Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, str.Continue_
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e460]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e3f4]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e408]
call fcn.00404068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40e45c]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40e49c]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40e484]
call fcn.00404068
mov edx, str.Password
lea ecx, [0x40e4a0]
call fcn.00404068
mov edx, str.Please_enter_the_password.
lea ecx, [0x40e434]
call fcn.00404068
call fcn.0040633f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40e49c]
push dword [0x40e4b4]
call fcn.004048a4
jmp 0x401fd0
lea eax, [0x403274]
push eax
call fcn.00405330
call fcn.00404d33
mov dword [0x40e490], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e440], eax
mov edx, dword [0x40e7a8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407ec0
push 0x40e48c
call fcn.0040ab90
push dword [0x40e48c]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x40e490]
and ebx, ebx
jle 0x401333
mov dword [0x40e420], 0
mov ebx, dword [0x40e490]
dec ebx
cmp ebx, dword [0x40e420]
jl 0x4012b6
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e420]
call fcn.00404ce5
push 0x40e478
call fcn.0040ab90
push dword [0x40e478]
mov edx, str._b2epass
pop ecx
call fcn.0040ac10
je 0x40127a
mov dword [0x40e414], 1
jmp 0x4012aa
mov ebx, dword [0x40e414]
cmp ebx, 1
jne 0x4012aa
mov edx, dword [0x40e478]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e4a8
call fcn.0040ab90
mov dword [0x40e414], 0
inc dword [0x40e420]
jno 0x40122f
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407ec0
inc dword [0x40e7a8]
mov edx, dword [0x40d338]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e7a8]
push eax
call fcn.00407ec0
push 0x40e438
call fcn.0040ab90
mov edx, dword [0x40e48c]
push dword [0x40e7a8]
call fcn.0040ac40
mov edx, 0x40d01f
call fcn.0040ac40
mov edx, dword [0x40e438]
call fcn.0040ac40
push 0x40e438
call fcn.0040ab90
jmp 0x40134e
mov edx, dword [0x40e48c]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e438
call fcn.0040ab90
push 0x40d085
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401379
mov eax, dword [0x40e3e4]
mov dword [0x40e470], eax
push dword [0x40e470]
call fcn.00403297
jmp 0x401399
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp 0x401fd5
push str.NOPSX
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x4013d2
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3f8]
push dword [0x40e3e4]
call fcn.00407f10
push 0x40e458
call fcn.0040ab90
jmp 0x4013f2
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp 0x401fd5
push 0x40d06c
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401426
mov eax, dword [0x40e3e4]
mov dword [0x40e424], eax
mov eax, dword [0x40e3f8]
mov dword [0x40e3e8], eax
mov eax, dword [0x40e424]
mov dword [0x40e498], eax
jmp 0x401446
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp 0x401fd5
push 0x40d072
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401478
mov eax, dword [0x40e3e4]
mov dword [0x40e42c], eax
mov eax, dword [0x40e3f8]
mov dword [0x40e430], eax
mov eax, dword [0x40e42c]
mov dword [0x40e46c], eax
push 0x40d070
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x4014aa
mov eax, dword [0x40e3e4]
mov dword [0x40e428], eax
mov eax, dword [0x40e3f8]
mov dword [0x40e3ec], eax
mov eax, dword [0x40e428]
mov dword [0x40e4b8], eax
push 0x40d087
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401742
mov edx, dword [0x40e4a8]
xor ecx, ecx
call fcn.0040ac10
jne 0x4014f1
mov edx, dword [0x40e4a8]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e480
call fcn.0040ab90
jmp 0x401665
push 0xc80001
push dword [0x40e4a0]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00406890
push dword [0x40e434]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00405a73
push 0x20
push 0x40d01e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00405c4c
push 0x40d1fc
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00405f59
push 4
push 0xd
push 0
call fcn.004068b3
push 2
call fcn.00405f79
call fcn.00406ab7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4015d1
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401619
call fcn.00408adc
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401616
mov edx, dword [0x40e7a8]
push edx
push edx
push 2
call fcn.00405fb4
push 0x40e480
call fcn.0040ab90
push 0
call fcn.00406453
add esp, 8
jmp 0x401665
pop eax
jmp 0x40165f
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40165f
call fcn.00408aeb
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40165e
mov edx, dword [0x40e7a8]
push edx
push edx
push 2
call fcn.00405fb4
push 0x40e480
jmp loc.00414212
pop eax
pop eax
jmp 0x4015a7
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e480]
call fcn.004040c0
push eax
mov eax, dword [0x40e480]
push eax
call fcn.004094a0
inc dword [0x40e7a8]
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3f8]
push dword [0x40e3e4]
call fcn.00407f10
pop edx
pop ecx
mov dword [0x40e7a8], ecx
add ecx, dword [0x40d338]
add edx, dword [0x40d338]
call fcn.0040ac10
jne 0x4016e9
push 0x10
push dword [0x40e488]
push dword [0x40e4b4]
call fcn.004048a4
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401fd5
push 0x40d089
push dword [0x40e440]
jmp loc.00414414
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3e8]
push dword [0x40e498]
call fcn.00407f10
push 0x40e454
call fcn.0040ab90
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e430]
push dword [0x40e46c]
call fcn.00407f10
push 0x40e40c
jmp loc.00414000
push 0
call 0x401fef
call fcn.0040ab60
push dword [0x40e3d8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405480
call fcn.00405801
call fcn.00406569
call fcn.004075df
call fcn.00407ddd
call fcn.004082ea
call fcn.004083b0
call fcn.00408dde
call fcn.00407eb0
ret