Function at 0x40160c
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2e8
mov eax, dword [0x434a04]
and dword [ebp + 0x70], 0
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
push 9
pop ecx
lea edi, [ebp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x48]
mov edx, dword [ebp + 0x44]
mov esi, dword [ebp + 0x40]
shl ecx, 0xb
mov edi, section..ndata
add ecx, edi
mov dword [ebp + 0x6c], ecx
lea ecx, [ebp + 0x44]
mov ebx, edx
shl ebx, 0xb
mov dword [0x40a100], ecx
lea ecx, [esi - 2]
add ebx, edi
mov dword [ebp + 0x64], eax
cmp ecx, 0x45
ja case.0x401663.68
jmp dword [ecx*4 + 0x402f90]
mov eax, edx
jmp 0x402f85
push 0
push edx
call fcn.004051f2
mov eax, 0x7fffffff
jmp 0x402f85
inc dword [0x4339d4]
test eax, eax
je 0x401679
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x401679
push edx
call fcn.0040137c
dec eax
push 0
push eax
call fcn.00401398
jmp 0x402f85
push 0
push edx
call fcn.004051f2
jmp case.0x401663.68
xor ecx, ecx
call fcn.00401443
cmp eax, 1
mov dword [ebp + 0x1c], edx
jg 0x4016ca
xor eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x401663.68
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x401663.68
cmp dword [ebp + 0x4c], 0
jg 0x401715
jne 0x4016fb
mov eax, edx
shl eax, 2
mov ecx, dword [eax + 0x434ac0]
mov dword [eax + 0x434a80], ecx
xor ecx, ecx
inc ecx
call fcn.00401443
mov ecx, dword [ebp + 0x44]
mov dword [ebp + 0x1c], edx
mov dword [ecx*4 + 0x434ac0], eax
jmp case.0x401663.68
mov eax, edx
shl eax, 2
mov ecx, dword [eax + 0x434a80]
mov dword [eax + 0x434ac0], ecx
jmp case.0x401663.68
mov edx, dword [ebp + 0x4c]
lea edx, [edx*4 + 0x434ac0]
mov ecx, dword [edx]
xor eax, eax
test ecx, ecx
sete al
and ecx, dword [ebp + 0x50]
mov dword [edx], ecx
mov eax, dword [ebp + eax*4 + 0x44]
jmp 0x402f85
mov eax, dword [ebp + 0x48]
push dword [eax*4 + 0x434ac0]
push ebx
call fcn.004063fe
jmp case.0x401663.68
mov eax, dword [0x4339e0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x401779
push dword [ebp + 0x48]
push eax
call esi
mov edx, dword [ebp + 0x44]
mov eax, dword [0x4339cc]
test eax, eax
je case.0x401663.68
push edx
push eax
call esi
jmp case.0x401663.68
push 0xfffffffffffffff0
pop esi
call fcn.00401460
push dword [ebp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x401663.68
mov dword [ebp + 0x70], 1
jmp case.0x401663.68
push 0xfffffffffffffff0
pop esi
call fcn.00401460
mov ebx, eax
push ebx
call fcn.0040604f
mov esi, eax
test esi, esi
je 0x401822
push 0x5c
push esi
call fcn.00405ffb
mov esi, eax
movzx edi, word [esi]
xor eax, eax
mov word [esi], ax
test di, di
jne 0x4017f9
cmp dword [ebp + 0x4c], 0
je 0x4017f9
call fcn.00406727
test eax, eax
je 0x4017f9
push ebx
call fcn.00405e79
jmp 0x4017ff
push ebx
call fcn.00405efb
test eax, eax
je 0x401818
cmp eax, 0xb7
jne 0x401815
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x401818
inc dword [ebp + 0x70]
mov word [esi], di
inc esi
inc esi
test di, di
jne 0x4017cb
cmp dword [ebp + 0x48], 0
je 0x401851
push 0xffffffffffffffe6
call fcn.00401432
push ebx
push 0x440000
call fcn.004064b7
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne case.0x401663.68
inc dword [ebp + 0x70]
jmp case.0x401663.68
push 0xfffffffffffffff5
call fcn.00401432
jmp case.0x401663.68
xor esi, esi
call fcn.00401460
push eax
call fcn.004065a5
test eax, eax
je 0x401cf2
mov eax, dword [ebp + 0x48]
jmp 0x402f85
push 0xffffffffffffffd0
pop esi
call fcn.00401460
push 0xffffffffffffffdf
pop esi
mov edi, eax
call fcn.00401460
push 0x13
pop esi
mov ebx, eax
call fcn.00401460
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4018a6
push 0xffffffffffffffe3
jmp 0x401853
cmp dword [ebp + 0x4c], 0
je 0x4017a9
push edi
call fcn.004065a5
test eax, eax
je 0x4017a9
push ebx
push edi
call fcn.00406c6f
push 0xffffffffffffffe4
jmp 0x401853
xor esi, esi
call fcn.00401460
mov ebx, dword [ebp + 0x6c]
mov esi, eax
lea eax, [ebp + 0x7c]
push eax
push ebx
mov edi, 0x400
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x401910
mov eax, dword [ebp + 0x7c]
cmp eax, esi
jbe 0x40191c
cmp word [eax], 0
je 0x40191c
push esi
call fcn.004065a5
test eax, eax
je 0x401910
add eax, 0x2c
push eax
push dword [ebp + 0x7c]
call fcn.004064b7
jmp 0x40191c
xor eax, eax
mov word [ebx], ax
mov dword [ebp + 0x70], 1
cmp dword [ebp + 0x4c], 0
jne case.0x401663.68
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp case.0x401663.68
or esi, 0xffffffff
call fcn.00401460
lea ecx, [ebp + 0x7c]
push ecx
push ebx
push 0x400
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x401663.68
xor eax, eax
mov dword [ebp + 0x70], 1
mov word [ebx], ax
jmp case.0x401663.68
push 0xffffffffffffffef
pop esi
call fcn.00401460
push eax
push ebx
call fcn.0040617b
jmp 0x4017a1
push 0x31
pop esi
call fcn.00401460
mov esi, eax
mov eax, dword [ebp + 0x44]
and eax, 7
push esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x7c], eax
call fcn.0040601a
push esi
mov esi, 0x40a168
test eax, eax
je 0x4019ac
push esi
call fcn.004064b7
jmp 0x4019c3
push 0x440000
push esi
call fcn.004064b7
push eax
call fcn.00406787
push eax
call sub.KERNEL32.dll_lstrcatW
push esi
call fcn.004064f4
mov ebx, 0x40b168
cmp dword [ebp + 0x7c], 3
jl 0x401a05
push esi
call fcn.004065a5
xor ecx, ecx
test eax, eax
je 0x4019f0
lea ecx, [ebp + 0x54]
push ecx
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
mov eax, dword [ebp + 0x7c]
add eax, 0xfffffffd
or eax, 0x80000000
and eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x7c], eax
cmp dword [ebp + 0x7c], 0
jne 0x401a11
push esi
call fcn.00406126
xor eax, eax
cmp dword [ebp + 0x7c], 1
setne al
inc eax
push eax
push 0x40000000
push esi
call fcn.0040614c
mov dword [ebp + 0x2c], eax
cmp eax, 0xffffffff
jne 0x401a9a
cmp dword [ebp + 0x7c], 0
jne 0x401a7c
push edi
push ebx
call fcn.004064b7
push esi
push edi
call fcn.004064b7
push dword [ebp + 0x5c]
push 0x40a968
call fcn.004068b2
push ebx
push edi
call fcn.004064b7
mov eax, dword [ebp + 0x44]
sar eax, 3
push eax
push 0x40a968
call fcn.00405f95
sub eax, 4
je 0x4019ce
dec eax
je 0x401a8f
push esi
push 0xfffffffffffffffa
jmp 0x401674
push dword [ebp + 0x68]
push 0xffffffffffffffe2
call fcn.004051f2
cmp dword [ebp + 0x7c], 2
jmp 0x4017a3
inc dword [0x434ac8]
jmp 0x402f83
push dword [ebp + 0x68]
push 0xffffffffffffffea
call fcn.004051f2
push dword [ebp + 0x60]
mov ecx, dword [ebp + 0x50]
mov eax, dword [ebp + 0x4c]
inc dword [0x434af4]
xor edi, edi
cmp dword [ebp + 0x40], 0x15
push edi
push edi
push dword [ebp + 0x2c]
push ecx
push eax
jne 0x401ac6
push 1
jmp 0x401ac7
push edi
call fcn.004032fd
dec dword [0x434af4]
cmp dword [ebp + 0x54], 0xffffffff
mov ebx, edx
mov dword [ebp + 0x18], eax
jne 0x401ae3
cmp dword [ebp + 0x58], 0xffffffff
je 0x401af2
lea eax, [ebp + 0x54]
push eax
push edi
push eax
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jg case.0x401663.68
jl 0x401b0f
cmp dword [ebp + 0x18], 0
jae case.0x401663.68
cmp dword [ebp + 0x18], 0xfffffffe
jne 0x401b2d
cmp ebx, 0xffffffff
jne 0x401b2d
push 0xffffffffffffffe9
push esi
call fcn.004068b2
push dword [ebp + 0x68]
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x401b35
push 0xffffffffffffffee
push esi
call fcn.004068b2
push 0x200010
push esi
call fcn.00405f95
jmp 0x401679
cmp dword [0x40a014], 0xffffffff
mov dword [ebp + 0x70], 1
je 0x401b5e
cmp dword [0x434a60], 0
jmp 0x401bc6
cmp dword [0x434a60], 0
je case.0x401663.68
xor esi, esi
call fcn.00401460
mov edi, eax
push edi
call fcn.0040601a
test eax, eax
jne 0x401bab
push 0x442800
mov esi, 0x40a968
push esi
call fcn.004064b7
push esi
call fcn.004067e3
push eax
push esi
call fcn.004064b7
push esi
push 0x4082b4
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
call fcn.004064f4
push 3
push 0x80000000
push edi
call fcn.0040614c
mov dword [0x40a014], eax
cmp eax, 0xffffffff
je case.0x401663.68
and dword [ebp + 0x70], 0
jmp case.0x401663.68
xor esi, esi
call fcn.00401460
push dword [ebp + 0x48]
push eax
call fcn.00406c9b
jmp case.0x401663.68
push 0x31
pop esi
call fcn.00401460
push dword [ebp + 0x44]
push eax
call fcn.00405f95
test eax, eax
je 0x4017a9
cmp eax, dword [ebp + 0x4c]
jne 0x401c10
mov eax, dword [ebp + 0x50]
jmp 0x402f85
cmp eax, dword [ebp + 0x54]
jne case.0x401663.68
mov eax, dword [ebp + 0x58]
jmp 0x402f85
push 0xfffffffffffffff0
pop esi
jmp 0x401bd7
xor esi, esi
inc esi
call fcn.00401460
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
jmp 0x401756
push 2
pop ecx
call fcn.00401443
push 3
pop ecx
mov esi, eax
mov dword [ebp + 0x34], edx
call fcn.00401443
mov dword [ebp + 0x7c], esi
xor esi, esi
inc esi
mov edi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401460
push eax
mov dword [ebp + 0x1c], eax
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [ebx], cx
mov esi, eax
cmp dword [ebp + 0x34], ecx
je 0x401c77
mov esi, dword [ebp + 0x7c]
test esi, esi
je case.0x401663.68
test edi, edi
jge 0x401c8b
add edi, eax
js case.0x401663.68
cmp edi, eax
jle 0x401c91
mov edi, eax
mov eax, dword [ebp + 0x1c]
lea eax, [eax + edi*2]
push eax
push ebx
call fcn.004064b7
test esi, esi
jge 0x401cb3
push ebx
call sub.KERNEL32.dll_lstrlenW
add esi, eax
jns 0x401cb3
and dword [ebp + 0x7c], 0
mov esi, dword [ebp + 0x7c]
cmp esi, 0x400
jge case.0x401663.68
xor eax, eax
mov word [ebx + esi*2], ax
jmp case.0x401663.68
push 0x20
pop esi
call fcn.00401460
push 0x31
pop esi
mov edi, eax
call fcn.00401460
cmp dword [ebp + 0x54], 0
push eax
push edi
jne 0x401cfa
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401c08
mov eax, dword [ebp + 0x4c]
jmp 0x402f85
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x401cea
xor esi, esi
inc esi
call fcn.00401460
push 0x400
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x401d2f
cmp dword [ebp + 0x4c], 0
je 0x401d37
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401d37
xor eax, eax
mov dword [ebp + 0x70], esi
mov word [ebx], ax
xor eax, eax
mov word [ebx + 0x7fe], ax
jmp case.0x401663.68
mov esi, dword [ebp + 0x58]
xor ecx, ecx
call fcn.00401443
xor ecx, ecx
inc ecx
mov edi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401443
mov dword [ebp + 0x1c], edx
test esi, esi
jne 0x401d75
cmp edi, eax
jl 0x401c08
jle 0x401cf2
mov eax, dword [ebp + 0x54]
jmp 0x402f85
cmp edi, eax
jb 0x401c08
jbe 0x401cf2
jmp 0x401d6d
xor ecx, ecx
inc ecx
call fcn.00401443
push 2
pop ecx
mov esi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401443
mov ecx, eax
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x1c], edx
cmp eax, 0xd
ja case.default.0x401da7
jmp dword [eax*4 + 0x4030a8]
add esi, ecx
jmp case.default.0x401da7
sub esi, ecx
jmp case.default.0x401da7
imul ecx, esi
mov esi, ecx
jmp case.default.0x401da7
test ecx, ecx
je 0x401dc8
mov eax, esi
cdq
idiv ecx
jmp 0x401de6
xor esi, esi
mov dword [ebp + 0x70], 1
jmp case.default.0x401da7
or ecx, esi
jmp 0x401db9
and ecx, esi
jmp 0x401db9
xor ecx, esi
jmp 0x401db9
xor eax, eax
test esi, esi
sete al
mov esi, eax
jmp case.default.0x401da7
test esi, esi
jne 0x401df2
test ecx, ecx
je 0x401dfb
xor esi, esi
inc esi
jmp case.default.0x401da7
test esi, esi
jne 0x401dee
xor esi, esi
jmp case.default.0x401da7
test ecx, ecx
je 0x401dc8
mov eax, esi
cdq
idiv ecx
mov esi, edx
jmp case.default.0x401da7
shl esi, cl
jmp case.default.0x401da7
sar esi, cl
jmp case.default.0x401da7
shr esi, cl
push esi
jmp 0x401756
xor esi, esi
inc esi
call fcn.00401460
push 2
pop ecx
mov esi, eax
call fcn.00401443
push eax
push esi
push ebx
mov dword [ebp + 0x1c], edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp case.0x401663.68
mov eax, dword [ebp + 0x4c]
mov esi, dword [0x40a104]
test eax, eax
je 0x401e9f
dec eax
test esi, esi
je 0x401e5e
mov esi, dword [esi]
test eax, eax
jne 0x401e4f
test esi, esi
jne 0x401e72
push 0x200010
push 0xffffffffffffffe8
push 0
call fcn.004068b2
push eax
jmp 0x401b3b
lea edi, [esi + 4]
push edi
mov esi, 0x40a168
push esi
call fcn.004064b7
mov eax, dword [0x40a104]
add eax, 4
push eax
push edi
call fcn.004064b7
mov eax, dword [0x40a104]
push esi
add eax, 4
push eax
jmp 0x402c4a
cmp dword [ebp + 0x48], 0
je 0x401ec4
test esi, esi
je 0x4017a9
lea eax, [esi + 4]
push eax
push ebx
call fcn.004064b7
mov eax, dword [esi]
mov dword [0x40a104], eax
push esi
jmp 0x40237f
push 0x804
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp + 0x44]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.004068b2
mov eax, dword [0x40a104]
mov dword [esi], eax
mov dword [0x40a104], esi
jmp case.0x401663.68
push 3
pop ecx
call fcn.00401443
push 4
pop ecx
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x2c], eax
call fcn.00401443
test byte [ebp + 0x58], 1
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x7c], eax
je 0x401f1e
push 0x33
pop esi
call fcn.00401460
mov dword [ebp + 0x2c], eax
test byte [ebp + 0x58], 2
je 0x401f2f
push 0x44
pop esi
call fcn.00401460
mov dword [ebp + 0x7c], eax
cmp dword [ebp + 0x40], 0x23
jne 0x401f86
xor ecx, ecx
inc ecx
call fcn.00401443
push 2
pop ecx
mov esi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401443
mov ecx, dword [ebp + 0x58]
sar ecx, 2
mov dword [ebp + 0x1c], edx
test ecx, ecx
je 0x401f76
lea edx, [ebp + 0x68]
push edx
push ecx
push 0
push dword [ebp + 0x7c]
push dword [ebp + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x70], eax
jmp 0x401fbb
push dword [ebp + 0x7c]
push dword [ebp + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x401fb8
xor esi, esi
inc esi
call fcn.00401460
push 0x12
pop esi
mov edi, eax
call fcn.00401460
movzx ecx, word [eax]
neg ecx
sbb ecx, ecx
and ecx, eax
movzx eax, word [edi]
neg eax
push ecx
sbb eax, eax
and eax, edi
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x2c]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x44], 0
jl case.0x401663.68
push dword [ebp + 0x68]
jmp 0x401756
xor ecx, ecx
call fcn.00401443
push eax
mov dword [ebp + 0x1c], edx
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x40186a
push 2
pop ecx
call fcn.00401443
xor ecx, ecx
inc ecx
mov esi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401443
push esi
push eax
mov dword [ebp + 0x1c], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401c34
mov ecx, dword [ebp + 0x48]
mov eax, dword [0x434a48]
lea esi, [eax + ecx]
xor ecx, ecx
call fcn.00401443
push esi
push 0xffffffffffffffeb
push eax
mov dword [ebp + 0x1c], edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x401663.68
test dword [ebp + 0x50], 0x100
je 0x402042
push 2
pop ecx
call fcn.00401443
mov dword [ebp + 0x1c], edx
jmp 0x40204c
push dword [ebp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp + 0x50]
mov dword [ebp + 0x7c], eax
mov eax, ecx
shr eax, 0x1f
mov dword [ebp + 0x3c], eax
mov eax, ecx
shr eax, 0x1e
mov esi, ecx
mov edi, ecx
and esi, 3
and eax, 1
and edi, 4
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x68], eax
test ecx, 0x10000
je 0x402087
push 0x11
pop esi
call fcn.00401460
mov esi, dword [ebp + 0x34]
jmp 0x40208b
movzx eax, word [ebp + 0x48]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp + 0x50]
and eax, 0xfef0
push eax
mov eax, dword [ebp + 0x2c]
imul eax, dword [ebp + 0x68]
push eax
mov eax, dword [ebp + 0x28]
imul eax, dword [ebp + 0x3c]
push eax
neg edi
push esi
push dword [ebp + 0x1c]
sbb edi, edi
and edi, dword [0x434a08]
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
push edi
push esi
push 0x172
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4020ea
test esi, esi
jne 0x4020ea
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp + 0x44], 0
jl case.0x401663.68
push edi
jmp 0x401756
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 2
pop ecx
mov esi, eax
call fcn.00401443
push 0x48
push 0x5a
push esi
mov edi, eax
mov dword [ebp + 0x1c], edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
push esi
push dword [ebp + 0x64]
neg eax
mov dword [0x40a108], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
pop ecx
call fcn.00401443
push dword [ebp + 0x48]
mov dword [0x40a118], eax
mov al, byte [ebp + 0x54]
mov cl, al
and cl, 1
mov byte [0x40a11c], cl
mov cl, al
and cl, 2
and al, 4
push 0x40a124
mov dword [ebp + 0x1c], edx
mov byte [0x40a11d], cl
mov byte [0x40a11e], al
mov byte [0x40a11f], 1
call fcn.004068b2
push 0x40a108
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x401c34
xor ecx, ecx
call fcn.00401443
xor ecx, ecx
inc ecx
mov esi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401443
cmp dword [ebp + 0x50], 0
push eax
mov dword [ebp + 0x1c], edx
push esi
jne 0x4021b2
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x401663.68
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x401663.68
xor esi, esi
call fcn.00401460
push 0x31
pop esi
mov edi, eax
call fcn.00401460
push 0x22
pop esi
mov dword [ebp + 0x7c], eax
call fcn.00401460
push 0x15
pop esi
mov ebx, eax
call fcn.00401460
push 0xffffffffffffffec
call fcn.00401432
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x50]
mov dword [ebp], eax
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0xc], eax
movzx eax, word [ebx]
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], 0x440000
call fcn.00405f5b
test eax, eax
je 0x4017a9
test byte [ebp - 0x18], 0x40
je case.0x401663.68
push dword [ebp + 0x1c]
call fcn.004066e5
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401663.68
xor esi, esi
call fcn.00401460
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.004051f2
push esi
call fcn.00405f18
mov esi, eax
test esi, esi
je 0x4017a9
cmp dword [ebp + 0x4c], 0
je 0x40229b
push esi
call fcn.004066e5
cmp dword [ebp + 0x48], 0
jl 0x402290
push eax
push dword [ebp + 0x6c]
call fcn.004063fe
jmp 0x40229b
test eax, eax
je 0x40229b
mov dword [ebp + 0x70], 1
push esi
jmp 0x402247
push 2
pop esi
call fcn.00401460
push eax
call fcn.004065a5
mov esi, eax
test esi, esi
je 0x4022c5
push dword [esi + 0x14]
push dword [ebp + 0x6c]
call fcn.004063fe
push dword [esi + 0x18]
jmp 0x401756
mov ecx, dword [ebp + 0x6c]
xor eax, eax
mov word [ebx], ax
mov word [ecx], ax
jmp 0x4017a9
push 0xffffffffffffffee
pop esi
call fcn.00401460
mov edi, eax
lea eax, [ebp + 0x3c]
push eax
push edi
push 0xa
call fcn.0040663c
call eax
mov ecx, dword [ebp + 0x6c]
mov esi, eax
xor eax, eax
mov word [ebx], ax
mov word [ecx], ax
mov dword [ebp + 0x70], 1
test esi, esi
je case.0x401663.68
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 0x7c], eax
test eax, eax
je case.0x401663.68
push 0xb
call fcn.0040663c
push 0xc
mov dword [ebp + 0x34], eax
call fcn.0040663c
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], eax
push esi
push 0
push edi
call dword [ebp + 0x34]
test eax, eax
je 0x40237c
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x1c]
push eax
push 0x4082b0
push dword [ebp + 0x7c]
call dword [ebp + 0x68]
test eax, eax
je 0x40237c
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x50]
push dword [eax + ecx*4 + 8]
push ebx
call fcn.004063fe
mov eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x1c]
push dword [ecx + eax*4 + 0xc]
push dword [ebp + 0x6c]
call fcn.004063fe
and dword [ebp + 0x70], 0
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x401663.68
cmp dword [0x434b00], 0
mov dword [ebp + 0x70], 1
jl 0x402456
push 0xfffffffffffffff0
pop esi
call fcn.00401460
xor esi, esi
inc esi
mov ebx, eax
call fcn.00401460
cmp dword [ebp + 0x54], 0
mov dword [ebp + 0x7c], eax
je 0x4023c6
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4023d7
push 8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x40244f
push dword [ebp + 0x7c]
push esi
call fcn.004066a9
mov ebx, eax
test ebx, ebx
je 0x402421
and dword [ebp + 0x70], 0
cmp dword [ebp + 0x4c], 0
je 0x402407
push dword [ebp + 0x4c]
call fcn.00401432
call ebx
test eax, eax
je 0x40242b
mov dword [ebp + 0x70], 1
jmp 0x40242b
push section..data
push 0x40a104
push edi
push 0x400
push dword [ebp + 0x64]
call ebx
add esp, 0x14
jmp 0x40242b
push dword [ebp + 0x7c]
push 0xfffffffffffffff7
call fcn.004051f2
cmp dword [ebp + 0x50], 0
jne case.0x401663.68
push esi
call fcn.00403f8b
test eax, eax
je case.0x401663.68
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x401663.68
push 0xfffffffffffffff6
jmp 0x401853
push 0xffffffffffffffe7
jmp 0x401853
push 0xfffffffffffffff0
pop esi
call fcn.00401460
push 0xffffffffffffffdf
pop esi
mov dword [ebp + 0x6c], eax
call fcn.00401460
push 2
pop esi
mov dword [ebp + 0x1c], eax
call fcn.00401460
push 0xffffffffffffffcd
pop esi
mov dword [ebp - 0x20], eax
call fcn.00401460
push 0x45
pop esi
mov dword [ebp + 0x3c], eax
call fcn.00401460
push dword [ebp + 0x1c]
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x54]
mov ecx, eax
mov ebx, eax
mov edi, eax
sar eax, 0x10
and ecx, 0xfff
and eax, 0xffff
sar edi, 0xc
mov dword [ebp + 0x2c], ecx
and ebx, 0x8000
and edi, 7
mov dword [ebp + 0x68], eax
call fcn.0040601a
test eax, eax
jne 0x4024d1
push 0x21
pop esi
call fcn.00401460
lea eax, [ebp + 0x7c]
push eax
push 0x408ad8
push 1
push 0
push 0x408af8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40259e
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp + 0x34]
push edx
push 0x408ae8
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x402591
mov eax, dword [ebp + 0x7c]
push dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov esi, eax
test ebx, ebx
jne 0x40252c
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push 0x440000
push eax
call dword [ecx + 0x24]
test edi, edi
je 0x40253a
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp + 0x7c]
push dword [ebp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
mov ecx, dword [ebp + 0x3c]
cmp word [ecx], 0
je 0x40255c
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x7c]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x44]
mov eax, dword [ebp + 0x7c]
push dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0x7c]
push dword [ebp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test esi, esi
jl 0x402588
mov eax, dword [ebp + 0x34]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x6c]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp + 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jge 0x4025ac
mov dword [ebp + 0x70], 1
push 0xfffffffffffffff0
jmp 0x401853
push 0xfffffffffffffff4
jmp 0x401853
xor esi, esi
call fcn.00401460
push 0x11
pop esi
mov edi, eax
call fcn.00401460
push 0x23
pop esi
mov ebx, eax
call fcn.00401460
push edi
mov esi, eax
call fcn.004065a5
test eax, eax
jne 0x4025e8
push 0
push 0xfffffffffffffff9
call fcn.004051f2
jmp 0x4017a9
mov eax, dword [ebp + 0x64]
push edi
mov dword [ebp], eax
mov dword [ebp + 4], 2
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push ebx
mov word [edi + eax*2 + 2], cx
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
mov ax, word [ebp + 0x4c]
push esi
push ecx
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x1a], esi
mov word [ebp + 0x10], ax
call fcn.004051f2
lea eax, [ebp]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x401663.68
jmp 0x4025da
cmp edx, 0xbadf00d
jne 0x401e5e
inc dword [0x434ad4]
jmp case.0x401663.68
xor ebx, ebx
xor edi, edi
mov dword [ebp + 0x7c], ebx
cmp edx, ebx
je 0x402666
xor esi, esi
call fcn.00401460
mov edi, eax
cmp dword [ebp + 0x48], ebx
je 0x402676
push 0x11
pop esi
call fcn.00401460
mov dword [ebp + 0x7c], eax
cmp dword [ebp + 0x54], ebx
je 0x402685
push 0x22
pop esi
call fcn.00401460
mov ebx, eax
push 0xffffffffffffffcd
pop esi
call fcn.00401460
push eax
push ebx
push dword [ebp + 0x7c]
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x4017a1
xor esi, esi
inc esi
mov dword [ebp + 0x7c], 0xa
call fcn.00401460
push 0x12
pop esi
mov edi, eax
call fcn.00401460
push 0xffffffffffffffdd
pop esi
mov dword [ebp + 0x1c], eax
call fcn.00401460
push eax
push 0x3ff
push ebx
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebx], 0xa
jmp 0x401953
cmp dword [ebp + 0x54], 0
mov edi, dword [ebp + 0x48]
jne 0x402716
push 2
pop eax
call fcn.004014aa
mov edi, eax
test edi, edi
je 0x4017a9
push 0x33
pop esi
call fcn.00401460
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40272e
push 0x22
pop esi
call fcn.00401460
mov ecx, dword [ebp + 0x54]
sar ecx, 1
push ecx
push edi
mov esi, eax
call fcn.004015cc
mov esi, eax
test esi, esi
je case.0x401663.68
jmp 0x4017a9
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp + 0x5c]
push 2
pop esi
mov edi, edx
mov dword [ebp + 0x34], eax
call fcn.00401460
push 0x11
pop esi
mov dword [ebp + 0x68], eax
call fcn.00401460
lea ecx, [ebp + 0x1c]
push ecx
push 0x100022
push eax
mov eax, edi
mov dword [ebp + 0x70], 1
call fcn.00401498
push eax
call fcn.00406350
mov edi, eax
neg edi
sbb edi, edi
not edi
and edi, dword [ebp + 0x1c]
je case.0x401663.68
xor esi, esi
xor eax, eax
cmp dword [ebp + 0x7c], 1
mov ebx, 0x40b168
jne 0x4027ae
push 0x23
pop esi
call fcn.00401460
push ebx
call sub.KERNEL32.dll_lstrlenW
lea eax, [eax + eax + 2]
xor esi, esi
cmp dword [ebp + 0x7c], 4
jne 0x4027c7
push 3
pop ecx
call fcn.00401443
push 4
mov dword [0x40b168], eax
mov dword [ebp + 0x3c], edx
pop eax
cmp dword [ebp + 0x7c], 3
jne 0x4027f1
push dword [ebp + 0x60]
mov ecx, dword [ebp + 0x54]
mov eax, dword [ebp + 0x50]
push 0x1800
push ebx
push esi
push ecx
push eax
cmp dword [0x434a60], esi
je 0x4027eb
push 1
jmp 0x4027ec
push esi
call fcn.004032fd
push eax
push ebx
push dword [ebp + 0x34]
push esi
push dword [ebp + 0x68]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402808
mov dword [ebp + 0x70], esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x401663.68
mov eax, 0x20019
call fcn.004014aa
push 0x33
pop esi
mov edi, eax
call fcn.00401460
xor ecx, ecx
mov word [ebx], cx
test edi, edi
je 0x4017a9
lea ecx, [ebp + 0x1c]
push ecx
push ebx
lea ecx, [ebp + 0x7c]
push ecx
push 0
push eax
push edi
mov dword [ebp + 0x1c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x402890
cmp dword [ebp + 0x7c], 4
je 0x402878
cmp dword [ebp + 0x7c], ecx
je 0x402867
cmp dword [ebp + 0x7c], 2
jne 0x402890
mov eax, dword [ebp + 0x54]
mov dword [ebp + 0x70], eax
xor eax, eax
mov word [ebx + 0x7fe], ax
jmp 0x402808
push dword [ebx]
xor eax, eax
cmp dword [ebp + 0x54], eax
push ebx
sete al
mov dword [ebp + 0x70], eax
call fcn.004063fe
jmp 0x402808
xor eax, eax
mov word [ebx], ax
mov dword [ebp + 0x70], ecx
jmp 0x402808
mov eax, 0x20019
call fcn.004014aa
push 3
pop ecx
mov esi, eax
call fcn.00401443
mov dword [ebp + 0x1c], edx
xor ecx, ecx
xor edx, edx
mov word [ebx], cx
cmp esi, edx
je 0x4017a9
mov ecx, 0x3ff
mov dword [ebp + 0x7c], ecx
cmp dword [ebp + 0x54], edx
je 0x4028dc
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4028f8
push edx
push edx
push edx
push edx
lea ecx, [ebp + 0x7c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x4028f8
mov dword [ebp + 0x70], 1
xor eax, eax
mov word [ebx + 0x7fe], ax
push esi
jmp 0x402809
push ebx
call fcn.00406417
test eax, eax
je case.0x401663.68
push eax
jmp 0x402247
push 0xffffffffffffffed
pop esi
call fcn.00401460
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
push eax
call fcn.0040614c
cmp eax, 0xffffffff
jne 0x401c34
xor eax, eax
mov word [ebx], ax
jmp 0x4017a9
mov eax, dword [ebp + 0x4c]
xor ecx, ecx
cmp esi, 0x3a
sete cl
mov dword [ebp + 0x7c], eax
mov edi, ecx
test eax, eax
je 0x402971
xor ecx, ecx
inc ecx
call fcn.00401443
mov word [0x40a968], ax
xor eax, eax
test edi, edi
sete al
mov dword [ebp + 0x1c], edx
inc eax
jmp 0x40299d
cmp esi, 0x3a
jne 0x4029a1
push 0x21
pop esi
call fcn.00401460
push 0x400
mov esi, 0x40a968
push esi
push 0x40b168
call fcn.004064d9
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
jmp 0x4029b3
push 0x11
pop esi
call fcn.00401460
push eax
call sub.KERNEL32.dll_lstrlenW
mov esi, eax
add esi, esi
cmp word [ebx], 0
je 0x4017a9
push ebx
call fcn.00406417
or edi, dword [ebp + 0x7c]
mov ebx, eax
jne 0x4029de
cmp dword [ebp + 0x50], edi
je 0x4029de
push ebx
push ebx
call fcn.0040622d
test eax, eax
jl 0x4017a9
push esi
push 0x40a968
push ebx
call fcn.004061fe
jmp 0x4017a1
push 2
pop ecx
xor esi, esi
mov dword [ebp + 0x34], esi
mov dword [ebp - 0x20], ecx
call fcn.00401443
cmp eax, 1
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x1c], eax
jl case.0x401663.68
mov ecx, 0x3ff
cmp eax, ecx
jle 0x402a1a
mov dword [ebp + 0x1c], ecx
xor edi, edi
cmp word [ebx], di
je 0x402b84
push ebx
mov dword [ebp + 0x68], edi
call fcn.00406417
cmp dword [ebp + 0x1c], edi
mov dword [ebp + 0x2c], eax
jle 0x402b84
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp + 0x40], 0x3b
jne 0x402b18
push edi
lea eax, [ebp + 0x3c]
push eax
push 2
pop eax
sub eax, dword [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402b84
mov ecx, dword [ebp + 0x3c]
cmp ecx, edi
je 0x402b84
movzx ax, byte [ebp + 0x7c]
movzx eax, ax
mov dword [ebp - 0x20], ecx
mov dword [ebp + 0x64], eax
cmp dword [ebp + 0x50], edi
jne 0x402b45
push 1
lea eax, [ebp + 0x64]
push eax
push ecx
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
call ebx
test eax, eax
jne 0x402b40
mov esi, dword [ebp - 0x20]
neg esi
dec dword [ebp + 0x3c]
mov eax, 0xfffd
mov dword [ebp + 0x64], eax
je 0x402ae1
dec dword [ebp - 0x20]
push 1
push edi
inc esi
push esi
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x3c]
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
call ebx
test eax, eax
je 0x402aaa
mov eax, dword [ebp + 0x64]
mov esi, dword [ebp + 0x34]
cmp dword [ebp + 0x50], edi
jne 0x402b45
cmp word [ebp + 0x68], 0xd
je 0x402b56
cmp word [ebp + 0x68], 0xa
je 0x402b56
mov ecx, dword [ebp + 0x6c]
mov word [ecx + esi*2], ax
movzx ecx, ax
inc esi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x68], ecx
cmp ax, di
je 0x402b84
cmp esi, dword [ebp + 0x1c]
jl 0x402a40
jmp 0x402b84
cmp dword [ebp + 0x50], edi
jne 0x402b2e
cmp esi, edi
jne 0x402b2e
push edi
push dword [ebp + 0x2c]
call fcn.0040622d
test eax, eax
jl 0x402b84
push 2
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x2c]
call fcn.004061cf
test eax, eax
je 0x402b84
mov eax, dword [ebp + 0x64]
jmp 0x402ae4
movzx eax, ax
push eax
push dword [ebp + 0x6c]
call fcn.004063fe
jmp 0x402f83
cmp word [ebp + 0x68], ax
je 0x402b72
cmp ax, 0xd
je 0x402b68
cmp ax, 0xa
jne 0x402b72
mov ecx, dword [ebp + 0x6c]
mov word [ecx + esi*2], ax
inc esi
jmp 0x402b84
mov eax, dword [ebp - 0x20]
push 1
push edi
neg eax
push eax
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x6c]
xor eax, eax
mov word [ecx + esi*2], ax
cmp esi, edi
jmp 0x4017a3
cmp word [ebx], 0
je case.0x401663.68
push 2
pop ecx
call fcn.00401443
push dword [ebp + 0x50]
mov dword [ebp + 0x1c], edx
push 0
push eax
push ebx
call fcn.00406417
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x48], 0
jl case.0x401663.68
push eax
push dword [ebp + 0x6c]
jmp 0x401757
push ebx
call fcn.00406417
test eax, eax
je case.0x401663.68
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x401663.68
push dword [ebp + 0x6c]
call fcn.00406417
test eax, eax
je 0x401959
lea ecx, [ebp - 0x274]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x401959
jmp 0x402c42
push 2
pop esi
call fcn.00401460
lea ecx, [ebp - 0x274]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x402c39
mov ecx, dword [ebp + 0x6c]
xor eax, eax
mov word [ecx], ax
jmp 0x402938
push eax
push dword [ebp + 0x6c]
call fcn.004063fe
lea eax, [ebp - 0x248]
push eax
push ebx
call fcn.004064b7
jmp case.0x401663.68
push 0xfffffffffffffff0
pop esi
mov dword [ebp + 0x28], 0xfffffd66
or ebx, 0xffffffff
call fcn.00401460
mov edi, eax
push edi
mov dword [ebp + 0x68], edi
call fcn.0040601a
test eax, eax
jne 0x402c7d
push 0xffffffffffffffec
pop esi
call fcn.00401460
push edi
call fcn.00406126
push 2
push 0x40000000
push edi
call fcn.0040614c
xor edi, edi
mov dword [ebp + 0x7c], eax
cmp eax, ebx
je 0x402d7f
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x3c], eax
cmp dword [ebp + 0x50], edi
je 0x402d51
mov eax, dword [0x434a74]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x40
mov dword [ebp + 0x1c], eax
call esi
mov ebx, eax
cmp ebx, edi
je 0x402d51
push edi
call fcn.0040322a
push dword [ebp + 0x1c]
push ebx
call fcn.004031ce
push dword [ebp + 0x50]
push 0x40
call esi
mov esi, eax
mov dword [ebp + 0x34], esi
cmp esi, edi
je 0x402d36
push dword [ebp + 0x58]
push dword [ebp + 0x50]
push esi
push edi
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
cmp dword [0x434a60], edi
je 0x402d08
push 1
jmp 0x402d09
push edi
call fcn.004032fd
jmp 0x402d28
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push ecx
add esi, 8
push esi
add eax, ebx
push eax
mov dword [ebp - 0x24], ecx
call fcn.00406102
add esi, dword [ebp - 0x24]
cmp byte [esi], 0
jne 0x402d10
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 0x1c]
push ebx
push dword [ebp + 0x7c]
call fcn.004061fe
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or dword [ebp + 0x38], 0xffffffff
or dword [ebp + 0x3c], 0xffffffff
push dword [ebp + 0x5c]
push edi
push edi
push dword [ebp + 0x7c]
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
cmp dword [0x434a60], edi
je 0x402d6b
push 1
jmp 0x402d6c
push edi
call fcn.004032fd
push dword [ebp + 0x7c]
mov ebx, edx
mov dword [ebp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
push 0xfffffffffffffff3
pop esi
jg 0x402da0
jl 0x402d8d
cmp dword [ebp + 0x28], edi
jae 0x402da0
push 0xffffffffffffffef
pop esi
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp + 0x70], 1
push esi
jmp 0x401853
xor ecx, ecx
call fcn.00401443
mov edi, eax
mov dword [ebp + 0x1c], edx
cmp edi, dword [0x434a2c]
jae 0x4017a9
mov eax, dword [ebp + 0x4c]
mov esi, edi
imul esi, esi, 0x818
add esi, dword [0x434a28]
test eax, eax
jl 0x402dea
mov ecx, dword [esi + eax*4]
jne 0x402de4
add esi, 0x18
push esi
push dword [ebp + 0x6c]
jmp 0x402c4a
push ecx
jmp 0x402bc7
or ecx, 0xffffffff
sub ecx, eax
mov dword [ebp + 0x4c], ecx
je 0x402e04
xor ecx, ecx
inc ecx
call fcn.00401443
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x48], eax
jmp 0x402e17
push dword [ebp + 0x54]
lea eax, [esi + 0x18]
push eax
call fcn.004068b2
or dword [esi + 8], 0x100
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x48]
mov dword [esi + eax*4], ecx
cmp dword [ebp + 0x50], 0
je case.0x401663.68
push edi
call fcn.00401186
jmp case.0x401663.68
xor ecx, ecx
call fcn.00401443
mov dword [ebp + 0x1c], edx
cmp eax, 0x20
jae 0x4017a9
xor esi, esi
cmp dword [ebp + 0x50], esi
je 0x402e71
cmp dword [ebp + 0x4c], esi
je 0x402e66
push eax
call fcn.004012a6
push esi
push esi
call fcn.004011f8
jmp case.0x401663.68
push esi
call fcn.004012f1
jmp 0x402bc6
cmp dword [ebp + 0x4c], esi
je 0x402e8b
mov ecx, dword [ebp + 0x48]
mov edx, dword [0x434a0c]
mov dword [edx + eax*4 + 0x94], ecx
jmp case.0x401663.68
mov ecx, dword [0x434a0c]
push dword [ecx + eax*4 + 0x94]
push dword [ebp + 0x6c]
call fcn.004068b2
jmp case.0x401663.68
mov eax, dword [ebp + 0x50]
sub eax, 0
je 0x402ef4
dec eax
jne case.0x401663.68
push 2
pop ecx
call fcn.00401443
push 4
pop ecx
mov esi, eax
mov dword [ebp + 0x1c], edx
call fcn.00401443
and dword [ebp + 0x7c], 0
movzx ecx, al
shr eax, 0x18
mov dword [ebp + 0x1c], edx
test esi, esi
jne 0x402edf
mov esi, 0x434ac0
push ecx
add eax, esi
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00406102
push dword [ebp + 0x7c]
jmp 0x402bc7
push 5
call fcn.0040663c
push 0x22
pop esi
mov edi, eax
call fcn.00401460
test edi, edi
je 0x402f41
lea ecx, [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jl 0x402f41
lea eax, [ebp + 0x7c]
push eax
push 0
push dword [ebp + 0x50]
lea eax, [ebp + 0x10]
push eax
call edi
test eax, eax
jl 0x402f41
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.004064b7
push dword [ebp + 0x7c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp case.0x401663.68
mov ecx, dword [ebp + 0x6c]
xor eax, eax
mov dword [ebp + 0x70], 1
mov word [ecx], ax
jmp case.0x401663.68
mov eax, dword [0x42ed70]
push 0
and eax, edx
push eax
push 0xb
push dword [ebp + 0x64]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp + 0x44], 0
je case.0x401663.68
push 0
push 0
push dword [ebp + 0x64]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp + 0x70]
add dword [0x434ac8], eax
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4