Function at 0x4014cf
Capabilities:
Copy file
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x288
mov eax, dword [esp + 0x29c]
mov ecx, dword [0x40a008]
mov ecx, dword [ecx]
mov dword [esp + 4], ecx
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0xc]
lea ecx, [esp + 0x14]
movups xmmword [ecx - 4], xmm0
movups xmmword [ecx + 8], xmm1
mov eax, dword [ecx - 4]
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [0x419938], ecx
lea ecx, [eax - 2]
mov dword [esp], 0
cmp ecx, 0x43
ja case.0x40153d.66
mov edx, dword [0x40a174]
mov ebp, dword [edx]
mov edx, esi
shl edx, 0xb
add edx, ebp
mov edi, ebx
shl edi, 0xb
add edi, ebp
mov dword [esp], 0
jmp dword [ecx*4 + 0x40a010]
mov dword [esp + 0xc], edx
mov ecx, 3
call fcn.004031b9
mov ebp, eax
mov ecx, 4
call fcn.004031b9
mov edi, eax
mov eax, dword [esp + 0x28]
test al, 1
je 0x401580
mov eax, dword [0x419938]
push dword [eax + 0xc]
push 0x4188f8
call fcn.004072ff
mov ebp, eax
mov eax, dword [esp + 0x28]
test al, 2
je 0x401598
mov eax, dword [0x419938]
push dword [eax + 0x10]
push 0x4190f8
call fcn.004072ff
mov edi, eax
cmp dword [esp + 0x10], 0x21
jne 0x40289d
xor ecx, ecx
inc ecx
call fcn.004031b9
mov ebx, eax
mov ecx, 2
call fcn.004031b9
mov ecx, dword [esp + 0x28]
cmp ecx, 4
jae 0x402942
push edi
push ebp
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x38], eax
xor ebx, ebx
jmp 0x40295e
mov ebp, dword [esp + 0x1c]
cmp eax, 0x38
sete byte [esp]
test ebp, ebp
mov dword [esp + 0xc], edx
je 0x402901
xor ebx, ebx
cmp eax, 0x38
sete bl
xor ecx, ecx
inc ecx
call fcn.004031b9
mov word [0x4178f8], ax
mov esi, 2
sub esi, ebx
jmp 0x402cc2
mov ecx, 2
mov esi, edx
call fcn.004031b9
mov dword [esp], 0
test eax, eax
jle case.0x40153d.66
mov ecx, esi
mov ebx, edi
mov esi, 0x3ff
cmp eax, esi
cmovl esi, eax
cmp word [ecx], 0
je 0x402938
mov edi, 2
push ecx
call fcn.00407749
mov dword [esp], eax
xor ebp, ebp
xor eax, eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 4], eax
cmp dword [esp + 0x10], 0x39
jne 0x401726
mov eax, 2
sub eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x3c]
push ecx
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402fa6
mov edi, dword [esp + 0x38]
test edi, edi
je 0x402fa6
movzx eax, byte [esp + 0x30]
mov word [esp + 8], ax
cmp dword [esp + 0x20], 0
jne 0x402f29
mov dword [esp + 0xc], ebp
push 1
lea eax, [esp + 0xc]
push eax
push edi
lea eax, [esp + 0x3c]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401718
xor esi, esi
inc esi
sub esi, edi
mov word [esp + 8], 0xfffd
dec dword [esp + 0x38]
je 0x401718
dec edi
xor ebp, ebp
inc ebp
push ebp
xor ebx, ebx
push ebx
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x3c]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc esi
test eax, eax
je 0x4016db
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0xc]
jmp 0x401759
mov eax, dword [esp + 0x20]
or eax, ebp
jne 0x401741
push 0
push dword [esp + 4]
call fcn.00407066
test eax, eax
js 0x403187
push 2
lea eax, [esp + 0xc]
push eax
push dword [esp + 8]
call fcn.00407002
test eax, eax
je 0x402fa6
cmp dword [esp + 0x20], 0
jne 0x402f29
mov ecx, dword [esp + 4]
cmp cx, 0xd
je 0x402eac
movzx eax, cx
cmp eax, 0xa
je 0x402eac
movzx eax, word [esp + 8]
mov word [ebx + ebp*2], ax
inc ebp
movzx eax, word [esp + 8]
test ax, ax
je 0x402fa6
cmp ebp, esi
jl 0x40165f
jmp 0x402fa6
push 0
push esi
call fcn.00406324
jmp 0x4028f7
mov eax, dword [0x40a170]
inc dword [eax]
mov esi, 0x7fffffff
cmp dword [esp + 4], 0
je case.0x40153d.2
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x40153d.2
test esi, esi
jns 0x4017e7
not esi
shl esi, 0xb
add ebp, esi
push ebp
call fcn.00407749
mov esi, eax
dec esi
push 0
push esi
call fcn.004013ec
mov esi, eax
jmp case.0x40153d.2
push 0
push esi
jmp 0x4019cb
mov dword [esp], 0
xor ecx, ecx
call fcn.004031b9
xor ecx, ecx
inc ecx
cmp eax, 2
cmovge ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40153d.66
push dword [esp + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403025
mov eax, dword [0x40a17c]
mov eax, dword [eax]
test eax, eax
je 0x401844
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x40a178]
mov eax, dword [eax]
mov dword [esp], 0
test eax, eax
je case.0x40153d.66
push dword [esp + 0x14]
push eax
jmp 0x402c0d
push 0xfffffffffffffff0
call fcn.004031d6
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x402c51
mov dword [esp], ebp
push 0xfffffffffffffff0
call fcn.004031d6
mov esi, eax
push eax
call fcn.00406d6c
xor ebp, ebp
test eax, eax
je 0x4018f1
push 0x5c
push eax
call fcn.00406d08
mov edi, eax
movzx ebx, word [eax]
mov word [eax], 0
test bx, bx
jne 0x4018c2
cmp dword [esp + 0x1c], 0
je 0x4018c2
call fcn.00406782
test eax, eax
je 0x4018c2
push esi
call fcn.00406710
jmp 0x4018c8
push esi
call fcn.00406764
test eax, eax
je 0x4018e4
cmp eax, 0xb7
jne 0x4018e3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 4
sbb ebp, 0xffffffff
jmp 0x4018e4
inc ebp
mov eax, edi
add eax, 2
mov word [edi], bx
test bx, bx
jne 0x401893
cmp dword [esp + 0x18], 0
je 0x402a50
push 0x4178f8
push 0xffffffffffffffe6
call fcn.00406324
mov eax, dword [esp]
add eax, 0xb000
push esi
push eax
call fcn.00406c2f
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, 1
adc ebp, 0
jmp 0x402a5c
push esi
push 0x4170f8
call fcn.004072ff
push eax
call fcn.00406cb1
jmp 0x401d58
cmp dword [esp + 0x1c], 0
jle 0x402a64
mov eax, dword [esi*4 + 0x4198fc]
mov dword [esi*4 + 0x4170b8], eax
jmp 0x403025
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x4170b8]
xor edx, edx
test ecx, ecx
sete dl
mov esi, dword [esp + edx*4 + 0x14]
and ecx, dword [esp + 0x20]
mov dword [eax*4 + 0x4170b8], ecx
jmp case.0x40153d.2
push dword [ebx*4 + 0x4170b8]
push edx
jmp 0x403020
push 0xffffffffffffffd0
call fcn.004031d6
mov esi, eax
push 0xffffffffffffffdf
call fcn.004031d6
mov edi, eax
mov eax, dword [0x419938]
push dword [eax + 0xc]
push 0x4178f8
call fcn.004072ff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x402a8c
push 0x4178f8
push 0xffffffffffffffe3
call fcn.00406324
jmp 0x403025
push esi
push 0x4170f8
call fcn.004072ff
mov esi, eax
lea eax, [esp + 0x38]
push eax
push edi
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x402a2b
mov eax, dword [esp + 0x38]
xor ebx, ebx
cmp eax, esi
jbe 0x402a33
cmp word [eax], 0
je 0x402a33
push esi
call fcn.00406cb1
test eax, eax
je 0x402a2b
add eax, 0x2c
push eax
push dword [esp + 0x3c]
call fcn.00406c2f
jmp 0x402a33
push 0xffffffffffffffff
mov esi, edx
call fcn.004031d6
lea ecx, [esp + 0x38]
xor edi, edi
push ecx
push esi
push 0x400
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x401a5f
mov word [esi], 0
xor edi, edi
inc edi
mov dword [esp], edi
jmp case.0x40153d.66
push 0xffffffffffffffef
mov esi, edx
call fcn.004031d6
push eax
push esi
call fcn.00406f94
jmp 0x402c51
push ebx
push 0x4188f8
call fcn.004072ff
mov edi, eax
mov esi, dword [esp + 0x14]
push eax
call fcn.00406d3b
test eax, eax
mov dword [esp + 4], edi
je 0x402abe
push edi
push 0x4170f8
call fcn.00406c2f
jmp 0x402adc
push esi
push 0x4170f8
call fcn.004072ff
jmp 0x401b04
push ebx
push 0x4188f8
call fcn.004072ff
push dword [esp + 0x14]
push eax
call fcn.00406878
test eax, eax
je 0x402fd8
cmp eax, dword [esp + 0x1c]
je 0x402bd5
mov dword [esp], 0
cmp eax, dword [esp + 0x24]
jne case.0x40153d.66
mov esi, dword [esp + 0x28]
jmp case.0x40153d.2
push 0xfffffffffffffff0
call fcn.004031d6
push dword [esp + 0x18]
push eax
call fcn.00406963
jmp 0x403025
push ebx
push 0x4170f8
mov esi, edx
call fcn.004072ff
push eax
call sub.KERNEL32.dll_lstrlenW
jmp 0x402570
mov ecx, 2
mov dword [esp + 0xc], edx
call fcn.004031b9
mov esi, eax
mov ebx, edx
mov ecx, 3
call fcn.004031b9
mov ebp, eax
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4170f8
call fcn.004072ff
mov edi, eax
push eax
call sub.KERNEL32.dll_lstrlenW
mov edx, dword [esp + 0xc]
mov word [edx], 0
test ebx, ebx
cmove esi, eax
mov dword [esp], 0
test esi, esi
je case.0x40153d.66
mov ecx, ebp
sar ecx, 0x1f
and ecx, eax
add ecx, ebp
mov dword [esp], 0
js case.0x40153d.66
cmp ecx, eax
cmovl eax, ecx
lea eax, [edi + eax*2]
push eax
push edx
mov edi, edx
call fcn.00406c2f
test esi, esi
jns 0x401bb3
push edi
call sub.KERNEL32.dll_lstrlenW
add esi, eax
xor eax, eax
test esi, esi
cmovle esi, eax
cmp esi, 0x3ff
ja 0x403025
mov eax, dword [esp + 0xc]
mov word [eax + esi*2], 0
jmp 0x403025
push esi
push 0x4180f8
call fcn.004072ff
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4188f8
call fcn.004072ff
cmp dword [esp + 0x24], 0
je 0x402bbc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x402bc4
push ebx
push 0x4170f8
mov edi, edx
call fcn.004072ff
mov esi, eax
push 0x400
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, edi
test eax, eax
je 0x401c45
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x401c4d
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, edi
test eax, eax
jne 0x401c4d
mov word [ecx], 0
xor ebx, ebx
inc ebx
mov dword [esp], ebx
mov word [ecx + 0x7fe], 0
jmp case.0x40153d.66
mov edi, dword [esp + 0x28]
xor ecx, ecx
call fcn.004031b9
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.004031b9
test edi, edi
je 0x402bcd
cmp esi, eax
jb 0x402bd5
ja 0x402f17
jmp 0x402f20
mov ebx, edx
xor edi, edi
inc edi
mov ecx, edi
call fcn.004031b9
mov esi, eax
mov ecx, 2
call fcn.004031b9
mov ecx, eax
xor ebp, ebp
mov eax, dword [esp + 0x20]
cmp eax, 0xd
ja case.default.0x401cb7
jmp dword [eax*4 + 0x40a120]
add esi, ecx
jmp case.default.0x401cb7
push ebx
push 0x4170f8
mov edi, edx
call fcn.004072ff
mov esi, eax
mov ecx, 2
call fcn.004031b9
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403025
mov esi, dword [0x41993c]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402bde
test esi, esi
je 0x4028e3
dec eax
mov esi, dword [esi]
add eax, 0xffffffff
jae 0x401d15
test esi, esi
jne 0x401d0a
test esi, esi
je 0x4028e3
add esi, 4
mov edi, 0x4170f8
push esi
push edi
call fcn.00406c2f
mov eax, dword [0x41993c]
add eax, 4
push eax
push esi
call fcn.00406c2f
mov eax, dword [0x41993c]
add eax, 4
push edi
push eax
jmp 0x402638
xor ecx, ecx
call fcn.004031b9
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402f20
mov esi, dword [esp + 0x18]
jmp case.0x40153d.2
xor ecx, ecx
inc ecx
mov edi, edx
call fcn.004031b9
mov esi, eax
mov ecx, 2
call fcn.004031b9
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x40301e
mov eax, dword [0x40a00c]
add ebx, dword [eax + 0x28]
mov dword [esp], 0
xor ecx, ecx
call fcn.004031b9
push ebx
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40153d.66
mov dword [esp + 0xc], edx
test byte [esp + 0x21], 1
jne 0x40297c
push dword [esp + 0x1c]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402986
mov ebp, dword [esp + 4]
push ebp
mov ebx, edx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov ecx, 2
call fcn.004031b9
mov edi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x48
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x419940], eax
push esi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 3
call fcn.004031b9
mov dword [0x419950], eax
mov al, byte [esp + 0x24]
mov ecx, eax
and cl, 1
mov byte [0x419954], cl
mov ecx, eax
and cl, 2
mov byte [0x419955], cl
and al, 4
mov byte [0x419956], al
mov byte [0x419957], 1
push dword [esp + 0x18]
push 0x41995c
call fcn.004072ff
push 0x419940
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
jmp 0x402d54
xor ecx, ecx
call fcn.004031b9
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.004031b9
cmp dword [esp + 0x20], 0
je 0x402c0b
push eax
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x403025
push esi
push 0x4170f8
call fcn.004072ff
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4188f8
call fcn.004072ff
mov dword [esp], eax
mov eax, dword [0x419938]
push dword [eax + 8]
push 0x4180f8
call fcn.004072ff
mov edi, eax
mov eax, dword [0x419938]
mov ebx, 0x4178f8
push dword [eax + 0x14]
push ebx
call fcn.004072ff
push ebx
push 0xffffffffffffffec
call fcn.00406324
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x38]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x1c], ecx
xor ecx, ecx
cmp word [esi], 0
cmove esi, ecx
mov dword [eax + 0xc], esi
mov edx, dword [esp]
mov dword [eax + 0x10], edx
cmp word [edi], 0
cmove edi, ecx
mov dword [eax + 0x14], edi
add ebp, 0xb000
mov dword [eax + 0x18], ebp
push eax
call fcn.0040683e
test eax, eax
je 0x4022fe
test byte [esp + 0x3c], 0x40
jne 0x402d5a
xor ebx, ebx
jmp 0x402d6f
push esi
push 0x4170f8
call fcn.004072ff
mov esi, eax
push eax
push 0xffffffffffffffeb
call fcn.00406324
push esi
call fcn.004067d5
test eax, eax
je 0x402fd8
mov esi, eax
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x402fc0
push esi
call fcn.0040790c
cmp dword [esp + 0x18], 0
js 0x402fb9
push eax
push edi
call fcn.00407730
jmp 0x402fc0
mov ebx, edi
mov edi, edx
push dword [esp + 0x1c]
push 0x4170f8
call fcn.004072ff
push eax
call fcn.00406cb1
test eax, eax
je 0x402c18
mov esi, eax
push dword [eax + 0x14]
push ebx
call fcn.00407730
push dword [esi + 0x18]
jmp 0x40301f
push 0xffffffffffffffee
mov dword [esp + 0x10], edx
call fcn.004031d6
mov ebp, eax
push 0xb
call fcn.0040679c
lea ecx, [esp + 0x38]
push ecx
push ebp
call eax
mov esi, eax
xor eax, eax
mov ecx, dword [esp + 0xc]
mov word [ecx], ax
mov word [edi], ax
xor ebx, ebx
inc ebx
test esi, esi
je 0x402d6f
mov dword [esp + 0x2c], edi
mov edi, ebp
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x402d6f
mov ebp, eax
push 0xc
call fcn.0040679c
mov ebx, eax
push 0xd
call fcn.0040679c
mov dword [esp], eax
push ebp
push esi
push 0
push edi
call ebx
xor ebx, ebx
inc ebx
test eax, eax
je 0x402073
lea eax, [esp + 0x30]
lea ecx, [esp + 8]
push eax
push ecx
push 0x40a158
push ebp
call dword [esp + 0x10]
test eax, eax
je 0x402073
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 8]
push dword [esp + 0x10]
call fcn.00407730
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 0xc]
push dword [esp + 0x30]
call fcn.00407730
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x402d6f
cmp dword [0x419934], 0
js 0x402c25
push 0xfffffffffffffff0
call fcn.004031d6
mov ebx, eax
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4170f8
call fcn.004072ff
mov edi, eax
cmp dword [esp + 0x24], 0
je 0x4020bd
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test eax, eax
jne 0x4020d2
push 8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
je 0x402fcc
push edi
push esi
call fcn.004078c6
test eax, eax
je 0x402f3a
mov ebx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403070
push 0x4178f8
push eax
call fcn.00406324
call ebx
xor ebx, ebx
test eax, eax
setne bl
jmp 0x40308b
push 0xfffffffffffffff0
call fcn.004031d6
mov ebx, eax
push 0xffffffffffffffdf
call fcn.004031d6
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 8]
push 0x4170f8
call fcn.004072ff
mov dword [esp], eax
push 0xffffffffffffffcd
call fcn.004031d6
mov dword [esp + 0xc], eax
mov eax, dword [0x419938]
push dword [eax + 0x14]
push 0x4190f8
call fcn.004072ff
mov dword [esp + 4], eax
mov edi, dword [esp + 0x24]
push esi
call fcn.00406d3b
test eax, eax
jne 0x402170
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4180f8
call fcn.004072ff
lea eax, [esp + 0x38]
mov ecx, dword [0x40a164]
mov edx, dword [0x40a15c]
push eax
push ecx
push 1
push 0
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402c31
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
lea edx, [esp + 8]
mov ebx, dword [0x40a160]
push edx
push ebx
push eax
call dword [ecx]
test eax, eax
js 0x402e1c
mov ebx, edi
shr ebx, 0xc
and ebx, 7
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov esi, eax
test di, di
js 0x4021e1
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
add ebp, 0xb000
push ebp
push eax
call dword [ecx + 0x24]
mov ebp, edi
shr ebp, 0x10
test ebx, ebx
je 0x4021f5
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x34]
mov edx, dword [esp + 0xc]
cmp word [edx], 0
je 0x40221c
and edi, 0xfff
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push edi
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push dword [esp]
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push dword [esp + 4]
push eax
call dword [ecx + 0x1c]
test esi, esi
mov edx, dword [esp + 0x2c]
js 0x40224e
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x402e1e
push esi
push 0x4170f8
call fcn.004072ff
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4178f8
call fcn.004072ff
mov edi, eax
mov eax, dword [0x419938]
push dword [eax + 0xc]
push 0x4180f8
call fcn.004072ff
mov ebx, eax
push esi
call fcn.00406cb1
test eax, eax
je 0x4022f5
lea ebp, [esp + 0x38]
mov eax, dword [esp + 4]
mov dword [ebp], eax
mov dword [ebp + 4], 2
push esi
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [esi + eax*2 + 2], cx
push edi
call sub.KERNEL32.dll_lstrlenW
mov ecx, ebx
xor ebx, ebx
xor edx, edx
mov word [edi + eax*2 + 2], dx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x1a], ecx
movzx eax, word [esp + 0x1c]
mov word [ebp + 0x10], ax
push ecx
push 0
call fcn.00406324
push ebp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x402d6f
push 0
push 0xfffffffffffffff9
call fcn.00406324
xor ebx, ebx
inc ebx
jmp 0x402d6f
cmp esi, 0xbadf00d
jne 0x4028e3
inc dword [0x4170cc]
jmp 0x403025
xor edi, edi
mov ebp, 0
test esi, esi
je 0x402339
push esi
push 0x4170f8
call fcn.004072ff
mov ebp, eax
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x402351
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4178f8
call fcn.004072ff
mov edi, eax
cmp dword [esp + 0x24], 0
je 0x402c3e
mov eax, dword [0x419938]
push dword [eax + 8]
push 0x4180f8
call fcn.004072ff
mov esi, eax
jmp 0x402c40
lea eax, [esp + 0x38]
mov dword [eax], 0xa
push ebx
push 0x4170f8
mov ebp, edx
call fcn.004072ff
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 8]
push 0x4178f8
call fcn.004072ff
mov edi, eax
push 0xffffffffffffffdd
call fcn.004031d6
push eax
push 0x3ff
push ebp
lea eax, [esp + 0x44]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp word [ebp], 0xa
jne 0x402fdb
mov word [ebp], 0
jmp 0x402fd8
cmp dword [esp + 0x24], 0
je 0x402c60
push dword [esp + 0x1c]
push 0x4180f8
call fcn.004072ff
mov ecx, dword [esp + 0x24]
sar ecx, 1
push ecx
push eax
push ebx
call fcn.00403265
mov edi, eax
jmp 0x402c94
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push dword [esp + 0x1c]
push 0x4170f8
call fcn.004072ff
mov edi, eax
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4178f8
call fcn.004072ff
push eax
push esi
call fcn.004032bd
test eax, eax
je 0x402fd8
mov esi, eax
cmp ebp, 4
je 0x402f4a
cmp ebp, 3
je 0x402f60
xor eax, eax
cmp ebp, 1
jne 0x402f75
mov eax, dword [0x419938]
mov ebp, 0x4180f8
push dword [eax + 0xc]
push ebp
call fcn.004072ff
push ebp
call sub.KERNEL32.dll_lstrlenW
add eax, eax
add eax, 2
jmp 0x402f75
push 0x20019
mov edi, edx
call fcn.00403216
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 0xc]
push 0x4188f8
call fcn.004072ff
mov word [edi], 0
test esi, esi
je 0x402fd8
mov ebp, edi
lea ecx, [esp + 0x38]
mov dword [ecx], 0x800
lea edx, [esp + 8]
push ecx
push edi
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402e4c
mov word [ebp], 0
xor ebx, ebx
inc ebx
jmp 0x403064
push 0x20019
mov edi, edx
call fcn.00403216
mov esi, eax
mov ecx, 3
call fcn.004031b9
mov word [edi], 0
test esi, esi
je 0x402fd8
mov edx, edi
mov dword [esp + 0x38], 0x3ff
cmp dword [esp + 0x24], 0
je 0x402e6e
push 0x3ff
push edx
push eax
push esi
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ecx, ecx
jmp 0x402e9b
push edx
call fcn.00407749
mov dword [esp], 0
test eax, eax
je case.0x40153d.66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403025
mov esi, edx
push 0xffffffffffffffed
call fcn.004031d6
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call fcn.00406f62
cmp eax, 0xffffffff
je 0x4025fc
push eax
push esi
jmp 0x403020
cmp word [edx], 0
mov dword [esp], 0
je case.0x40153d.66
push edx
call fcn.00407749
mov esi, eax
mov ecx, 2
call fcn.004031b9
push dword [esp + 0x20]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x18], 0
mov dword [esp], 0
jns 0x40301e
jmp case.0x40153d.66
push edx
call fcn.00407749
mov dword [esp], 0
test eax, eax
je case.0x40153d.66
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x403025
mov esi, edx
push edi
call fcn.00407749
test eax, eax
je 0x4025fc
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402632
mov word [esi], 0
jmp 0x402fd8
mov esi, edx
push dword [esp + 0x1c]
push 0x4170f8
call fcn.004072ff
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x402ca0
push eax
push edi
call fcn.00407730
lea eax, [esp + 0x64]
push eax
push esi
call fcn.00406c2f
jmp 0x403025
push 0xfffffffffffffff0
call fcn.004031d6
mov esi, eax
push eax
call fcn.00406d3b
test eax, eax
jne 0x40265c
push 0xffffffffffffffed
call fcn.004031d6
push esi
call fcn.0040693b
push 2
push 0x40000000
push esi
call fcn.00406f62
cmp eax, 0xffffffff
je 0x40274d
mov edi, eax
mov ebp, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0
je 0x40272e
mov eax, dword [0x40a168]
mov eax, dword [eax]
mov dword [esp], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x40272e
mov ebx, eax
push 0
call fcn.004037bc
push dword [esp]
push ebx
call fcn.004037a6
push dword [esp + 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test eax, eax
mov eax, dword [esp]
je 0x40271c
mov dword [esp + 0xc], edi
push dword [esp + 0x1c]
push ebp
push 0
push dword [esp + 0x24]
call fcn.004037d3
mov dword [esp + 4], ebp
cmp byte [ebp], 0
je 0x40270b
mov ebp, dword [esp + 4]
mov edi, dword [ebp]
lea eax, [ebp + 8]
mov ecx, dword [ebp + 4]
add ecx, ebx
push edi
push eax
push ecx
call fcn.00406f3e
add ebp, edi
add ebp, 8
cmp byte [ebp], 0
jne 0x4026ed
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [esp + 0xc]
mov eax, dword [esp]
push eax
push ebx
push edi
call fcn.00407034
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor ebp, ebp
dec ebp
mov ebx, edi
xor edi, edi
push edi
push edi
push ebx
push ebp
call fcn.004037d3
mov ebp, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffff3
test ebp, ebp
jns 0x40275c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
inc edi
mov eax, 0xffffffef
mov dword [esp], edi
jmp 0x402e3c
mov ebx, edi
xor ecx, ecx
call fcn.004031b9
mov esi, eax
mov eax, dword [0x40a00c]
cmp dword [eax + 0xc], esi
jbe 0x402fd8
mov eax, dword [eax + 8]
imul ecx, esi, 0x818
lea edi, [eax + ecx]
mov edx, dword [esp + 0x1c]
test edx, edx
js 0x402ed5
je 0x40300b
push dword [edi + edx*4]
jmp 0x402d54
xor ecx, ecx
call fcn.004031b9
cmp eax, 0x1f
ja 0x402fd8
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x1c]
je 0x402ef5
test ecx, ecx
je 0x403017
push eax
call fcn.00401304
xor eax, eax
push eax
push eax
call fcn.00401248
jmp 0x403025
mov ebx, edi
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x402d18
mov dword [esp], 0
test eax, eax
jne case.0x40153d.66
push 5
call fcn.0040679c
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 8]
push 0x4180f8
call fcn.004072ff
test esi, esi
je 0x402938
lea edi, [esp + 0x38]
push edi
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x402938
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x28]
push edi
call esi
test eax, eax
js 0x402938
push dword [esp + 8]
push ebx
call fcn.00406c2f
push dword [esp + 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x403025
mov eax, dword [0x40a188]
and esi, dword [eax]
push 0
push esi
push 0xb
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x14], 0
mov dword [esp], 0
je case.0x40153d.66
xor eax, eax
push eax
push eax
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x403025
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4170f8
call fcn.004072ff
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 8]
push 0x4178f8
call fcn.004072ff
xor ebx, ebx
cmp word [esi], 0
cmove esi, ebx
cmp word [eax], 0
cmove eax, ebx
push eax
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x38], eax
jmp 0x40295e
push 0xffffffffffffffe8
push 0
call fcn.004072ff
push 0x200010
push eax
call fcn.00406878
mov esi, 0x7fffffff
jmp case.0x40153d.2
cmp eax, 0x38
jne 0x402cad
mov esi, 0x4180f8
push ebx
push esi
call fcn.004072ff
mov edi, 0x4178f8
push 0x400
push edi
push esi
call fcn.004077fb
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
jmp 0x402cc2
mov word [ebx], 0
jmp 0x402fd8
sar ecx, 2
lea edx, [esp + 0x38]
push edx
push ecx
push 0
push edi
push ebp
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ebx, ebx
test eax, eax
sete bl
cmp dword [esp + 0x14], 0
mov ebp, dword [esp + 0xc]
js 0x402d6f
push dword [esp + 0x38]
push ebp
call fcn.00407730
jmp 0x402d6f
mov ecx, 2
call fcn.004031b9
mov esi, eax
mov ebp, dword [esp + 0x20]
mov ebx, ebp
and ebx, 3
bt ebp, 0x10
jb 0x40299e
movzx eax, word [esp + 0x18]
jmp 0x4029b0
mov eax, dword [0x419938]
push dword [eax + 4]
push 0x4178f8
call fcn.004072ff
mov dword [esp], eax
lea edi, [esp + 0x38]
push edi
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, ebp
shl eax, 0x1d
sar eax, 0x1f
mov ecx, dword [0x40a16c]
and eax, dword [ecx]
mov ecx, ebp
sar ecx, 0x1f
and ecx, dword [edi + 8]
add ebp, ebp
sar ebp, 0x1f
and ebp, dword [edi + 0xc]
mov edx, 0xfef0
and edx, dword [esp + 0x20]
push edx
push ebp
push ecx
push ebx
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
push eax
push ebx
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x402a16
test ebx, ebx
jne 0x402a16
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x14], 0
js 0x403025
push edi
push dword [esp + 0x10]
jmp 0x403020
mov word [edi], 0
xor ebx, ebx
inc ebx
cmp dword [esp + 0x1c], 0
jne 0x402d6f
push 0x400
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x402d6f
push 0x4178f8
push 0xfffffffffffffff5
call fcn.00406324
mov dword [esp], ebp
jmp case.0x40153d.66
jne 0x402a74
mov eax, dword [esi*4 + 0x4170b8]
mov dword [esi*4 + 0x4198fc], eax
xor ecx, ecx
inc ecx
call fcn.004031b9
mov ecx, dword [esp + 0x14]
mov dword [ecx*4 + 0x4170b8], eax
jmp 0x403025
xor ebx, ebx
inc ebx
cmp dword [esp + 0x1c], 0
mov dword [esp], ebx
je case.0x40153d.66
push esi
call fcn.00406cb1
test eax, eax
je case.0x40153d.66
push edi
push esi
call fcn.00406c82
push 0x4178f8
push 0xffffffffffffffe4
jmp 0x4019cb
lea eax, [ebp + 0xb000]
push eax
push 0x4170f8
call fcn.00406c2f
push eax
call fcn.00406cd9
push edi
push eax
call sub.KERNEL32.dll_lstrcatW
and esi, 7
push 0x4170f8
call fcn.00406de1
mov ebx, 0x4178f8
cmp esi, 3
jb 0x402b29
push 0x4170f8
call fcn.00406cb1
test eax, eax
je 0x402b12
add eax, 0x14
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x402b14
xor eax, eax
add esi, 0x7ffffffd
or esi, 0x80000000
xor ecx, ecx
test eax, esi
sete cl
mov esi, ecx
test esi, esi
jne 0x402b37
push 0x4170f8
call fcn.0040693b
xor eax, eax
cmp esi, 1
sete al
mov ecx, 2
sub ecx, eax
push ecx
push 0x40000000
push 0x4170f8
call fcn.00406f62
cmp eax, 0xffffffff
jne 0x402d77
test esi, esi
jne 0x402df8
push ebp
mov esi, 0x4180f8
push esi
call fcn.00406c2f
push 0x4170f8
push ebp
call fcn.00406c2f
push dword [esp + 0x28]
push ebx
call fcn.004072ff
push esi
push ebp
call fcn.00406c2f
mov eax, dword [esp + 0x14]
sar eax, 3
xor esi, esi
push eax
push ebx
call fcn.00406878
cmp eax, 4
je 0x402aee
cmp eax, 5
jne 0x402e10
inc dword [0x4170c0]
jmp 0x403035
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x402bd5
jmp 0x402f20
cmp esi, eax
jge 0x402f15
mov esi, dword [esp + 0x20]
jmp case.0x40153d.2
test ebx, ebx
je 0x402fe0
test esi, esi
je 0x402fd8
lea eax, [esi + 4]
push eax
push edx
call fcn.00406c2f
mov eax, dword [esi]
mov dword [0x41993c], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403025
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403025
xor eax, eax
mov word [edi], ax
mov word [ebx], ax
jmp 0x402fd8
push 0x4178f8
push 0xffffffffffffffe7
jmp 0x402fd3
xor esi, esi
inc esi
mov eax, 0xfffffff0
jmp 0x402e39
xor esi, esi
push 0xffffffffffffffcd
call fcn.004031d6
push eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp], ecx
jmp case.0x40153d.66
push 2
call fcn.00403216
test eax, eax
je 0x402fd8
mov esi, eax
mov eax, dword [0x419938]
push dword [eax + 0xc]
push 0x4188f8
call fcn.004072ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
setne al
jmp 0x402fdb
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x402fd8
push ebx
push 0x4178f8
call fcn.004072ff
push eax
call sub.KERNEL32.dll_lstrlenW
mov esi, eax
add esi, eax
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xc]
cmp word [eax], 0
je 0x402c58
xor ebx, ebx
mov cl, byte [esp]
mov bl, cl
push eax
call fcn.00407749
mov edi, eax
or ebp, ebx
jne 0x402cf8
cmp dword [esp + 0x20], 0
je 0x402cf8
push edi
push edi
call fcn.00407066
test eax, eax
js 0x402fd8
push esi
push 0x4178f8
push edi
call fcn.00407034
mov dword [esp], 0
test eax, eax
jne case.0x40153d.66
jmp 0x402fd8
mov ecx, 2
call fcn.004031b9
mov esi, eax
mov ecx, 4
call fcn.004031b9
lea edi, [esp + 0x38]
mov dword [edi], 0
movzx ecx, al
shr eax, 0x18
test esi, esi
mov edx, 0x4170b8
cmovne edx, esi
add edx, eax
push ecx
push edx
push edi
call fcn.00406f3e
push dword [edi]
push ebx
jmp 0x403020
xor ebx, ebx
push dword [esp + 0x70]
call fcn.0040790c
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], ebx
jmp case.0x40153d.66
mov edi, eax
push dword [esp + 4]
push 0xffffffffffffffea
call fcn.00406324
inc dword [0x4170ec]
xor eax, eax
push eax
push eax
push edi
push dword [esp + 0x28]
call fcn.004037d3
dec dword [0x4170ec]
mov ebp, eax
cmp dword [esp + 0x20], 0xffffffff
jne 0x402dae
cmp dword [esp + 0x24], 0xffffffff
je 0x402dbd
lea eax, [esp + 0x20]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
test ebp, ebp
jns case.0x40153d.66
cmp ebp, 0xfffffffe
jne 0x403159
mov esi, 0x4170f8
push 0xffffffffffffffe9
push esi
call fcn.004072ff
push dword [esp + 4]
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x403165
push dword [esp + 4]
push 0xffffffffffffffe2
call fcn.00406324
xor eax, eax
cmp esi, 2
sete al
jmp 0x402fdb
push 0x4170f8
push 0xfffffffffffffffa
jmp 0x4017a6
mov esi, eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
not eax
shr eax, 0x1f
lea eax, [eax*4 - 0x10]
shr esi, 0x1f
mov dword [esp], esi
push 0x4178f8
push eax
call fcn.00406324
jmp case.0x40153d.66
mov eax, dword [esp + 8]
lea ecx, [eax - 1]
cmp ecx, 2
jae 0x403046
mov ebx, dword [esp + 0x24]
mov word [edi + 0x7fe], 0
jmp 0x403064
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea ecx, [esp + 0x58]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp], ecx
mov word [edi + 0x7fe], 0
jmp 0x403067
movzx eax, word [esp + 8]
cmp cx, ax
je 0x402f95
movzx ecx, ax
cmp ecx, 0xa
je 0x402ecb
cmp ecx, 0xd
jne 0x402f95
mov word [ebx + ebp*2], ax
inc ebp
jmp 0x402fa6
cmp edx, 0xffffffff
not edx
mov dword [esp + 0x1c], edx
je 0x4030a8
xor ecx, ecx
inc ecx
call fcn.004031b9
mov dword [esp + 0x18], eax
jmp 0x4030c0
test ecx, ecx
je 0x4030dd
mov ecx, dword [esp + 0x18]
mov edx, dword [0x40a004]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x94], ecx
jmp 0x403025
jle 0x402f20
mov esi, dword [esp + 0x24]
jmp case.0x40153d.2
mov esi, dword [esp + 0x1c]
jmp case.0x40153d.2
movzx eax, word [esp + 8]
push eax
push ebx
call fcn.00407730
jmp 0x403035
push edi
push 0xfffffffffffffff7
call fcn.00406324
xor ebx, ebx
inc ebx
jmp 0x40308b
mov ecx, 3
call fcn.004031b9
mov dword [0x4180f8], eax
mov eax, 4
jmp 0x402f75
push 0x1800
push 0x4180f8
push 0
push dword [esp + 0x2c]
call fcn.004037d3
push eax
push 0x4180f8
push ebx
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp], ecx
jmp 0x403067
neg edi
push 1
push 0
push edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [ebx + ebp*2], 0
mov dword [esp], 0
test ebp, ebp
jne case.0x40153d.66
jmp 0x402fd8
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40153d.66
push 0x4178f8
push 0xfffffffffffffff6
call fcn.00406324
xor eax, eax
inc eax
mov dword [esp], eax
jmp case.0x40153d.66
push 0x804
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
add eax, 4
push dword [esp + 0x14]
push eax
call fcn.004072ff
mov eax, dword [0x41993c]
mov dword [esi], eax
mov dword [0x41993c], esi
jmp 0x403025
add eax, ecx
add eax, 0x18
push eax
push ebx
jmp 0x402638
push 0
call fcn.00401351
push eax
push edi
call fcn.00407730
mov dword [esp], 0
mov eax, dword [esp]
add dword [0x4170c0], eax
xor esi, esi
mov eax, esi
add esp, 0x288
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp eax, 4
mov ebp, edi
jne 0x4024d0
xor ebx, ebx
cmp dword [esp + 0x24], 0
sete bl
push dword [ebp]
push ebp
call fcn.00407730
mov dword [esp], ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40153d.66
push section..data
push 0x41993c
push ebp
push 0x400
push dword [esp + 0x14]
call ebx
add esp, 0x14
xor ebx, ebx
cmp dword [esp + 0x20], 0
mov dword [esp], ebx
jne case.0x40153d.66
push esi
call fcn.0040418f
test eax, eax
je case.0x40153d.66
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x40153d.66
lea ebx, [eax + ecx]
add ebx, 0x18
push dword [esp + 0x24]
push ebx
call fcn.004072ff
or byte [ebx - 0xf], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [edi + ecx*4], eax
cmp dword [esp + 0x20], 0
je 0x403025
push esi
call fcn.004011dc
jmp 0x403025
mov ecx, dword [0x40a004]
mov ecx, dword [ecx]
push dword [ecx + eax*4 + 0x94]
push edi
call fcn.004072ff
jmp 0x403025
sub esi, ecx
jmp case.default.0x401cb7
imul esi, ecx
jmp case.default.0x401cb7
test ecx, ecx
je 0x403174
mov eax, esi
cdq
idiv ecx
xor ebp, ebp
jmp 0x403129
or esi, ecx
jmp case.default.0x401cb7
and esi, ecx
jmp case.default.0x401cb7
xor esi, ecx
jmp case.default.0x401cb7
xor eax, eax
test esi, esi
sete al
jmp 0x403129
xor eax, eax
or esi, ecx
setne al
mov esi, eax
jmp case.default.0x401cb7
test esi, esi
setne al
test ecx, ecx
setne cl
and cl, al
movzx esi, cl
jmp case.default.0x401cb7
test ecx, ecx
je 0x403174
mov eax, esi
cdq
idiv ecx
xor ebp, ebp
mov esi, edx
jmp case.default.0x401cb7
shl esi, cl
jmp case.default.0x401cb7
sar esi, cl
jmp case.default.0x401cb7
shr esi, cl
jmp case.default.0x401cb7
push 0xffffffffffffffee
push 0x4170f8
call fcn.004072ff
push 0x200010
push 0x4170f8
jmp 0x4028f2
xor esi, esi
mov ebp, edi
mov dword [esp], ebp
push esi
push ebx
call fcn.00407730
jmp case.0x40153d.66
xor ebp, ebp
jmp 0x402fa6