Function at 0x4014cf
Capabilities:
Copy file
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x298
mov eax, dword [esp + 0x2ac]
mov ecx, dword [0x40a008]
mov ecx, dword [ecx]
mov dword [esp + 4], ecx
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0xc]
lea eax, [esp + 0x14]
movups xmmword [eax - 4], xmm0
movups xmmword [eax + 8], xmm1
mov esi, dword [eax - 4]
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
mov dword [0x42c130], eax
lea eax, [esi - 2]
mov dword [esp], 0
cmp eax, 0x44
ja case.0x40153c.67
mov ecx, dword [0x40ae14]
mov ecx, dword [ecx]
mov edx, ebp
shl edx, 0xe
add edx, ecx
mov edi, ebx
shl edi, 0xe
add edi, ecx
mov dword [esp], 0
jmp dword [eax*4 + 0x40a010]
mov dword [esp + 8], edx
mov ecx, 3
call fcn.00403793
mov ebx, eax
mov ecx, 4
call fcn.00403793
mov ebp, eax
mov eax, dword [esp + 0x28]
test al, 1
je 0x40157f
mov eax, dword [0x42c130]
push dword [eax + 0xc]
push 0x4240f0
call fcn.00407b44
mov ebx, eax
mov eax, dword [esp + 0x28]
test al, 2
je 0x401597
mov eax, dword [0x42c130]
push dword [eax + 0x10]
push 0x4280f0
call fcn.00407b44
mov ebp, eax
cmp dword [esp + 0x10], 0x21
jne 0x401795
xor ecx, ecx
inc ecx
call fcn.00403793
mov esi, eax
mov ecx, 2
call fcn.00403793
mov ecx, dword [esp + 0x28]
cmp ecx, 4
jae 0x402c3e
push ebp
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x48], eax
xor edi, edi
jmp 0x402c5c
mov ebp, dword [esp + 0x1c]
cmp esi, 0x38
sete byte [esp]
test ebp, ebp
mov dword [esp + 8], edx
je 0x402c07
xor ecx, ecx
inc ecx
call fcn.00403793
xor ecx, ecx
cmp esi, 0x38
mov word [0x41c0f0], ax
setne cl
inc ecx
jmp 0x402d73
mov ecx, 2
mov esi, edx
call fcn.00403793
mov dword [esp], 0
test eax, eax
jle case.0x40153c.67
mov ecx, esi
mov edx, 0x1fff
cmp eax, edx
cmovl edx, eax
mov dword [esp + 4], edx
cmp word [esi], 0
je 0x402d28
mov ebp, 2
push ecx
call fcn.00407f8b
mov dword [esp], eax
xor esi, esi
mov ebx, edi
xor edi, edi
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x10], 0x39
jne 0x40171f
mov eax, 2
sub eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x4c]
push ecx
push eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40346e
mov ebp, dword [esp + 0x48]
test ebp, ebp
je 0x40346e
movzx eax, byte [esp + 0x34]
mov word [esp + 0xc], ax
cmp dword [esp + 0x20], 0
jne 0x40338c
mov dword [esp + 0x30], esi
mov dword [esp + 8], edi
push 1
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x40]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401711
xor edi, edi
inc edi
sub edi, ebp
mov word [esp + 0xc], 0xfffd
dec dword [esp + 0x48]
je 0x401711
dec ebp
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
lea eax, [esp + 0x40]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc edi
test eax, eax
je 0x4016d4
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
jmp 0x401752
mov eax, dword [esp + 0x20]
or eax, edi
jne 0x40173a
push 0
push dword [esp + 4]
call fcn.004078ab
test eax, eax
js 0x403721
push 2
lea eax, [esp + 0x10]
push eax
push dword [esp + 8]
call fcn.00407847
test eax, eax
je 0x40346e
cmp dword [esp + 0x20], 0
jne 0x40338c
cmp si, 0xd
je 0x403314
movzx eax, si
cmp eax, 0xa
je 0x403314
movzx esi, word [esp + 0xc]
mov word [ebx + edi*2], si
inc edi
test si, si
je 0x40346e
cmp edi, dword [esp + 4]
jl 0x401658
jmp 0x40346e
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x4180f0
call fcn.00407b44
mov esi, eax
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x41c0f0
call fcn.00407b44
xor ecx, ecx
cmp word [esi], 0
cmove esi, ecx
cmp word [eax], 0
mov edi, 0
cmove eax, ecx
push eax
push esi
push ebp
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x48], eax
jmp 0x402c5c
mov ebx, edi
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x40316d
mov dword [esp], 0
test eax, eax
jne case.0x40153c.67
push 5
call fcn.00406f3d
mov esi, eax
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x4200f0
call fcn.00407b44
test esi, esi
je 0x403271
lea edi, [esp + 0x48]
push edi
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x403271
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x28]
push edi
call esi
test eax, eax
js 0x403271
push dword [esp + 0xc]
push ebx
call fcn.00407432
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x403562
push 0x20019
mov esi, edx
call fcn.004037b0
mov edi, eax
mov eax, dword [0x42c130]
push dword [eax + 0xc]
push 0x4240f0
call fcn.00407b44
mov word [esi], 0
test edi, edi
je 0x4034ed
mov ebx, esi
lea ecx, [esp + 0x48]
mov dword [ecx], 0x4000
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x403294
mov word [ebx], 0
xor ebp, ebp
inc ebp
jmp 0x40353f
mov esi, edx
push 0xffffffffffffffed
call fcn.00403753
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call fcn.004077a7
cmp eax, 0xffffffff
jne 0x401ec3
jmp 0x4029af
mov dword [esp + 0x2c], edi
push ebp
push 0x4180f0
call fcn.00407b44
mov edi, eax
push eax
push str.Exec:_command__s_
call fcn.00407485
add esp, 8
push edi
push 0xffffffffffffffeb
call fcn.00406aa5
push edi
call fcn.00406f76
test eax, eax
je 0x402dd3
mov esi, eax
push edi
push str.Exec:_success____s__
call fcn.00407485
add esp, 8
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x40348c
push esi
call fcn.004083d0
cmp dword [esp + 0x18], 0
js 0x403485
push eax
push dword [esp + 0x30]
call fcn.00407f72
jmp 0x40348c
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp], eax
push dword [esp + 0x1c]
push 0x4180f0
call fcn.00407b44
mov dword [esp + 4], eax
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x41c0f0
call fcn.00407b44
mov ebx, eax
push ebp
call fcn.00408121
add esp, 4
mov edi, eax
push ebx
push ebp
call fcn.00403857
test eax, eax
je 0x402dde
mov ebp, eax
mov dword [esp + 8], edi
cmp esi, 4
mov dword [esp + 0x2c], ebx
je 0x40342b
cmp esi, 3
je 0x4033bc
xor ebx, ebx
cmp esi, 1
mov edi, dword [esp + 4]
mov esi, dword [esp + 8]
jne 0x4035e8
mov eax, dword [0x42c130]
mov esi, 0x4200f0
push dword [eax + 0xc]
push esi
call fcn.00407b44
push esi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [eax*2 + 2]
cmp dword [esp], 1
jne 0x4035c8
push 0x4200f0
mov edi, dword [esp + 8]
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegStr:___s_s____s___s_
jmp 0x4035e0
push ebp
push 0x4180f0
mov ebx, ecx
call fcn.00407b44
mov dword [esp], eax
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x4240f0
call fcn.00407b44
mov edi, eax
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x4200f0
call fcn.00407b44
mov ebp, eax
mov eax, dword [0x42c130]
mov esi, 0x41c0f0
push dword [eax + 0x14]
push esi
call fcn.00407b44
push esi
mov esi, dword [esp + 4]
push 0xffffffffffffffec
call fcn.00406aa5
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x48]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 4]
mov dword [eax + 8], edx
mov dword [eax + 0x1c], ecx
xor ecx, ecx
cmp word [esi], 0
mov edx, esi
cmove edx, ecx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edi
cmp word [ebp], 0
mov edx, ebp
cmove edx, ecx
mov dword [eax + 0x14], edx
add ebx, 0x58000
mov dword [eax + 0x18], ebx
push eax
call fcn.00406fdf
test eax, eax
je 0x402df2
test byte [esp + 0x4c], 0x40
je 0x401ae3
push dword [esp + 0x80]
call fcn.004083d0
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push edi
push esi
push str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.00407485
add esp, 0x10
jmp 0x403562
mov ebp, dword [esp + 4]
push ebp
mov ebx, edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov ecx, 2
call fcn.00403793
mov esi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x48
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x42c138], eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 3
call fcn.00403793
mov dword [0x42c148], eax
mov al, byte [esp + 0x24]
mov ecx, eax
and cl, 1
mov byte [0x42c14c], cl
mov ecx, eax
and cl, 2
mov byte [0x42c14d], cl
and al, 4
mov byte [0x42c14e], al
mov byte [0x42c14f], 1
push dword [esp + 0x18]
push 0x42c154
call fcn.00407b44
push 0x42c138
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
jmp 0x4031a9
push ebp
push 0x4180f0
call fcn.00407b44
mov edi, eax
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x41c0f0
call fcn.00407b44
mov ebx, eax
mov eax, dword [0x42c130]
push dword [eax + 0xc]
push 0x4200f0
call fcn.00407b44
mov esi, eax
push ebx
push edi
push str.CopyFiles___s_____s_
call fcn.00407485
add esp, 0xc
push edi
call fcn.004074f3
test eax, eax
je 0x401c31
mov dword [esp], esi
lea esi, [esp + 0x48]
mov eax, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], 2
push edi
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
push ebx
call sub.KERNEL32.dll_lstrlenW
xor ebp, ebp
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov ecx, dword [esp]
mov dword [esi + 0x1a], ecx
movzx eax, word [esp + 0x1c]
mov word [esi + 0x10], ax
push ecx
push 0
call fcn.00406aa5
push esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x401c3d
push 0
push 0xfffffffffffffff9
call fcn.00406aa5
xor ebp, ebp
inc ebp
mov dword [esp], ebp
jmp case.0x40153c.67
mov ebx, edi
xor ecx, ecx
call fcn.00403793
mov esi, eax
mov eax, dword [0x40a00c]
cmp dword [eax + 0xc], esi
jbe 0x4034ed
mov eax, dword [eax + 8]
imul ecx, esi, 0x4018
lea edi, [eax + ecx]
mov edx, dword [esp + 0x1c]
test edx, edx
js 0x40333d
je 0x403548
push dword [edi + edx*4]
jmp 0x4031a9
mov dword [esp], ecx
push ebx
push 0x4240f0
call fcn.00407b44
mov edi, eax
mov eax, dword [esp + 0x14]
mov ebp, eax
and ebp, 7
shr eax, 3
and eax, 2
push edi
push eax
push ebp
push str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
call fcn.00407485
add esp, 0x10
push edi
call fcn.0040757d
test eax, eax
mov dword [esp + 4], edi
je 0x402e0e
push edi
push 0x4180f0
call fcn.00407432
jmp 0x402e2e
xor ecx, ecx
inc ecx
mov edi, edx
call fcn.00403793
mov esi, eax
mov ecx, 2
call fcn.00403793
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x40355b
push 0xfffffffffffffff0
call fcn.00403753
mov esi, eax
push eax
push str.RMDir:___s_
jmp 0x401f03
push dword [ebx*4 + 0x4180b0]
push edx
jmp 0x40355d
push ebx
push 0x4180f0
mov esi, edx
call fcn.00407b44
mov edi, eax
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
test eax, eax
je 0x401d52
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x401d5a
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, esi
test eax, eax
jne 0x401d5a
mov word [ecx], 0
xor ebx, ebx
inc ebx
mov dword [esp], ebx
mov word [ecx + 0x3ffe], 0
jmp case.0x40153c.67
mov ecx, 2
mov dword [esp + 8], edx
call fcn.00403793
mov edi, eax
mov esi, edx
mov ecx, 3
call fcn.00403793
mov ebx, eax
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x4180f0
call fcn.00407b44
mov ebp, eax
push eax
call sub.KERNEL32.dll_lstrlenW
mov edx, dword [esp + 8]
mov word [edx], 0
test esi, esi
cmove edi, eax
mov dword [esp], 0
test edi, edi
je case.0x40153c.67
mov ecx, ebx
sar ecx, 0x1f
and ecx, eax
add ecx, ebx
mov dword [esp], 0
js case.0x40153c.67
cmp ecx, eax
cmovl eax, ecx
lea eax, [ebp + eax*2]
push eax
push edx
mov esi, edx
call fcn.00407432
test edi, edi
jns 0x401df4
push esi
call sub.KERNEL32.dll_lstrlenW
add edi, eax
mov dword [esp], 0
cmp edi, 0x1fff
mov eax, dword [esp + 8]
jg case.0x40153c.67
xor ecx, ecx
test edi, edi
mov dword [esp], 0
cmovle edi, ecx
mov word [eax + edi*2], 0
jmp case.0x40153c.67
mov ebx, edi
mov edi, edx
push dword [esp + 0x1c]
push 0x4180f0
call fcn.00407b44
push eax
call fcn.004074f3
test eax, eax
je 0x402f32
mov esi, eax
push dword [eax + 0x14]
push ebx
call fcn.00407f72
push dword [esi + 0x18]
jmp 0x40355c
push ebp
push 0x4180f0
call fcn.00407b44
mov esi, eax
push eax
call fcn.004074f3
test eax, eax
je 0x402f3f
push dword [esp + 0x18]
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.00407485
add esp, 0xc
jmp 0x4028e3
push ebx
push 0x4180f0
mov edi, edx
call fcn.00407b44
mov esi, eax
mov ecx, 2
call fcn.00403793
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x402fad
push ebx
push 0x4180f0
mov esi, edx
call fcn.00407b44
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
push esi
jmp 0x40355d
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x4180b0]
xor edx, edx
test ecx, ecx
sete dl
mov esi, dword [esp + edx*4 + 0x14]
and ecx, dword [esp + 0x20]
mov dword [eax*4 + 0x4180b0], ecx
jmp 0x403574
push ebp
push 0x4180f0
call fcn.00407b44
mov esi, eax
push eax
push str.Delete:___s_
call fcn.00407485
add esp, 8
push dword [esp + 0x18]
push esi
call fcn.00407104
jmp 0x403562
push 0xffffffffffffffee
mov dword [esp + 0xc], edx
call fcn.00403753
mov esi, eax
push 0xa
call fcn.00406f3d
lea ecx, [esp + 0x48]
push ecx
push esi
call eax
mov ebp, eax
xor eax, eax
mov ecx, dword [esp + 8]
mov word [ecx], ax
mov dword [esp + 0x2c], edi
mov word [edi], ax
xor ebx, ebx
inc ebx
test ebp, ebp
je 0x4030c7
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4030c7
mov edi, eax
push 0xb
call fcn.00406f3d
mov ebx, eax
push 0xc
call fcn.00406f3d
mov dword [esp], eax
push edi
push ebp
push 0
push esi
call ebx
xor ebx, ebx
inc ebx
test eax, eax
je 0x401fcb
lea eax, [esp + 0x34]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x40a90c
push edi
call dword [esp + 0x10]
test eax, eax
je 0x401fcb
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 8]
push dword [esp + 0xc]
call fcn.00407f72
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 0xc]
push dword [esp + 0x30]
call fcn.00407f72
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4030c7
mov eax, dword [0x40ae10]
inc dword [eax]
mov esi, 0x7fffffff
cmp dword [esp + 4], 0
je 0x403574
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x403574
mov esi, dword [0x42c134]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402f53
test esi, esi
je 0x402d32
lea ecx, [eax - 1]
mov esi, dword [esi]
add ecx, 0xffffffff
jae 0x402023
test esi, esi
jne 0x402018
test esi, esi
je 0x402d32
add esi, 4
mov edi, 0x4180f0
push esi
push edi
call fcn.00407432
mov eax, dword [0x42c134]
add eax, 4
push eax
push esi
call fcn.00407432
mov eax, dword [0x42c134]
add eax, 4
push edi
push eax
jmp 0x402b8b
mov dword [esp], 0
xor ecx, ecx
call fcn.00403793
mov esi, eax
push eax
push str.Sleep__d_
call fcn.00407485
add esp, 8
xor eax, eax
inc eax
cmp esi, 2
cmovge eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40153c.67
cmp dword [esp + 0x1c], 0
je 0x402f80
mov eax, dword [ebp*4 + 0x42c0f4]
mov dword [ebp*4 + 0x4180b0], eax
jmp 0x403562
push ebp
push 0x4200f0
call fcn.00407b44
mov esi, eax
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x4240f0
call fcn.00407b44
cmp dword [esp + 0x24], 0
je 0x402fb5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x402fbd
cmp ebp, 0xbadf00d
jne 0x402d40
inc dword [0x4180c4]
jmp 0x403562
push ebp
push 0x40a15c
call fcn.00407485
add esp, 8
mov esi, dword [esp + 0x14]
jmp 0x403574
xor ecx, ecx
call fcn.00403793
mov edi, eax
xor ecx, ecx
inc ecx
call fcn.00403793
mov esi, eax
cmp dword [esp + 0x1c], 0
je 0x402135
push str.HideWindow
call fcn.00407485
add esp, 4
cmp dword [esp + 0x20], 0
je 0x402fce
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x403562
push ebx
call fcn.00408121
add esp, 4
mov edi, eax
cmp dword [esp + 0x24], 0
je 0x402fdb
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x4200f0
call fcn.00407b44
mov esi, eax
push eax
push edi
push str.DeleteRegKey:___s_s_
call fcn.00407485
add esp, 0xc
mov eax, dword [esp + 0x24]
sar eax, 1
push eax
push esi
push ebx
call fcn.004037ff
mov ebp, eax
jmp 0x403025
push ebp
push 0x4180f0
call fcn.00407b44
push eax
push str.Aborting:___s_
call fcn.00407485
add esp, 8
push 0
push dword [esp + 0x18]
call fcn.00406aa5
jmp 0x402d54
push str.BringToFront
call fcn.00407485
add esp, 4
push dword [esp + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403562
mov eax, dword [0x40ae1c]
mov eax, dword [eax]
test eax, eax
je 0x4021f3
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x40ae18]
mov eax, dword [eax]
mov dword [esp], 0
test eax, eax
je case.0x40153c.67
push dword [esp + 0x14]
push eax
jmp 0x402fd0
mov esi, 0x41c0f0
push str._RM_
push esi
call fcn.00407432
push esi
push 0x4200f0
call fcn.00407432
xor ebx, ebx
cmp dword [esp + 0x14], 0
mov edi, 0
je 0x40224f
mov eax, dword [0x42c130]
push dword [eax]
push 0x4180f0
call fcn.00407b44
mov edi, eax
cmp dword [esp + 0x18], 0
je 0x40226a
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x41c0f0
call fcn.00407b44
mov ebx, eax
cmp dword [esp + 0x24], 0
je 0x403031
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x4200f0
call fcn.00407b44
mov ebp, eax
jmp 0x403033
push 0xffffffffffffffd0
call fcn.00403753
mov edi, eax
push 0xffffffffffffffdf
call fcn.00403753
mov ebp, eax
mov eax, dword [0x42c130]
push dword [eax + 0xc]
push 0x41c0f0
call fcn.00407b44
mov ebx, eax
push eax
push str.Rename:__s
call fcn.00407485
add esp, 8
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x403072
push 0x41c0f0
push 0xffffffffffffffe3
jmp 0x402391
push ebp
push 0x4180f0
call fcn.00407b44
mov esi, eax
lea eax, [esp + 0x48]
push eax
push edi
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
mov eax, edi
je 0x4030a9
mov edi, eax
mov eax, dword [esp + 0x48]
xor ebx, ebx
cmp eax, esi
jbe 0x4030b3
cmp word [eax], 0
je 0x4030b3
push esi
call fcn.004074f3
test eax, eax
je 0x403629
add eax, 0x2c
push eax
push dword [esp + 0x4c]
call fcn.00407432
jmp 0x4030b3
test ebp, ebp
jns 0x402354
not ebp
shl ebp, 0xe
add ecx, ebp
push ecx
call fcn.00407f8b
mov ebp, eax
dec ebp
push ebp
push str.Call:__d
call fcn.00407485
add esp, 8
push 0
push ebp
call fcn.004013ec
mov esi, eax
jmp 0x403574
push ebp
push 0x4180f0
call fcn.00407b44
push eax
push str.DetailPrint:__s
call fcn.00407485
add esp, 8
push 0
push dword [esp + 0x18]
call fcn.00406aa5
jmp 0x403562
mov eax, dword [0x40a00c]
add ebx, dword [eax + 0x28]
mov dword [esp], 0
xor ecx, ecx
call fcn.00403793
push ebx
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40153c.67
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403753
mov edi, eax
push dword [esp + 0x18]
push eax
push str.CreateDirectory:___s____d_
call fcn.00407485
add esp, 0xc
push edi
call fcn.004075ae
xor esi, esi
test eax, eax
je 0x40247a
push 0x5c
push eax
call fcn.0040754a
mov ebx, eax
movzx ebp, word [eax]
mov word [eax], 0
test bp, bp
jne 0x40241d
cmp dword [esp + 0x1c], 0
je 0x40241d
call fcn.00406f23
test eax, eax
je 0x40241d
push edi
call fcn.00406e88
jmp 0x402423
push edi
call fcn.00406f05
test eax, eax
je 0x402449
cmp eax, 0xb7
jne 0x402459
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x402469
push edi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.00407485
add esp, 8
jmp 0x402468
push edi
push str.CreateDirectory:___s__created
call fcn.00407485
add esp, 8
jmp 0x402469
push eax
push edi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.00407485
add esp, 0xc
inc esi
mov eax, ebx
add eax, 2
mov word [ebx], bp
test bp, bp
jne 0x4023ee
cmp dword [esp + 0x18], 0
je 0x4030cf
push 0x41c0f0
push 0xffffffffffffffe6
call fcn.00406aa5
mov eax, dword [esp]
add eax, 0x58000
push edi
push eax
call fcn.00407432
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4030db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.SetCurrentDirectory__s__failed___d_
call fcn.00407485
add esp, 0xc
inc esi
jmp 0x4030db
push 0xfffffffffffffff0
call fcn.00403753
mov esi, eax
push dword [esp + 0x18]
push eax
push str.SetFileAttributes:___s_:_08X
call fcn.00407485
add esp, 0xc
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [esp], 0
test eax, eax
jne case.0x40153c.67
push str.SetFileAttributes_failed.
jmp 0x4030f4
push 0xffffffffffffffef
mov esi, edx
call fcn.00403753
push eax
push esi
call fcn.004077d9
jmp 0x403063
push 0xffffffffffffffff
mov esi, edx
call fcn.00403753
lea ecx, [esp + 0x48]
xor edi, edi
push ecx
push esi
push 0x2000
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x402c71
mov word [esi], 0
xor edi, edi
inc edi
jmp 0x402c71
cmp dword [0x42c12c], 0
js 0x4030e3
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403753
mov esi, eax
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x4180f0
call fcn.00407b44
mov ebp, eax
cmp dword [esp + 0x24], 0
je 0x402593
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x4025a8
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test eax, eax
je 0x4034d3
push ebp
push edi
call fcn.0040838a
test eax, eax
je 0x40339d
mov ebx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403583
push 0x41c0f0
push eax
call fcn.00406aa5
call ebx
xor ebx, ebx
test eax, eax
setne bl
jmp 0x4035a1
cmp word [edx], 0
mov dword [esp], 0
je case.0x40153c.67
push edx
call fcn.00407f8b
mov esi, eax
mov ecx, 2
call fcn.00403793
push dword [esp + 0x20]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x18], 0
mov dword [esp], 0
jns 0x40355b
jmp case.0x40153c.67
push 0xfffffffffffffff0
call fcn.00403753
mov edi, eax
push eax
call fcn.0040757d
test eax, eax
jne 0x402640
push 0xffffffffffffffed
call fcn.00403753
push edi
call fcn.004070dc
push 2
push 0x40000000
push edi
call fcn.004077a7
cmp eax, 0xffffffff
je 0x403101
mov ebx, eax
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0
je 0x40270f
mov eax, dword [0x40ae08]
mov eax, dword [eax]
mov dword [esp], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x40270f
mov ebp, eax
push 0
call fcn.00403e37
push dword [esp]
push ebp
call fcn.00403e21
push dword [esp + 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test eax, eax
mov eax, dword [esp]
je 0x4026fd
mov dword [esp + 8], ebx
push dword [esp + 0x1c]
push esi
push 0
push dword [esp + 0x24]
call fcn.00403e4e
mov dword [esp + 4], esi
cmp byte [esi], 0
je 0x4026ec
mov esi, dword [esp + 4]
mov ebx, dword [esi]
lea eax, [esi + 8]
mov ecx, dword [esi + 4]
add ecx, ebp
push ebx
push eax
push ecx
call fcn.00407783
add esi, ebx
add esi, 8
cmp byte [esi], 0
jne 0x4026d0
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 8]
mov eax, dword [esp]
push eax
push ebp
push ebx
call fcn.00407879
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
dec esi
mov ebp, ebx
xor ebx, ebx
push ebx
push ebx
push ebp
push esi
call fcn.00403e4e
mov esi, eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push esi
push str.created_uninstaller:__d____s_
call fcn.00407485
add esp, 0xc
mov eax, 0xfffffff3
test esi, esi
jns 0x403123
jmp 0x403114
test ebp, ebp
je 0x403131
push ebx
push str.settings_logging_to__d
call fcn.00407485
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [0x40ae20]
mov dword [ecx], eax
push eax
push str.logging_set_to__d
call fcn.00407485
add esp, 8
cmp dword [esp + 0x18], 0
je 0x4032b6
call fcn.00404884
jmp 0x403562
push ebx
push 0x4240f0
call fcn.00407b44
mov esi, eax
push eax
push dword [esp + 0x18]
push str.MessageBox:__d___s_
call fcn.00407485
add esp, 0xc
push dword [esp + 0x14]
push esi
call fcn.00407019
test eax, eax
je 0x4034ed
cmp eax, dword [esp + 0x1c]
je 0x403157
mov dword [esp], 0
cmp eax, dword [esp + 0x24]
jne case.0x40153c.67
mov esi, dword [esp + 0x28]
jmp 0x403574
xor ecx, ecx
call fcn.00403793
cmp eax, 0x1f
ja 0x4034ed
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x1c]
je 0x40335d
test ecx, ecx
je 0x403554
push eax
call fcn.00401304
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
call fcn.00401248
jmp case.0x40153c.67
mov ebx, edx
xor esi, esi
inc esi
mov ecx, esi
call fcn.00403793
mov edi, eax
mov ecx, 2
call fcn.00403793
mov ecx, eax
xor ebp, ebp
mov eax, dword [esp + 0x20]
cmp eax, 0xd
ja case.default.0x40284c
jmp dword [eax*4 + 0x40a124]
add edi, ecx
jmp case.default.0x40284c
mov edi, dword [esp + 0x28]
xor ecx, ecx
call fcn.00403793
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.00403793
test edi, edi
je 0x40314f
cmp esi, eax
jb 0x403157
jbe 0x402fc5
jmp 0x403383
push edx
call fcn.00407f8b
mov dword [esp], 0
test eax, eax
je case.0x40153c.67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403562
mov dword [esp + 8], edx
test byte [esp + 0x21], 1
jne 0x402c79
push dword [esp + 0x1c]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402c83
xor ecx, ecx
call fcn.00403793
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402fc5
mov esi, dword [esp + 0x18]
jmp 0x403574
mov eax, dword [0x40ae2c]
and ebp, dword [eax]
push 0
push ebp
push 0xb
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x14], 0
mov dword [esp], 0
je case.0x40153c.67
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x40153c.67
lea eax, [esp + 0x48]
mov dword [eax], 0xa
push ebx
push 0x4180f0
mov ebp, edx
call fcn.00407b44
mov edi, eax
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x41c0f0
call fcn.00407b44
mov esi, eax
push 0xffffffffffffffdd
call fcn.00403753
push eax
push 0x1fff
push ebp
lea eax, [esp + 0x54]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp word [ebp], 0xa
jne 0x4034f0
mov word [ebp], 0
jmp 0x4034ed
mov esi, edx
push edi
call fcn.00407f8b
test eax, eax
je 0x4029af
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402b85
mov word [esi], 0
jmp 0x4034ed
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403753
mov dword [esp + 4], eax
push 0xffffffffffffffdf
call fcn.00403753
mov esi, eax
mov eax, dword [0x42c130]
push dword [eax + 8]
push 0x4180f0
call fcn.00407b44
mov dword [esp + 8], eax
push 0xffffffffffffffcd
call fcn.00403753
mov dword [esp + 0x2c], eax
mov eax, dword [0x42c130]
push dword [eax + 0x14]
push 0x4280f0
call fcn.00407b44
mov dword [esp + 0x44], eax
mov ebp, dword [esp + 0x24]
mov ebx, ebp
and ebx, 0xfff
mov edi, ebp
shr edi, 0xc
and edi, 7
mov dword [esp + 0x38], ebp
shr ebp, 0x10
mov dword [esp + 0x30], esi
push esi
call fcn.0040757d
test eax, eax
jne 0x402a42
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x4200f0
call fcn.00407b44
mov dword [esp + 0x3c], ebp
push ebp
push edi
mov dword [esp + 0x48], ebx
push ebx
push dword [esp + 0x38]
push dword [esp + 0x18]
mov ebx, dword [esp + 0x44]
push ebx
push dword [esp + 0x1c]
push str.CreateShortcut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
call fcn.00407485
add esp, 0x20
lea eax, [esp + 0x48]
mov ecx, dword [0x40ae04]
mov edx, dword [0x40adfc]
push eax
push ecx
push 1
push 0
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
xor esi, esi
inc esi
mov ebp, 0xfffffff0
test eax, eax
js 0x4034c0
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push dword [0x40ae00]
push eax
call dword [ecx]
mov edx, dword [esp + 0x48]
mov ecx, dword [edx]
test eax, eax
js 0x4032c2
push ebx
push edx
call dword [ecx + 0x50]
mov dword [esp + 0x30], eax
cmp word [esp + 0x38], 0
js 0x402adf
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
mov edx, dword [esp]
add edx, 0x58000
push edx
push eax
call dword [ecx + 0x24]
test edi, edi
mov esi, dword [esp + 4]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x40]
je 0x402afa
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push dword [esp + 0x3c]
push eax
call dword [ecx + 0x34]
mov edx, dword [esp + 0x2c]
cmp word [edx], 0
je 0x402b1e
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ebp
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push dword [esp + 0x44]
push eax
call dword [ecx + 0x1c]
cmp dword [esp + 0x30], 0
js 0x40349b
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x18]
mov ebx, eax
shr ebx, 0x1f
jmp 0x40349d
mov esi, edx
push dword [esp + 0x1c]
push 0x4180f0
call fcn.00407b44
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403160
push eax
push edi
call fcn.00407f72
lea eax, [esp + 0x74]
push eax
push esi
call fcn.00407432
jmp 0x403562
push 0x20019
mov esi, edx
call fcn.004037b0
mov edi, eax
mov ecx, 3
call fcn.00403793
mov word [esi], 0
test edi, edi
je 0x4034ed
mov edx, esi
mov dword [esp + 0x48], 0x1fff
cmp dword [esp + 0x24], 0
je 0x4032cb
push 0x1fff
push edx
push eax
push edi
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ebx, ebx
jmp 0x4032f8
push edx
call fcn.00407f8b
mov dword [esp], 0
test eax, eax
je case.0x40153c.67
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x403562
cmp esi, 0x38
jne 0x402d5e
mov esi, 0x4200f0
push ebx
push esi
call fcn.00407b44
mov edi, 0x41c0f0
push 0x2000
push edi
push esi
call fcn.00408032
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
jmp 0x402d73
sar ecx, 2
lea edx, [esp + 0x48]
push edx
push ecx
push 0
push ebp
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ecx, ecx
test eax, eax
sete cl
mov edi, ecx
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 8]
js 0x402c71
push dword [esp + 0x48]
push ebx
call fcn.00407f72
mov dword [esp], edi
jmp case.0x40153c.67
mov ecx, 2
call fcn.00403793
mov edi, eax
mov ebp, dword [esp + 0x20]
mov ebx, ebp
and ebx, 3
bt ebp, 0x10
jb 0x402c9b
movzx eax, word [esp + 0x18]
jmp 0x402cad
mov eax, dword [0x42c130]
push dword [eax + 4]
push 0x41c0f0
call fcn.00407b44
mov dword [esp], eax
lea esi, [esp + 0x48]
push esi
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, ebp
shl eax, 0x1d
sar eax, 0x1f
mov ecx, dword [0x40ae0c]
and eax, dword [ecx]
mov ecx, ebp
sar ecx, 0x1f
and ecx, dword [esi + 8]
add ebp, ebp
sar ebp, 0x1f
and ebp, dword [esi + 0xc]
mov edx, 0xfef0
and edx, dword [esp + 0x20]
push edx
push ebp
push ecx
push ebx
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
push eax
push ebx
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
jne 0x402d13
test eax, eax
je 0x402d13
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x14], 0
js 0x403562
push esi
push dword [esp + 0xc]
jmp 0x40355d
mov word [edi], 0
jmp 0x4034ed
push eax
push str.Exch:_stack____d_elements
call fcn.00407485
add esp, 8
push 0xffffffffffffffe8
push 0
call fcn.00407b44
push 0x200010
push eax
call fcn.00407019
mov esi, 0x7fffffff
jmp 0x403574
push ebx
push 0x41c0f0
call fcn.00407b44
push eax
call sub.KERNEL32.dll_lstrlenW
mov ecx, eax
add ecx, eax
xor edx, edx
inc edx
mov eax, dword [esp + 8]
cmp word [eax], 0
je 0x402dcb
mov esi, ecx
xor ebx, ebx
mov cl, byte [esp]
mov bl, cl
push eax
call fcn.00407f8b
mov edi, eax
or ebp, ebx
jne 0x402dab
cmp dword [esp + 0x20], 0
je 0x402dab
push edi
push edi
call fcn.004078ab
test eax, eax
js 0x4034ed
push esi
push 0x41c0f0
push edi
call fcn.00407879
mov dword [esp], 0
test eax, eax
jne case.0x40153c.67
jmp 0x4034ed
mov dword [esp], edx
jmp case.0x40153c.67
push edi
push str.Exec:_failed_createprocess____s__
jmp 0x4034e5
push ebx
push edi
push str.WriteReg:_error_creating_key___s_s_
call fcn.00407485
add esp, 0xc
jmp 0x4034ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push edi
push esi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.00407485
add esp, 0x14
jmp 0x4034ed
mov eax, dword [esp]
add eax, 0x58000
push eax
push 0x4180f0
call fcn.00407432
push eax
call fcn.0040751b
push edi
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x4180f0
call fcn.00407623
mov edi, 0x41c0f0
mov esi, 0x4200f0
cmp ebp, 3
jb 0x402e7d
push 0x4180f0
call fcn.004074f3
test eax, eax
je 0x402e66
add eax, 0x14
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x402e68
xor eax, eax
add ebp, 0x7ffffffd
or ebp, 0x80000000
xor ecx, ecx
test eax, ebp
sete cl
mov ebp, ecx
test ebp, ebp
jne 0x402e8b
push 0x4180f0
call fcn.004070dc
xor eax, eax
cmp ebp, 1
setne al
inc eax
push eax
push 0x40000000
push 0x4180f0
call fcn.004077a7
cmp eax, 0xffffffff
jne 0x4031af
test ebp, ebp
jne 0x403243
mov ebp, 0x4180f0
push ebp
push str.File:_error_creating___s_
call fcn.00407485
add esp, 8
mov ebx, dword [esp]
push ebx
push esi
call fcn.00407432
push ebp
push ebx
call fcn.00407432
push dword [esp + 0x28]
push edi
call fcn.00407b44
push esi
push ebx
call fcn.00407432
mov eax, dword [esp + 0x14]
sar eax, 3
push eax
push edi
call fcn.00407019
cmp eax, 4
jne 0x402f11
push str.File:_error__user_retry
call fcn.00407485
add esp, 4
xor ebp, ebp
jmp 0x402e42
cmp eax, 5
jne 0x40327b
push str.File:_error__user_cancel
call fcn.00407485
add esp, 4
inc dword [0x4180b8]
jmp 0x403572
xor eax, eax
mov word [edi], ax
mov word [ebx], ax
jmp 0x4034ed
push dword [esp + 0x1c]
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.00407485
add esp, 0xc
jmp 0x402fc5
test ebx, ebx
je 0x4034f5
test esi, esi
je 0x4035be
lea eax, [esi + 4]
push eax
push edx
call fcn.00407432
mov eax, dword [esi]
mov dword [0x42c134], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403562
mov eax, dword [ebp*4 + 0x4180b0]
mov dword [ebp*4 + 0x42c0f4], eax
xor ecx, ecx
inc ecx
call fcn.00403793
mov ecx, dword [esp + 0x14]
mov dword [ecx*4 + 0x4180b0], eax
push eax
push ecx
push str.SetFlag:__d_d
call fcn.00407485
add esp, 0xc
jmp 0x403562
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403157
mov esi, dword [esp + 0x1c]
jmp 0x403574
push esi
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403562
push 2
call fcn.004037b0
test eax, eax
je 0x4034ed
mov ebx, eax
mov eax, dword [0x42c130]
push dword [eax + 0xc]
push 0x4240f0
call fcn.00407b44
mov esi, eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, eax
push esi
push 0x4200f0
push edi
push str.DeleteRegValue:___s_s____s_
call fcn.00407485
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebp, ebp
setne al
jmp 0x4034f0
xor ebp, ebp
push 0xffffffffffffffcd
call fcn.00403753
mov esi, eax
push eax
push 0x4200f0
push 0x41c0f0
push 0x4180f0
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.00407485
add esp, 0x14
push esi
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp], ecx
jmp case.0x40153c.67
cmp dword [esp + 0x1c], 0
je 0x403309
push edi
call fcn.004074f3
test eax, eax
je 0x403309
push ebp
push edi
call fcn.004074c4
push 0x41c0f0
push 0xffffffffffffffe4
call fcn.00406aa5
push ebx
push str.Rename_on_reboot:__s
jmp 0x403142
mov edi, eax
mov word [eax], 0
xor ebx, ebx
inc ebx
cmp dword [esp + 0x1c], 0
jne 0x4030c7
push 0x2000
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [esp], ebx
jmp case.0x40153c.67
push 0x41c0f0
push 0xfffffffffffffff5
call fcn.00406aa5
mov dword [esp], esi
jmp case.0x40153c.67
push 0x41c0f0
push 0xffffffffffffffe7
call fcn.00406aa5
push str.Error_registering_DLL:_Could_not_initialize_OLE
call fcn.00407485
add esp, 4
jmp 0x4034ed
push edi
push 0xfffffd66
push str.created_uninstaller:__d____s_
call fcn.00407485
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
mov eax, 0xffffffef
mov dword [esp], ebx
push 0x41c0f0
push eax
jmp 0x4034c9
push ebx
push 0x4180f0
call fcn.00407b44
push eax
push 0x40a6d4
call fcn.00407485
add esp, 8
jmp 0x403562
cmp esi, eax
jge 0x40337d
mov esi, dword [esp + 0x20]
jmp 0x403574
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x4034ed
mov ecx, 2
call fcn.00403793
mov esi, eax
mov ecx, 4
call fcn.00403793
lea edi, [esp + 0x48]
mov dword [edi], 0
movzx ecx, al
shr eax, 0x18
test esi, esi
mov edx, 0x4180b0
cmovne edx, esi
add edx, eax
push ecx
push edx
push edi
call fcn.00407783
push dword [edi]
push ebx
jmp 0x40355d
mov ebx, eax
push dword [esp + 4]
push 0xffffffffffffffea
call fcn.00406aa5
inc dword [0x4180e4]
xor eax, eax
push eax
push eax
push ebx
push dword [esp + 0x28]
call fcn.00403e4e
mov ebp, eax
dec dword [0x4180e4]
push 0x4180f0
push eax
push str.File:_wrote__d_to___s_
call fcn.00407485
add esp, 0xc
cmp dword [esp + 0x20], 0xffffffff
jne 0x4031f9
cmp dword [esp + 0x24], 0xffffffff
je 0x403208
lea eax, [esp + 0x20]
push eax
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
test ebp, ebp
jns case.0x40153c.67
cmp ebp, 0xfffffffe
jne 0x4036f7
mov esi, 0x4180f0
push 0xffffffffffffffe9
push esi
call fcn.00407b44
push dword [esp + 4]
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x403703
push dword [esp + 4]
push 0xffffffffffffffe2
call fcn.00406aa5
xor eax, eax
cmp ebp, 2
sete al
mov dword [esp], eax
push ebp
push 0x4180f0
push str.File:_skipped:___s___overwriteflag_d_
call fcn.00407485
add esp, 0xc
jmp case.0x40153c.67
mov word [ebx], 0
jmp 0x4034ed
push str.File:_error__user_abort
call fcn.00407485
add esp, 4
push 0x4180f0
push 0xfffffffffffffffa
jmp 0x4021ba
mov eax, dword [esp + 0xc]
lea ecx, [eax - 1]
cmp ecx, 2
jae 0x403520
mov ebp, dword [esp + 0x24]
mov word [esi + 0x3ffe], 0
jmp 0x40353f
push 1
call fcn.0040804d
jmp 0x403562
push edx
call dword [ecx + 8]
jmp 0x4034c0
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea ecx, [esp + 0x68]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
mov word [esi + 0x3ffe], 0
jmp 0x403542
push ebx
push str.Rename_failed:__s
jmp 0x4034e5
movzx eax, word [esp + 0xc]
cmp si, ax
je 0x40345d
movzx ecx, ax
cmp ecx, 0xa
je 0x403333
cmp ecx, 0xd
jne 0x40345d
mov word [ebx + edi*2], ax
inc edi
jmp 0x40346e
cmp edx, 0xffffffff
not edx
mov dword [esp + 0x1c], edx
je 0x403633
xor ecx, ecx
inc ecx
call fcn.00403793
mov dword [esp + 0x18], eax
jmp 0x40364b
test ecx, ecx
je 0x403668
mov ecx, dword [esp + 0x18]
mov edx, dword [0x40a004]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x94], ecx
jmp 0x403562
jle 0x402fc5
mov esi, dword [esp + 0x24]
jmp 0x403574
movzx eax, word [esp + 0xc]
push eax
push ebx
call fcn.00407f72
jmp 0x403572
push ebp
push 0xfffffffffffffff7
call fcn.00406aa5
push esi
push ebp
push 0x40a910
call fcn.00407485
add esp, 0xc
xor ebx, ebx
inc ebx
jmp 0x4035a1
mov edx, dword [esp]
cmp edx, 7
mov eax, str.WriteRegMultiStr
mov ecx, str.WriteRegBin
cmove ecx, eax
test edx, edx
mov esi, str.WriteRegNone
cmovne esi, ecx
mov edi, 0x4200f0
push 0xc000
push edi
push 0
push dword [esp + 0x2c]
call fcn.00403e4e
mov ebx, eax
lea eax, [esp + 0x48]
push ebx
push edi
push 0x80
push eax
mov edi, eax
call fcn.0040825c
add esp, 0x10
push edi
mov edi, dword [esp + 8]
push edi
push dword [esp + 0x34]
mov eax, dword [esp + 0x14]
push eax
push esi
mov esi, eax
push str._s:___s_s____s___s_
call fcn.00407485
add esp, 0x18
jmp 0x4035e8
mov ecx, 3
call fcn.00403793
mov dword [0x4200f0], eax
push eax
mov edi, dword [esp + 8]
push edi
push ebx
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegDWORD:___s_s____s__0x_08x_
call fcn.00407485
add esp, 0x14
mov ebx, 4
jmp 0x4035e8
neg ebp
push 1
push 0
push ebp
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [ebx + edi*2], 0
mov dword [esp], 0
test edi, edi
jne case.0x40153c.67
jmp 0x4034ed
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40153c.67
mov bl, 1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movzx esi, bl
xor bl, 1
movzx ebp, bl
shl ebp, 2
or ebp, 0xfffffff0
mov dword [esp], esi
push 0x41c0f0
push ebp
call fcn.00406aa5
jmp case.0x40153c.67
push 0x41c0f0
push 0xfffffffffffffff6
call fcn.00406aa5
push esi
push str.Error_registering_DLL:_Could_not_load__s
call fcn.00407485
add esp, 8
xor eax, eax
inc eax
mov dword [esp], eax
jmp case.0x40153c.67
push 0x4004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
add eax, 4
push dword [esp + 0x14]
push eax
call fcn.00407b44
mov eax, dword [0x42c134]
mov dword [esi], eax
mov dword [0x42c134], esi
jmp 0x403562
cmp eax, 4
mov ebx, esi
jne 0x4018b9
xor eax, eax
cmp dword [esp + 0x24], 0
sete al
mov ebp, eax
push dword [ebx]
push ebx
call fcn.00407f72
mov dword [esp], ebp
push edi
jmp 0x40361e
add eax, ecx
add eax, 0x18
push eax
push ebx
jmp 0x402b8b
push 0
call fcn.00401351
push eax
push edi
call fcn.00407f72
mov dword [esp], 0
mov eax, dword [esp]
add dword [0x4180b8], eax
xor esi, esi
mov eax, esi
add esp, 0x298
pop esi
pop edi
pop ebx
pop ebp
ret 4
push section..data
push 0x42c134
push dword [esp + 8]
push 0x2000
push dword [esp + 0x14]
call ebx
add esp, 0x14
xor ebx, ebx
cmp dword [esp + 0x20], 0
mov dword [esp], ebx
jne case.0x40153c.67
push edi
call fcn.0040481b
test eax, eax
je case.0x40153c.67
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x40153c.67
push str.Pop:_stack_empty
jmp 0x4030f4
push 0x4200f0
mov edi, dword [esp + 8]
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegExpandStr:___s_s____s___s_
call fcn.00407485
add esp, 0x14
push ebx
push 0x4200f0
push dword [esp + 8]
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x403618
push edi
push dword [esp + 0x30]
push esi
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.00407485
add esp, 0x10
xor ebx, ebx
inc ebx
jmp 0x40361a
xor ebx, ebx
mov dword [esp], ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40153c.67
mov word [edi], 0
jmp 0x4030b0
lea ebx, [eax + ecx]
add ebx, 0x18
push dword [esp + 0x24]
push ebx
call fcn.00407b44
or byte [ebx - 0xf], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [edi + ecx*4], eax
cmp dword [esp + 0x20], 0
je 0x403562
push esi
call fcn.004011dc
jmp 0x403562
mov ecx, dword [0x40a004]
mov ecx, dword [ecx]
push dword [ecx + eax*4 + 0x94]
push edi
call fcn.00407b44
jmp 0x403562
shl edi, cl
jmp case.default.0x40284c
or edi, ecx
jmp case.default.0x40284c
sar edi, cl
jmp case.default.0x40284c
test edi, edi
setne al
test ecx, ecx
setne cl
and cl, al
movzx edi, cl
jmp case.default.0x40284c
imul edi, ecx
jmp case.default.0x40284c
test ecx, ecx
je 0x4036e4
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
jmp 0x4036e0
xor eax, eax
test edi, edi
sete al
jmp 0x4036e0
sub edi, ecx
jmp case.default.0x40284c
and edi, ecx
jmp case.default.0x40284c
shr edi, cl
jmp case.default.0x40284c
xor edi, ecx
jmp case.default.0x40284c
test ecx, ecx
je 0x4036e4
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
mov edi, edx
jmp case.default.0x40284c
xor eax, eax
or edi, ecx
setne al
mov edi, eax
jmp case.default.0x40284c
xor edi, edi
mov ebp, esi
mov dword [esp], ebp
push edi
push ebx
call fcn.00407f72
jmp case.0x40153c.67
push 0xffffffffffffffee
push 0x4180f0
call fcn.00407b44
mov esi, 0x4180f0
push esi
push 0x40a6d4
call fcn.00407485
add esp, 8
push 0x200010
push esi
jmp 0x402d4f
xor edi, edi
jmp 0x40346e