword [ebp - 4], esi
jmp 0x4028b9
mov edx, dword [ebp + 8]
or edx, ecx
jmp 0x4028b9
mov edx, dword [ebp + 8]
and edx, ecx
jmp 0x4028b9
mov edx, dword [ebp + 8]
xor edx, ecx
jmp 0x4028b9
xor eax, eax
cmp dword [ebp + 8], eax
sete al
mov edx, eax
jmp 0x4028b9
cmp dword [ebp + 8], ebx
jne 0x40288f
test ecx, ecx
je 0x402898
mov edx, esi
jmp 0x4028b9
cmp dword [ebp + 8], ebx
jne 0x40288b
mov edx, ebx
jmp 0x4028b9
test ecx, ecx
je 0x40285e
mov eax, dword [ebp + 8]
cdq
idiv ecx
jmp 0x4028b9
mov edx, dword [ebp + 8]
shl edx, cl
jmp 0x4028b9
mov edx, dword [ebp + 8]
sar edx, cl
jmp 0x4028b9
mov edx, dword [ebp + 8]
push edx
jmp 0x40388a
push 1
call fcn.00403a0d
push 2
mov esi, eax
call fcn.004039ee
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp case.0x4021fa.11
mov eax, dword [ebp - 0x20]
mov esi, dword [0x41dce0]
test eax, eax
je 0x402941
dec eax
test esi, esi
je 0x40292e
mov esi, dword [esi]
test eax, eax
jne 0x4028ed
test esi, esi
je 0x40292e
add esi, 4
mov edi, 0x41dce8
push esi
push edi
call fcn.00409ad1
mov eax, dword [0x41dce0]
add eax, 4
push eax
push esi
call fcn.00409ad1
mov eax, dword [0x41dce0]
push edi
add eax, 4
push eax
call fcn.00409ad1
jmp case.0x4021fa.11
push 0x200010
push 0xffffffffffffffe8
push ebx
call fcn.00408ecc
push eax
jmp 0x402682
cmp dword [ebp - 0x24], ebx
je 0x40296b
test esi, esi
je 0x402322
lea eax, [esi + 4]
push eax
push edi
call fcn.00409ad1
mov eax, dword [esi]
mov dword [0x41dce0], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x4021fa.11
push 0x400c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp - 0x28]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.00408ecc
mov eax, dword [0x41dce0]
mov dword [esi], eax
mov dword [0x41dce0], esi
jmp case.0x4021fa.11
push 3
call fcn.004039ee
push 4
mov dword [ebp + 8], eax
call fcn.004039ee
mov esi, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
test al, 1
je 0x4029c2
push 0x33
call fcn.00403a0d
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
test al, 2
je 0x4029d2
push 0x44
call fcn.00403a0d
mov esi, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x2c], 0x21
push 1
jne 0x402a24
call fcn.004039ee
push 2
mov dword [ebp - 0xc], eax
call fcn.004039ee
mov ecx, dword [ebp - 0x14]
sar ecx, 2
test ecx, ecx
je 0x402a14
lea edx, [ebp - 8]
push edx
push ecx
push ebx
push esi
push dword [ebp + 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ecx, dword [ebp - 8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
jmp 0x402a58
push esi
push dword [ebp + 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x402a50
call fcn.00403a0d
push 0x12
mov esi, eax
call fcn.00403a0d
xor ecx, ecx
cmp word [eax], bx
cmovne ecx, eax
push ecx
xor ecx, ecx
cmp word [esi], bx
cmovne ecx, esi
push ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x28], ebx
jl 0x403893
push ecx
jmp 0x40388a
push ebx
call fcn.004039ee
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402792
mov eax, dword [ebp - 0x24]
jmp 0x40389b
push 2
call fcn.004039ee
push eax
push 1
call fcn.004039ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x403889
mov eax, dword [0x431d98]
add eax, dword [ebp - 0x24]
push eax
push 0xffffffffffffffeb
push ebx
call fcn.004039ee
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x4021fa.11
push dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x20]
push 0x10
push ecx
push eax
push ebx
push ebx
call fcn.00403a0d
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push ebx
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x4021fa.11
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x4021fa.11
push 0x48
push 0x5a
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 2
call fcn.004039ee
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 3
mov dword [0x431d10], eax
call fcn.004039ee
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x24]
mov dword [0x431d20], eax
mov al, cl
and al, 1
mov byte [0x431d27], 1
mov byte [0x431d24], al
mov al, cl
and al, 2
and cl, 4
push 0x431d2c
mov byte [0x431d25], al
mov byte [0x431d26], cl
call fcn.00408ecc
push 0x431d10
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x403889
push ebx
call fcn.004039ee
push 1
mov esi, eax
call fcn.004039ee
push eax
push esi
cmp dword [ebp - 0x1c], ebx
jne 0x402bad
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x4021fa.11
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x4021fa.11
push ebx
call fcn.00403a0d
push 0x31
mov ebx, eax
call fcn.00403a0d
push 0x22
mov edi, eax
call fcn.00403a0d
push 0x15
mov esi, eax
call fcn.00403a0d
push 0x421cf0
push 0xffffffffffffffec
call fcn.004086e6
push dword [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
cmp word [esi], dx
push 0x4de0b0
cmovne ecx, esi
xor eax, eax
cmp word [ebx], dx
push ecx
push edi
cmovne eax, ebx
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
jge case.0x4021fa.11
jmp 0x402322
push ebx
call fcn.00403a0d
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.004086e6
push esi
call fcn.004095cd
mov esi, eax
test esi, esi
je 0x402322
cmp dword [ebp - 0x20], ebx
je 0x402c90
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push esi
call edi
mov ebx, 0x102
jmp 0x402c5d
push 0xf
call fcn.00409172
push 0x64
push esi
call edi
cmp eax, ebx
je 0x402c51
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x24], 0
jl 0x402c80
push dword [ebp - 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00409aac
jmp 0x402c90
mov eax, dword [ebp - 4]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xc], 0
cmovne eax, ecx
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x4021fa.11
push 2
call fcn.00403a0d
push eax
call fcn.004094f9
mov ebx, eax
test ebx, ebx
je 0x402cc0
push dword [ebx + 0x14]
push esi
call fcn.00409aac
push dword [ebx + 0x18]
jmp 0x40388a
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x402322
push 0xffffffffffffffee
call fcn.00403a0d
lea ecx, [ebp - 0x30]
mov dword [ebp - 8], eax
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
xor eax, eax
mov word [edi], ax
mov word [esi], ax
inc eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
test ecx, ecx
je 0x403893
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
je case.0x4021fa.11
push eax
push dword [ebp - 0x10]
push ebx
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x402d53
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 8]
push eax
push 0x4163f0
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x402d53
mov eax, dword [ebp + 8]
push dword [eax + 8]
push edi
call fcn.00409aac
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push esi
call fcn.00409aac
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
jmp 0x402960
xor esi, esi
inc esi
mov dword [ebp - 4], esi
cmp dword [0x41dcdc], ebx
jl 0x402e3b
push 0xfffffffffffffff0
call fcn.00403a0d
mov edi, eax
push esi
mov dword [ebp - 0x10], edi
call fcn.00403a0d
mov dword [ebp + 8], eax
cmp dword [ebp - 0x18], ebx
je 0x402d97
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x402dab
mov edi, dword [ebp - 0x10]
push 8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x402e2f
push dword [ebp + 8]
push edi
call fcn.004091d3
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x402dff
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], ebx
je 0x402de0
push 0x421cf0
push dword [ebp - 0x20]
call fcn.004086e6
call dword [ebp - 0x10]
test eax, eax
je 0x402e09
mov eax, esi
mov dword [ebp - 4], eax
jmp 0x402e0c
mov eax, dword [ebp - 8]
push section..data
push 0x41dce0
push section..ndata
push 0x2004
push eax
call ecx
add esp, 0x14
jmp 0x402e09
push dword [ebp + 8]
push 0xfffffffffffffff7
call fcn.004086e6
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1c], ebx
jne 0x403893
push edi
call fcn.004063bb
test eax, eax
je case.0x4021fa.11
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x4021fa.11
push 0x421cf0
push 0xfffffffffffffff6
jmp 0x402241
push 0x421cf0
push 0xffffffffffffffe7
jmp 0x402241
push 0xfffffffffffffff0
call fcn.00403a0d
push 0xffffffffffffffdf
mov dword [ebp - 0x30], eax
call fcn.00403a0d
mov esi, eax
push 2
mov dword [ebp - 0x10], esi
call fcn.00403a0d
push 0xffffffffffffffcd
mov dword [ebp - 8], eax
call fcn.00403a0d
push 0x45
mov edi, eax
call fcn.00403a0d
push esi
mov dword [ebp - 0x3c], eax
call fcn.00409cdf
test eax, eax
jne 0x402e8b
push 0x21
call fcn.00403a0d
lea eax, [ebp + 8]
xor esi, esi
push eax
push 0x416794
inc esi
push esi
push ebx
push 0x4167a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
test eax, eax
js 0x402f6c
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
push edx
push 0x416784
push eax
mov ecx, dword [eax]
call dword [ecx]
mov dword [ebp - 4], eax
test eax, eax
js 0x402f60
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x4de0b0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 8
movzx eax, al
mov dword [ebp - 0x10], eax
test eax, eax
je 0x402f09
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
sar edx, 0x10
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp word [edi], bx
je 0x402f2a
mov ecx, dword [ebp + 8]
movzx eax, byte [ebp - 0x18]
push eax
push edi
mov edx, dword [ecx]
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp + 8]
push dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
push dword [ebp - 0x3c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 4], ebx
jl 0x402f57
mov eax, dword [ebp - 0xc]
push esi
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
sar eax, 0x1f
and eax, 0xfffffffc
sub eax, 0xc
push 0x421cf0
push eax
call fcn.004086e6
mov eax, dword [ebp - 4]
shr eax, 0x1f
jmp 0x403893
push ebx
call fcn.00403a0d
push 0x11
mov esi, eax
call fcn.00403a0d
push 0x23
mov edi, eax
call fcn.00403a0d
push esi
mov dword [ebp + 8], eax
call fcn.004094f9
test eax, eax
jne 0x402fbd
push ebx
push 0xfffffffffffffff9
call fcn.004086e6
jmp 0x402322
mov eax, dword [ebp - 8]
push esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 2
call fcn.00409ae9
xor ecx, ecx
push edi
mov word [esi + eax*2 + 2], cx
call fcn.00409ae9
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
mov ecx, dword [ebp + 8]
mov ax, word [ebp - 0x20]
push ecx
push ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3a], ecx
mov word [ebp - 0x44], ax
call fcn.004086e6
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x4021fa.11
jmp 0x402fb0
cmp ecx, 0xbadf00d
jne 0x40292e
inc dword [0x41dc7c]
jmp case.0x4021fa.11
mov esi, ebx
mov edi, ebx
test ecx, ecx
je 0x40303a
push ebx
call fcn.00403a0d
mov ebx, eax
cmp dword [ebp - 0x24], esi
je 0x403048
push 0x11
call fcn.00403a0d
mov esi, eax
cmp dword [ebp - 0x18], edi
je 0x403056
push 0x22
call fcn.00403a0d
mov edi, eax
push 0xffffffffffffffcd
call fcn.00403a0d
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x40231a
mov eax, dword [0x4163f4]
mov dword [ebp - 0x40], eax
mov eax, dword [0x4163f8]
push 1
mov dword [ebp - 0x3c], eax
call fcn.00403a0d
push 0x12
mov edi, eax
call fcn.00403a0d
push 0xffffffffffffffdd
mov esi, eax
call fcn.00403a0d
mov ebx, dword [ebp - 0x30]
push eax
push 0x2003
push ebx
lea eax, [ebp - 0x40]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.0x4021fa.11
xor esi, esi
xor ecx, ecx
mov word [ebx], cx
lea eax, [esi + 1]
jmp 0x403893
xor esi, esi
inc esi
cmp dword [ebp - 0x18], ebx
jne 0x4030fc
push 2
call fcn.00403b04
mov edi, eax
test edi, edi
je 0x403128
push 0x33
call fcn.00403a0d
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403128
push 0x22
call fcn.00403a0d
mov ecx, dword [ebp - 0x24]
mov edx, eax
test ecx, ecx
jne 0x403118
mov ecx, dword [0x41dc6c]
add ecx, 0x80000001
mov eax, dword [ebp - 0x18]
and eax, 2
push eax
push edx
push ecx
call fcn.00403a50
mov esi, eax
xor eax, eax
test esi, esi
setne al
jmp 0x403893
test ecx, ecx
je 0x40313c
mov edi, ecx
jmp 0x403148
mov edi, dword [0x41dc6c]
add edi, 0x80000001
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
push 2
mov dword [ebp - 0x30], eax
call fcn.00403a0d
push 0x11
mov dword [ebp - 0x3c], eax
call fcn.00403a0d
push ebx
lea ecx, [ebp - 0xc]
xor esi, esi
push ecx
mov ecx, dword [0x41dc98]
inc esi
push ebx
or ecx, 2
mov dword [ebp - 4], esi
push ecx
push ebx
push ebx
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne case.0x4021fa.11
mov eax, ebx
mov edi, 0x425cf8
cmp dword [ebp + 8], esi
jne 0x4031ae
push 0x23
call fcn.00403a0d
push edi
call fcn.00409ae9
lea eax, [eax*2 + 2]
mov esi, dword [ebp + 8]
cmp esi, 4
jne 0x4031c4
push 3
call fcn.004039ee
push esi
mov dword [0x425cf8], eax
pop eax
cmp esi, 3
jne 0x4031d8
push 0xc018
push edi
push ebx
push dword [ebp - 0x1c]
call fcn.00404ed8
push eax
push edi
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x3c]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x4021fa.11
push 0x20019
call fcn.00403b04
push 0x33
mov esi, eax
call fcn.00403a0d
xor ecx, ecx
mov word [edi], cx
test esi, esi
je 0x402322
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x4008
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x403276
cmp dword [ebp + 8], 4
je 0x403261
cmp dword [ebp + 8], ecx
je 0x403250
cmp dword [ebp + 8], 2
jne 0x403276
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov word [edi + eax*2], cx
jmp 0x40327e
push dword [edi]
xor eax, eax
cmp dword [ebp - 0x18], eax
push edi
sete al
mov dword [ebp - 4], eax
call fcn.00409aac
jmp 0x40327e
xor eax, eax
mov dword [ebp - 4], ecx
mov word [edi], ax
push esi
jmp 0x4031f4
push 0x20019
call fcn.00403b04
push 3
mov esi, eax
call fcn.004039ee
xor ecx, ecx
mov word [edi], cx
test esi, esi
je 0x402322
mov ecx, 0x2003
mov dword [ebp + 8], ecx
cmp dword [ebp - 0x18], ebx
je 0x4032bd
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4032d6
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp + 8]
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x402322
xor eax, eax
mov word [edi + 0x4006], ax
jmp 0x40327e
cmp word [edi], bx
je case.0x4021fa.11
push edi
call fcn.004099b6
push eax
jmp 0x402c91
push 0xffffffffffffffed
call fcn.00403a0d
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push eax
call fcn.00409826
cmp eax, 0xffffffff
jne 0x403889
xor eax, eax
mov word [edi], ax
jmp 0x402322
push 0x2004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor esi, esi
mov dword [ebp + 8], eax
inc esi
cmp dword [ebp - 0x20], ebx
je 0x403343
push esi
call fcn.004039ee
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov eax, esi
jmp 0x40336f
push 0x11
call fcn.00403a0d
push ebx
push ebx
push 0x2004
push dword [ebp + 8]
push 0xffffffffffffffff
push 0x421cf0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 8]
cmp word [edi], bx
je 0x40338c
push ebx
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push edi
call fcn.004099b6
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40338f
mov dword [ebp - 4], esi
push dword [ebp + 8]
jmp 0x402960
push 2
mov dword [ebp - 8], ebx
call fcn.004039ee
xor esi, esi
inc esi
cmp eax, esi
jl case.0x4021fa.11
mov ecx, 0x2003
cmp eax, ecx
cmovg eax, ecx
mov dword [ebp - 0xc], eax
cmp word [edi], bx
je 0x403486
push edi
mov byte [ebp - 0x31], bl
call fcn.004099b6
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], ebx
jle 0x403489
push ebx
lea ecx, [ebp - 0x30]
push ecx
push esi
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403466
cmp dword [ebp - 0x30], esi
jne 0x403466
cmp dword [ebp - 0x1c], ebx
jne 0x403476
push 2
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0xb]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov al, byte [ebp - 0x31]
cmp al, 0xd
je 0x40343a
cmp al, 0xa
je 0x40343a
mov ecx, dword [ebp - 8]
mov ax, word [ebp - 4]
mov word [edi + ecx*2], ax
inc ecx
mov al, byte [ebp + 0xb]
mov dword [ebp - 8], ecx
mov byte [ebp - 0x31], al
test al, al
je 0x403469
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jl 0x4033da
jmp 0x403469
mov cl, byte [ebp + 0xb]
cmp al, cl
je 0x403459
cmp cl, 0xd
je 0x40344b
cmp cl, 0xa
jne 0x403459
mov ax, word [ebp - 4]
mov ecx, dword [ebp - 8]
mov word [edi + ecx*2], ax
inc ecx
jmp 0x403469
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 8]
xor eax, eax
test ecx, ecx
mov word [edi + ecx*2], ax
jmp 0x402600
movzx eax, byte [ebp + 0xb]
push eax
push edi
call fcn.00409aac
jmp 0x403899
mov edi, dword [ebp + 8]
mov ecx, ebx
jmp 0x403469
xor esi, esi
inc esi
cmp dword [ebp - 0x20], ebx
je 0x4034a5
push esi
call fcn.004039ee
mov word [0x421cf0], ax
mov eax, esi
jmp 0x4034b2
push 0x11
call fcn.00403a0d
push eax
call fcn.00409ae9
cmp word [edi], bx
je 0x4034d9
push ebx
lea ecx, [ebp + 8]
add eax, eax
push ecx
push eax
push 0x421cf0
push edi
call fcn.004099b6
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne case.0x4021fa.11
mov eax, esi
jmp 0x403893
push 2
mov dword [ebp - 8], ebx
call fcn.004039ee
xor esi, esi
inc esi
cmp eax, esi
jl case.0x4021fa.11
mov ecx, 0x2003
cmp eax, ecx
cmovg eax, ecx
mov dword [ebp - 0xc], eax
cmp word [edi], bx
je 0x403486
push edi
mov dword [ebp - 0x10], ebx
call fcn.004099b6
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], ebx
jle 0x403489
push ebx
lea ecx, [ebp - 0x30]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403466
cmp dword [ebp - 0x30], 2
jne 0x403466
cmp dword [ebp - 0x1c], ebx
jne 0x4035b4
mov ecx, dword [ebp - 0x10]
push 0xd
pop edx
cmp cx, dx
je 0x40358a
push 0xa
pop eax
cmp cx, ax
je 0x40358a
mov ecx, dword [ebp - 8]
mov ax, word [ebp + 8]
mov word [edi + ecx*2], ax
inc ecx
movzx eax, ax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
test ax, ax
je 0x403469
mov eax, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jl 0x403523
jmp 0x403469
mov ax, word [ebp + 8]
cmp cx, ax
je 0x4035a8
cmp ax, dx
je 0x40344f
push 0xa
pop ecx
cmp ax, cx
je 0x40344f
push esi
push ebx
push 0xfffffffffffffffe
push dword [ebp - 4]
jmp 0x403460
movzx eax, word [ebp + 8]
jmp 0x40347a
cmp word [edi], bx
je case.0x4021fa.11
push dword [ebp - 0x1c]
push ebx
push 2
call fcn.004039ee
push eax
push edi
call fcn.004099b6
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x24], ebx
jl case.0x4021fa.11
push eax
push esi
jmp 0x40388b
cmp word [edi], bx
je case.0x4021fa.11
push edi
call fcn.004099b6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x4021fa.11
cmp word [esi], bx
je 0x4024b1
lea eax, [ebp - 0x2a4]
push eax
push esi
call fcn.004099b6
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4024b1
lea eax, [ebp - 0x278]
push eax
push edi
jmp 0x402924
push 2
call fcn.00403a0d
lea ecx, [ebp - 0x2a4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x403660
xor eax, eax
mov word [esi], ax
jmp 0x403312
push eax
push esi
call fcn.00409aac
jmp 0x40362f
push 0xfffffffffffffff0
mov dword [ebp - 4], 0xfffffd66
call fcn.00403a0d
mov esi, eax
push esi
mov dword [ebp - 0x30], esi
call fcn.00409cdf
test eax, eax
jne 0x40368d
push 0xffffffffffffffed
call fcn.00403a0d
push esi
call fcn.00409b59
push 2
push 0x40000000
push esi
call fcn.00409826
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x403763
mov eax, dword [0x431db8]
push eax
push 0x40
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x403755
push ebx
call fcn.00404d15
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00404ce3
push dword [ebp - 0x20]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x3c], edi
test edi, edi
je 0x40372a
push dword [ebp - 0x20]
push edi
push ebx
push dword [ebp - 0x24]
call fcn.00404ed8
cmp byte [edi], bl
je 0x403721
mov ebx, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebx
push eax
call fcn.00409d1b
add edi, esi
cmp byte [edi], 0
jne 0x403703
mov esi, dword [ebp - 0x30]
xor ebx, ebx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push ebx
push edi
push 0xffffffffffffffff
call fcn.00404ed8
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
test eax, eax
jns 0x40376d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
sar eax, 0x1f
and eax, 0xfffffffc
sub eax, 0xd
jmp 0x402f75
push ebx
call fcn.004039ee
mov ebx, eax
cmp ebx, dword [0x431d7c]
jae 0x402322
mov ecx, dword [ebp - 0x20]
imul edi, ebx, 0x4020
add edi, dword [0x431d78]
test ecx, ecx
js 0x4037b5
mov eax, dword [edi + ecx*4]
jne 0x4035e8
lea eax, [edi + 0x18]
push eax
push esi
jmp 0x402924
or eax, 0xffffffff
sub eax, ecx
mov dword [ebp - 0x20], eax
je 0x4037cd
push 1
call fcn.004039ee
mov ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x4037e3
push dword [ebp - 0x18]
lea eax, [edi + 0x18]
push eax
call fcn.00408ecc
or dword [edi + 8], 0x100
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [edi + eax*4], ecx
cmp dword [ebp - 0x1c], 0
je case.0x4021fa.11
push ebx
call fcn.00401f71
jmp case.0x4021fa.11
push ebx
call fcn.004039ee
mov edx, eax
cmp edx, 0x20
jae 0x402322
cmp dword [ebp - 0x1c], ebx
je 0x403833
cmp dword [ebp - 0x20], ebx
je 0x403828
push edx
call fcn.00401fe3
push ebx
push ebx
call fcn.00402033
jmp case.0x4021fa.11
push ebx
call fcn.00401eed
jmp 0x4035e8
mov eax, dword [0x431db0]
cmp dword [ebp - 0x20], ebx
je 0x403849
mov ecx, dword [ebp - 0x24]
mov dword [eax + edx*4 + 0x94], ecx
jmp case.0x4021fa.11
push dword [eax + edx*4 + 0x94]
push esi
call fcn.00408ecc
jmp case.0x4021fa.11
and ecx, dword [0x452540]
push ebx
push ecx
push 0xb
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x28], ebx
je case.0x4021fa.11
mov eax, dword [ebp - 8]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x4021fa.11
push 1
call fcn.00403a0d
push eax
call fcn.00408b64
push eax
push edi
call fcn.00409aac
mov eax, dword [ebp - 4]
add dword [0x41dc70], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4