Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x110
push 0
push 0x412440
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x412444], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x412440], eax
call section..text
call fcn.0040e4a0
call fcn.0040e28c
call fcn.0040c793
call fcn.0040c2c3
call fcn.0040bc70
call fcn.0040b8f9
call fcn.0040b700
call fcn.0040b6e2
call fcn.0040b659
call fcn.0040adc1
call fcn.00409df0
call fcn.00409001
call fcn.00408cc6
call fcn.00408301
call fcn.00407f79
push dword [0x41253c]
call fcn.00408ce5
push 7
push 0x411230
lea eax, [0x41253c]
push eax
push 8
call fcn.00408c34
push 0x412534
push 0x411240
push 7
push 0x401
push 8
call fcn.0040e18d
mov eax, 0x200
push eax
lea eax, [0x41254c]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040c7b2
push dword [0x412544]
call fcn.00408ce5
push 7
push 0x411238
lea eax, [0x412544]
push eax
push 8
call fcn.00408c34
mov edx, str.Continue_
lea ecx, [0x412458]
call fcn.00405068
mov edx, str.Error_
lea ecx, [0x41251c]
call fcn.00405068
mov edx, 0x411025
lea ecx, [0x41247c]
call fcn.00405068
mov edx, str.Cannot_allocate_the_memory.
lea ecx, [0x4124cc]
call fcn.00405068
mov edx, str.Wrong_password.
lea ecx, [0x4124f0]
call fcn.00405068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x4124c8]
call fcn.00405068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x412504]
call fcn.00405068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x4124ec]
call fcn.00405068
mov edx, str.Password
lea ecx, [0x412508]
call fcn.00405068
mov edx, str.Please_enter_the_password.
lea ecx, [0x41249c]
call fcn.00405068
call fcn.00409baf
mov ebx, eax
cmp ebx, 0x32
jge 0x4011df
push 0x10
push dword [0x412504]
push dword [0x41251c]
call fcn.00407fb0
jmp 0x40212c
push 1
lea eax, [0x4032be]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
lea eax, [0x403274]
push eax
call fcn.00408a50
call fcn.0040843f
mov dword [0x4124f8], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4124ac], eax
mov edx, dword [0x412820]
push edx
push edx
call fcn.00408452
push 0x4124f4
call fcn.0040e520
push dword [0x4124f4]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov ebx, dword [0x4124f8]
and ebx, ebx
jle 0x401353
mov dword [0x412480], 0
mov ebx, dword [0x4124f8]
dec ebx
cmp ebx, dword [0x412480]
jl 0x4012d6
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412480]
call fcn.004083f1
push 0x4124e0
call fcn.0040e520
push dword [0x4124e0]
mov edx, str._b2epass
pop ecx
call fcn.0040e5a0
je 0x40129a
mov dword [0x412474], 1
jmp 0x4012ca
mov ebx, dword [0x412474]
cmp ebx, 1
jne 0x4012ca
mov edx, dword [0x4124e0]
push dword [0x412820]
call fcn.0040e5d0
push 0x412510
call fcn.0040e520
mov dword [0x412474], 0
inc dword [0x412480]
jno 0x40124f
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b730
inc dword [0x412820]
mov edx, dword [0x4112f8]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x412820]
push eax
call fcn.0040b730
push 0x4124a0
call fcn.0040e520
mov edx, dword [0x4124f4]
push dword [0x412820]
call fcn.0040e5d0
mov edx, str.__
call fcn.0040e5d0
mov edx, dword [0x4124a0]
call fcn.0040e5d0
push 0x4124a0
call fcn.0040e520
jmp 0x40136e
mov edx, dword [0x4124f4]
push dword [0x412820]
call fcn.0040e5d0
push 0x4124a0
call fcn.0040e520
push 0x411097
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401399
mov eax, dword [0x41244c]
mov dword [0x4124d8], eax
push dword [0x4124d8]
call fcn.00403392
jmp 0x4013b9
push 0x10
push dword [0x4124c8]
push dword [0x41251c]
call fcn.00407fb0
push 1
jmp 0x402131
push str.NOPSX
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x4013f2
mov edx, dword [0x412820]
push edx
push edx
push dword [0x41245c]
push dword [0x41244c]
call fcn.0040b780
push 0x4124c4
call fcn.0040e520
jmp 0x401412
push 0x10
push dword [0x4124c8]
push dword [0x41251c]
call fcn.00407fb0
push 1
jmp 0x402131
push 0x41107e
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401446
mov eax, dword [0x41244c]
mov dword [0x412484], eax
mov eax, dword [0x41245c]
mov dword [0x412450], eax
mov eax, dword [0x412484]
mov dword [0x412500], eax
jmp 0x401466
push 0x10
push dword [0x4124c8]
push dword [0x41251c]
call fcn.00407fb0
push 1
jmp 0x402131
push 0x411084
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401498
mov eax, dword [0x41244c]
mov dword [0x41248c], eax
mov eax, dword [0x41245c]
mov dword [0x412494], eax
mov eax, dword [0x41248c]
mov dword [0x4124d4], eax
push 0x411082
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x4014ca
mov eax, dword [0x41244c]
mov dword [0x412488], eax
mov eax, dword [0x41245c]
mov dword [0x412454], eax
mov eax, dword [0x412488]
mov dword [0x412520], eax
push 0x411099
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401762
mov edx, dword [0x412510]
xor ecx, ecx
call fcn.0040e5a0
jne 0x401511
mov edx, dword [0x412510]
push dword [0x412820]
call fcn.0040e5d0
push 0x4124e8
call fcn.0040e520
jmp 0x401685
push 0xc80001
push dword [0x412508]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.0040a100
push dword [0x41249c]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.004092e3
push 0x20
push 0x41101e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.004094bc
push 0x4111ea
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.004097c9
push 4
push 0xd
push 0
call fcn.0040a123
push 2
call fcn.004097e9
call fcn.0040a327
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4015f1
push dword [0x412518]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402131
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401639
call fcn.0040c38c
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401636
mov edx, dword [0x412820]
push edx
push edx
push 2
call fcn.00409824
push 0x4124e8
call fcn.0040e520
push 0
call fcn.00409cc3
add esp, 8
jmp 0x401685
pop eax
jmp 0x40167f
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40167f
call fcn.0040c39b
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40167e
mov edx, dword [0x412820]
push edx
push edx
push 2
call fcn.00409824
push 0x4124e8
call fcn.0040e520
push 0
call fcn.00409cc3
add esp, 8
jmp 0x401685
pop eax
pop eax
jmp 0x4015c7
mov edx, dword [0x412820]
push edx
push edx
push dword [0x4124e8]
call fcn.004050d0
push eax
mov eax, dword [0x4124e8]
push eax
call fcn.0040cd70
inc dword [0x412820]
mov edx, dword [0x412820]
push edx
push edx
push dword [0x41245c]
push dword [0x41244c]
call fcn.0040b780
pop edx
pop ecx
mov dword [0x412820], ecx
add ecx, dword [0x4112f8]
add edx, dword [0x4112f8]
call fcn.0040e5a0
jne 0x401709
push 0x10
push dword [0x4124f0]
push dword [0x41251c]
call fcn.00407fb0
push dword [0x412518]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x402131
push 0x41109b
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401727
mov eax, dword [0x41244c]
mov dword [0x4124fc], eax
push dword [0x412454]
push dword [0x412494]
push dword [0x412450]
push dword [0x4124fc]
push dword [0x412488]
push dword [0x41248c]
push dword [0x412484]
push dword [0x4124e8]
push dword [0x4124ac]
call fcn.00403d08
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412450]
push dword [0x412500]
call fcn.0040b780
push 0x4124c0
call fcn.0040e520
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412494]
push dword [0x4124d4]
call fcn.0040b780
push 0x41246c
call fcn.0040e520
push 0x411080
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401931
mov edx, dword [0x412820]
push edx
push edx
push 0
call fcn.004083f1
inc dword [0x412820]
mov edx, dword [0x412820]
push edx
push edx
push dword [0x41245c]
push dword [0x41244c]
call fcn.0040b780
pop edx
pop ecx
mov dword [0x412820], ecx
add ecx, dword [0x4112f8]
add edx, dword [0x4112f8]
call fcn.0040e5a0
je 0x40181e
mov ebx, dword [0x4124f8]
cmp ebx, 1
jne 0x40181e
mov eax, 1
jmp 0x401820
xor eax, eax
and eax, eax
je 0x401931
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
call fcn.0040b905
inc dword [0x412820]
push dword [0x4124ec]
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.00408023
push 0x412468
call fcn.0040e520
mov edx, dword [0x412468]
xor ecx, ecx
call fcn.0040e5a0
jne 0x4018df
mov edx, dword [0x412468]
push dword [0x412820]
call fcn.0040e5d0
push 0x4124bc
call fcn.0040e520
push dword [0x4124bc]
call fcn.0040b945
mov edx, dword [0x41246c]
xor ecx, ecx
call fcn.0040e5a0
jne 0x4018b1
push dword [0x41246c]
call fcn.004034c0
push dword [0x4124c4]
push 1
call fcn.0040be10
and eax, eax
je 0x4018df
push dword [0x4124c0]
push 1
call fcn.0040bf90
push 1
call fcn.0040bbf0
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
call fcn.00408452
mov edx, dword [0x4112f8]
add dword [esp], edx
call fcn.0040b957
mov edx, dword [0x4112f8]
add dword [esp], edx
call fcn.0040b945
pop dword [0x412820]
push dword [0x412518]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x402131
push 0x41109d
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401a6d
push 0x400
call fcn.0040b820
mov dword [0x4124a4], eax
mov edx, dword [0x412820]
push edx
push edx
call fcn.0040b9cd
push 0x412528
call fcn.0040e520
push dword [0x4124a4]
push 0
push 0x41101e
push dword [0x412528]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x412820]
push edx
push edx
push dword [0x4124a4]
call fcn.0040b730
push 0x412514
call fcn.0040e520
push dword [0x4124a4]
call fcn.0040b840
push dword [0x412514]
call fcn.0040ba5c
push dword [0x412514]
call fcn.0040ba6a
push dword [0x412514]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x412514]
push dword [0x412820]
call fcn.0040e5d0
mov edx, str.extd.exe
call fcn.0040e5d0
push 0x4124b8
call fcn.0040e520
push dword [0x4124b8]
push 0
call fcn.0040be10
push dword [0x41245c]
push dword [0x41244c]
push 0
call fcn.0040c010
push 0
call fcn.0040bbf0
mov edx, dword [0x4124b8]
push dword [0x412820]
call fcn.0040e5d0
push 0x4124b0
call fcn.0040e520
push dword [0x4124b0]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x4124b0]
push str.b2eextd
call fcn.004084ad
push str._call:extd
push str.extd
call fcn.004084ad
mov edx, dword [0x412518]
push dword [0x412820]
call fcn.0040e5d0
mov edx, str.BDFI
call fcn.0040e5d0
mov edx, dword [0x4124c4]
call fcn.0040e5d0
push 0x4124c4
call fcn.0040e520
push dword [0x4124c4]
push 1
call fcn.0040be10
and eax, eax
je 0x401c4c
push str._shift__0
push 1
call fcn.0040c070
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b730
inc dword [0x412820]
mov edx, dword [0x4112f8]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x412820]
push eax
call fcn.0040b730
inc dword [0x412820]
push 0x41109f
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x412820]
push dword [0x4124c0]
push 1
call fcn.0040c070
push 0x41109d
push dword [0x4124ac]
call fcn.00403bf5
and eax, eax
je 0x401c40
mov edx, dword [0x412820]
push edx
push edx
mov ebp, 0x4112f5
mov ebx, ebp
mov ebp, 0x411248
sub ebx, ebp
push ebx
mov ebp, 0x411248
push ebp
call fcn.0040b780
push 0x412490
call fcn.0040e520
push dword [0x412490]
call fcn.004050d0
mov dword [0x4124a8], eax
push dword [0x4124a8]
call fcn.0040b820
mov dword [0x4124b4], eax
push dword [0x4124a8]
call fcn.0040b820
mov dword [0x412498], eax
push dword [0x412490]
push dword [0x4124b4]
call fcn.0040b860
mov dword [0x412480], 0
mov eax, dword [0x4124a8]
cmp eax, dword [0x412480]
jl 0x401c07
mov ebx, dword [0x4124b4]
add ebx, dword [0x412480]
mov eax, ebx
call fcn.0040b890
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x412498]
add ebx, dword [0x412480]
mov eax, ebx
call fcn.0040b8a0
inc dword [0x412480]
jno 0x401bc6
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
push dword [0x412498]
call fcn.0040b730
inc dword [0x412820]
push 1
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.0040c070
pop dword [0x412820]
push 1
call fcn.0040bbf0
jmp 0x401c87
push dword [0x4124c4]
call fcn.0040ba5c
call fcn.00403fb5
push 0x10
push dword [0x4124c8]
push dword [0x41251c]
call fcn.00407fb0
push dword [0x412518]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x402131
mov edx, dword [0x41246c]
xor ecx, ecx
call fcn.0040e5a0
jne 0x401ca1
push dword [0x41246c]
call fcn.004034c0
push 0x400
call fcn.0040b820
mov dword [0x41250c], eax
mov edx, dword [0x412820]
push edx
push edx
call fcn.0040b9cd
push 0x412464
call fcn.0040e520
push dword [0x41250c]
push 0
push 0x41101e
push dword [0x412464]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x412820]
push edx
push edx
push dword [0x41250c]
call fcn.0040b730
push 0x412524
call fcn.0040e520
mov edx, dword [0x412820]
push edx
push edx
push 0x800
call fcn.00405100
push 0x4124dc
call fcn.0040e520
push dword [0x412820]
push 0x800
push dword [0x4124dc]
mov edx, dword [0x412820]
push edx
push edx
call fcn.00408452
inc dword [0x412820]
mov edx, dword [0x4112f8]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x412820]
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
call fcn.00408452
inc dword [0x412820]
push str.b2eprogramname
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x412820]
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
call fcn.00408452
mov edx, dword [0x4112f8]
add dword [esp], edx
call fcn.0040bb88
inc dword [0x412820]
push str.b2eprogramfilename
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x412820]
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
call fcn.00408452
mov edx, dword [0x4112f8]
add dword [esp], edx
call fcn.0040b957
inc dword [0x412820]
push str.b2eprogrampathname
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x412820]
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
push dword [0x4124dc]
call fcn.00405200
inc dword [0x412820]
push str.b2eprogramshortname
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x412820]
mov edx, dword [0x4124bc]
push dword [0x412820]
call fcn.0040e5d0
push 0x412530
call fcn.0040e520
push dword [0x412530]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x412530]
push 0x411086
call fcn.004084ad
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
mov eax, dword [0x412460]
cdq
push edx
push eax
call fcn.00405390
inc dword [0x412820]
push str.b2eincfilecount
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x412820]
push dword [0x412524]
push str.b2etempfile
call fcn.004084ad
call fcn.00403bc1
and eax, eax
je 0x401eee
call fcn.00409baf
mov ebx, eax
cmp ebx, 0x41
je 0x401eee
mov eax, 1
jmp 0x401ef0
xor eax, eax
and eax, eax
je 0x401f5d
mov edx, dword [0x412820]
push edx
push edx
push 0x800
call fcn.00405100
push 0x41252c
call fcn.0040e520
push 0x800
push dword [0x41252c]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [0x41252c]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x41252c]
push dword [0x412820]
call fcn.0040e5d0
mov edx, str.sysnative
call fcn.0040e5d0
push 0x41252c
call fcn.0040e520
push dword [0x41252c]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x401f94
mov edx, dword [0x412820]
push edx
push edx
push 0x800
call fcn.00405100
push 0x41252c
call fcn.0040e520
push 0x800
push dword [0x41252c]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [0x41252c]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x4124c4]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x4124c4]
push dword [0x412820]
call fcn.0040e5d0
mov edx, str.__
call fcn.0040e5d0
mov edx, dword [0x4124a0]
call fcn.0040e5d0
push 0x4124a0
call fcn.0040e520
push dword [0x4124a0]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x412820]
push 0x44
push dword [0x4124bc]
push dword [0x412820]
mov edx, 0x4110d7
call fcn.0040e5d0
mov edx, dword [0x4124a0]
call fcn.0040e5d0
inc dword [0x412820]
mov edx, dword [0x41252c]
push dword [0x412820]
call fcn.0040e5d0
mov edx, 0x411138
call fcn.0040e5d0
mov edx, dword [0x4112f8]
add dword [esp], edx
mov edx, dword [0x4112f8]
add dword [esp + 4], edx
call fcn.00408929
pop dword [0x412820]
mov dword [0x4124d0], eax
push dword [0x4124d0]
call fcn.00408943
mov ebx, eax
and ebx, ebx
jne 0x40205d
jmp 0x402069
push 5
call fcn.00409ca2
jmp 0x40204a
push dword [0x4124d0]
call fcn.0040898a
push dword [0x4124d0]
call fcn.0040899b
mov dword [0x412478], eax
push dword [0x4124d0]
call fcn.004089b9
push 0
lea eax, [0x4032be]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.00403fb5
push dword [0x4124c4]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x4124c4]
call fcn.0040ba5c
push dword [0x412524]
call fcn.0040ba5c
push dword [0x4124b8]
call fcn.0040ba5c
mov edx, dword [0x412820]
push edx
push edx
mov edx, dword [0x412820]
push edx
push edx
push dword [0x412820]
call fcn.00408452
mov edx, dword [0x4112f8]
add dword [esp], edx
call fcn.0040b957
mov edx, dword [0x4112f8]
add dword [esp], edx
call fcn.0040b945
pop dword [0x412820]
push dword [0x412514]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x412518]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x412478]
jmp 0x402131
push 0
call 0x40214b
call fcn.0040e4f0
push dword [0x412440]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00408ba0
call fcn.00409071
call fcn.00409dd9
call fcn.0040ae4f
call fcn.0040b64d
call fcn.0040bb9a
call fcn.0040bc60
call fcn.0040c68e
call fcn.0040b720
ret