Function at 0x403137
Capabilities:
Check os version
Delete file
Get common file path
Get file size
Get geographical location
Query environment variable
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 8], 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
inc eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
je 0x40370a
cmp dword [0x44f970], 1
jne 0x402c80
mov eax, dword [0x436540]
and eax, 4
jne 0x402c80
mov eax, dword [0x436540]
and eax, 8
jne 0x402c80
call fcn.00407e6b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [eax + 0xc], ecx
mov eax, dword [0x436540]
and eax, 0x20
je 0x402c9f
push dword [ebp + 8]
call fcn.004091fc
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x3a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7d
ja case.0x402cc5.2
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax + 0x40381b]
jmp dword [eax*4 + 0x403737]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00405a3b
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x403528
cmp dword [ebp + 0x10], 0xffffffe6
jne 0x402cf0
jmp 0x40370a
push 0x4368c0
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
push 5
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
test eax, eax
je 0x402d6c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 4], eax
push 0
push 1
push 0xb
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
movsx eax, word [ebp - 0x10]
test eax, eax
je 0x402d6a
push dword [ebp + 0x14]
push 5
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402c2b
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402d68
push 0x13
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
jmp 0x402d6c
jmp case.0x402cc5.112
jmp 0x403528
cmp dword [ebp + 0x10], 5
jne 0x402d7c
jmp 0x40370a
push str.CASE_without_SELECT
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
cmp dword [ebp + 0x10], 5
jne 0x402d9f
call fcn.00416b9c
jmp 0x40370a
push str.ENDSELECT_without_SELECT
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
push 0x41
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402c2b
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402e04
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 1
push 0xb
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
movsx eax, word [ebp - 0x10]
test eax, eax
jne 0x402e04
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x24], ecx
movsx eax, word [ebp - 0x10]
test eax, eax
jne 0x402e12
cmp dword [ebp - 8], 0
je 0x402dbb
jmp 0x403528
cmp dword [ebp + 0x10], 0x41
jne 0x402e22
jmp 0x40370a
push str.UNTIL_without_DO
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004052d0
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x403528
cmp dword [ebp + 0x10], 0x2a
jne 0x402e59
jmp 0x40370a
push str.NEXT_without_FOR
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 1
push 0xb
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
movsx eax, word [ebp - 0x10]
test eax, eax
je 0x402ec0
push dword [ebp + 0x14]
push 0x26
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402c2b
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402ebe
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x24], ecx
jmp 0x402ecc
push 0x26
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
movsx eax, word [ebp - 0x10]
test eax, eax
je 0x402eda
cmp dword [ebp - 8], 0
je 0x402e75
jmp 0x403528
cmp dword [ebp + 0x10], 0x26
jne 0x402eea
jmp 0x40370a
push str.LOOP_without_WHILE
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 4], eax
push 0
push 1
push 0xb
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
movsx eax, word [ebp - 0x10]
test eax, eax
je 0x402f42
push dword [ebp + 0x14]
push 0x14
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402c2b
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x402f6b
push 0x14
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
test eax, eax
je 0x402f6b
push dword [ebp + 0x14]
push 0x11
mov eax, dword [ebp + 8]
push dword [eax + 0x24]
push dword [ebp + 8]
call fcn.00402c2b
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x403528
cmp dword [ebp + 0x10], 0x14
jne 0x402f91
push 0x11
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
jmp 0x40370a
push str.ELSE_without_IF
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
cmp dword [ebp + 0x10], 0x11
jne 0x402faf
jmp 0x40370a
cmp dword [ebp + 0x10], 0x14
jne 0x402fc4
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x14
jmp 0x40370a
push str.ENDIF_without_IF
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x403528
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004059d4
pop ecx
pop ecx
mov dword [ebp - 8], eax
jmp 0x403528
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040593f
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x403528
or dword [ebp - 8], 0xffffffff
jmp 0x403528
jmp 0x403528
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 1
push 8
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
push dword [ebp - 0x10]
call fcn.00402b84
pop ecx
cmp eax, 0xffffffff
jne 0x403047
mov dword [0x43d000], 2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x403528
push 0
push 0
push str.default_beep
call dword [sym.imp.WINMM.dll_PlaySoundA]
jmp 0x403528
mov dword [0x43d028], 1
jmp 0x403528
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
je 0x4030bf
push 0x436974
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041eba8
pop ecx
pop ecx
test eax, eax
jne 0x4030a4
call fcn.00407f38
jmp 0x4030bf
push 0x436978
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041eba8
pop ecx
pop ecx
test eax, eax
jne 0x4030bf
call fcn.00407e6b
jmp 0x403528
push dword [ebp + 8]
call fcn.00403906
pop ecx
jmp 0x403528
cmp dword [0x43d024], 0
jne 0x4030e0
call fcn.00407fda
jmp 0x403528
push dword [ebp + 8]
call fcn.00403ada
pop ecx
jmp 0x403528
mov eax, dword [0x43d008]
inc eax
mov dword [0x43d008], eax
jmp 0x403528
push dword [ebp + 8]
call fcn.00404cf6
pop ecx
jmp 0x403528
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
je 0x403176
push 0x43697c
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041eba8
pop ecx
pop ecx
test eax, eax
jne 0x403153
mov eax, dword [0x436540]
and eax, 0x10
jne 0x403151
call fcn.00409045
mov eax, dword [0x436540]
or eax, 0x20
mov dword [0x436540], eax
jmp 0x403176
push 0x436980
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041eba8
pop ecx
pop ecx
test eax, eax
jne 0x403176
mov eax, dword [0x436540]
and eax, 0xffffffdf
mov dword [0x436540], eax
jmp 0x403528
push dword [ebp + 8]
call fcn.00404e6d
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.0040516d
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.00405e21
pop ecx
jmp 0x403528
call fcn.00405237
jmp 0x403528
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or dword [ebp - 8], 0xffffffff
push 0
push 0
push 3
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
movzx eax, word [ebp - 0x18]
test eax, eax
je 0x4031f2
mov eax, dword [ebp - 0x10]
mov dword [0x43d000], eax
cmp dword [ebp + 0x14], 0
je 0x4031f0
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x43d000]
mov dword [eax], ecx
jmp 0x4031f9
and dword [0x43d000], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xfffffff1
jmp 0x403528
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
je 0x403226
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x12
je 0x403226
call fcn.00419289
jmp 0x40320d
jmp 0x403528
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 0
push 3
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
call fcn.0041a488
cmp dword [0x43d008], 0
je 0x40325a
call fcn.00402b0a
push dword [ebp - 0x10]
call fcn.0041efa8
call fcn.00407fa5
jmp 0x403528
push dword [ebp + 8]
call fcn.00405720
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.0040587d
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.00405b13
pop ecx
jmp 0x403528
push 0x436984
call fcn.004083d1
pop ecx
jmp 0x403528
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 1
push 8
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x403528
push dword [ebp + 8]
call fcn.00405c6e
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.00405dde
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.00406049
pop ecx
jmp 0x403528
push 0
push dword [ebp + 8]
call fcn.004060fc
pop ecx
pop ecx
jmp 0x403528
push 1
push dword [ebp + 8]
call fcn.004060fc
pop ecx
pop ecx
jmp 0x403528
call fcn.0040621e
jmp 0x403528
push dword [ebp + 8]
call fcn.00405f72
pop ecx
jmp 0x403528
push dword [ebp + 8]
call fcn.00406250
pop ecx
jmp 0x403528
call fcn.0040634a
jmp 0x403528
and dword [0x43d028], 0
jmp 0x403528
push dword [ebp + 8]
call fcn.00406cce
pop ecx
jmp 0x403528
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 5
push 8
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
push dword [ebp - 0x10]
call fcn.004083d1
pop ecx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x403528
push dword [ebp + 8]
call fcn.0040638a
pop ecx
jmp 0x403528
push 0
push 1
push 8
lea eax, [ebp - 0x18]
push eax
call fcn.00409b6d
add esp, 0x10
push dword [ebp - 0x10]
call fcn.0041ea20
pop ecx
cmp eax, 2
jb 0x40343d
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x40343d
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x40343d
cmp dword [0x43bd00], 1
jle 0x403401
push 0x103
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.0041fc3d
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
jmp 0x403419
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x40343d
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.0041f1a4
pop ecx
sub eax, 0x60
push eax
call fcn.0041fbe6
pop ecx
mov dword [0x43d000], eax
jmp 0x40344f
push dword [ebp - 0x10]
push 0x436988
push 1
call fcn.0041ac2a
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x403528
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0
je 0x403503
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041ea20
pop ecx
cmp eax, 2
jne 0x403503
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
movsx eax, byte [eax + 2]
test eax, eax
jne 0x403503
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x403503
cmp dword [0x43bd00], 1
jle 0x4034c1
push 0x103
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
movsx eax, byte [eax]
push eax
call fcn.0041fc3d
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
jmp 0x4034dc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
movsx eax, byte [eax]
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x403503
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
movsx eax, byte [eax]
push eax
call fcn.0041f1a4
pop ecx
sub eax, 0x60
push eax
call fcn.0041fbe6
pop ecx
mov dword [0x43d000], eax
jmp 0x403518
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
push str.unknown_command___s_
push 1
call fcn.0041ac2a
add esp, 0xc
jmp 0x403528
push 0x4369b8
push 1
call fcn.0041aa80
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x4036ef
cmp dword [ebp - 8], 0xffffffff
je 0x4036ef
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jb 0x4036ef
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x24]
jbe 0x4036e2
mov dword [ebp - 0x1c], 1
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
je 0x4036c4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
cmp eax, dword [ebp - 8]
ja 0x4036c4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 5
je 0x4035be
cmp dword [ebp - 0x2c], 0x11
je 0x403624
cmp dword [ebp - 0x2c], 0x14
je 0x4035e5
cmp dword [ebp - 0x2c], 0x26
je 0x403690
cmp dword [ebp - 0x2c], 0x2a
je 0x403648
cmp dword [ebp - 0x2c], 0x41
je 0x40366c
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x36
jne 0x4035d0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4035e0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x13
jne 0x4035e0
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x21
jne 0x4035f7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x40361f
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x11
jne 0x403609
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x40361f
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x14
jne 0x40361f
cmp dword [ebp - 0x1c], 1
jne 0x40361f
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x21
jne 0x403636
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x403646
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x11
jne 0x403646
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x19
jne 0x40365a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x40366a
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x2a
jne 0x40366a
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xf
jne 0x40367e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x40368e
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x41
jne 0x40368e
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x43
jne 0x4036a2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4036b2
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x26
jne 0x4036b2
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4036ba
jmp 0x4036c4
call fcn.00419289
jmp 0x403563
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
je 0x4036e0
cmp dword [ebp - 0x1c], 0
je 0x4036e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x24], ecx
and dword [ebp - 8], 0
jmp 0x4036ef
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x24], ecx
and dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x4036fe
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xfffffff1
jne 0x403700
jmp 0x40370a
call fcn.00419289
jmp 0x402c51
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
jne 0x40371c
push dword [ebp + 8]
call fcn.0041c10b
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
dec eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
push dword [ebp + 8]
call fcn.00409026
pop ecx
mov eax, dword [ebp - 8]
leave
ret