Function at 0x4014c2
Capabilities:
Copy file
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x298
mov eax, dword [0x40a008]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
push 0x1c
push dword [esp + 0x2b0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x14]
mov esi, dword [eax - 4]
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
mov dword [0x42c12c], eax
lea eax, [esi - 2]
cmp eax, 0x44
mov dword [esp], 0
ja case.0x40152e.67
mov ecx, dword [0x40ae14]
mov ecx, dword [ecx]
mov edx, ebp
shl edx, 0xe
add edx, ecx
mov edi, ebx
shl edi, 0xe
add edi, ecx
mov dword [esp], 0
jmp dword [eax*4 + 0x40a010]
mov dword [esp + 8], edx
mov ecx, 3
call fcn.0040376c
mov edi, eax
mov ecx, 4
call fcn.0040376c
mov esi, eax
mov eax, dword [esp + 0x28]
test al, 1
je 0x401571
mov eax, dword [0x42c12c]
push dword [eax + 0xc]
push 0x4240ec
call fcn.00407938
mov edi, eax
mov eax, dword [esp + 0x28]
test al, 2
je 0x401589
mov eax, dword [0x42c12c]
push dword [eax + 0x10]
push 0x4280ec
call fcn.00407938
mov esi, eax
cmp dword [esp + 0x10], 0x21
jne 0x401790
xor ecx, ecx
inc ecx
call fcn.0040376c
mov ebp, eax
mov ecx, 2
call fcn.0040376c
mov ecx, dword [esp + 0x28]
cmp ecx, 4
jae 0x402c37
push esi
push edi
push eax
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x48], eax
xor ebx, ebx
jmp 0x402c53
mov ebp, dword [esp + 0x1c]
cmp esi, 0x38
sete byte [esp]
test ebp, ebp
mov dword [esp + 8], edx
je 0x402bf6
xor ecx, ecx
inc ecx
call fcn.0040376c
xor ecx, ecx
cmp esi, 0x38
mov word [0x41c0ec], ax
setne cl
inc ecx
jmp 0x402d61
mov ecx, 2
mov esi, edx
call fcn.0040376c
mov dword [esp + 4], eax
test eax, eax
mov dword [esp], 0
jle case.0x40152e.67
mov ecx, esi
mov eax, 0x1fff
cmp dword [esp + 4], eax
jl 0x401631
mov dword [esp + 4], 0x1fff
cmp word [ecx], 0
mov ebx, edi
je 0x402c2d
mov ebp, 2
push ecx
call fcn.00407d77
mov dword [esp], eax
xor esi, esi
xor edi, edi
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x10], 0x39
jne 0x40171a
mov eax, 2
sub eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x4c]
push ecx
push eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40344a
mov ebp, dword [esp + 0x48]
test ebp, ebp
je 0x40344a
movzx eax, byte [esp + 0x34]
mov word [esp + 0xc], ax
cmp dword [esp + 0x20], 0
jne 0x403360
mov dword [esp + 0x30], edi
mov dword [esp + 8], esi
push 1
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x40]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40170c
xor esi, esi
inc esi
sub esi, ebp
mov word [esp + 0xc], 0xfffd
dec dword [esp + 0x48]
je 0x40170c
dec ebp
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
lea eax, [esp + 0x40]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc esi
test eax, eax
je 0x4016cf
mov esi, dword [esp + 8]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
jmp 0x40174d
mov eax, dword [esp + 0x20]
or eax, esi
jne 0x401735
push 0
push dword [esp + 4]
call fcn.004076b8
test eax, eax
js 0x4036f6
push 2
lea eax, [esp + 0x10]
push eax
push dword [esp + 8]
call fcn.00407654
test eax, eax
je 0x40344a
cmp dword [esp + 0x20], 0
jne 0x403360
cmp di, 0xd
je 0x4032e8
movzx eax, di
cmp eax, 0xa
je 0x4032e8
movzx edi, word [esp + 0xc]
mov word [ebx + esi*2], di
inc esi
test di, di
je 0x40344a
cmp esi, dword [esp + 4]
jl 0x401653
jmp 0x40344a
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x4180ec
call fcn.00407938
mov ebp, eax
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x41c0ec
call fcn.00407938
xor ebx, ebx
cmp word [ebp], 0
mov ecx, 0
je 0x4017c6
mov ecx, ebp
cmp word [eax], 0
mov edx, 0
je 0x4017d3
mov edx, eax
push edx
push ecx
push esi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x48], eax
jmp 0x402c53
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x40315b
test eax, eax
mov dword [esp], 0
jne case.0x40152e.67
push 5
call fcn.00406d65
mov esi, eax
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x4200ec
call fcn.00407938
test esi, esi
mov ebx, edi
je 0x402c2d
lea edi, [esp + 0x48]
push edi
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x402c2d
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x28]
push edi
call esi
test eax, eax
js 0x402c2d
push dword [esp + 0xc]
push ebx
call fcn.00407239
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x40353d
push 0x20019
mov esi, edx
call fcn.00403789
mov edi, eax
mov eax, dword [0x42c12c]
push dword [eax + 0xc]
push 0x4240ec
call fcn.00407938
mov word [esi], 0
test edi, edi
je 0x4034c9
mov ebx, esi
lea ecx, [esp + 0x48]
mov dword [ecx], 0x4000
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40327a
mov word [ebx], 0
xor ebp, ebp
inc ebp
jmp 0x40351b
mov esi, edx
push 0xffffffffffffffed
call fcn.00403728
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call fcn.004075ae
cmp eax, 0xffffffff
jne 0x401ec4
jmp 0x4029a2
mov dword [esp + 0x2c], edi
push ebp
push 0x4180ec
call fcn.00407938
mov edi, eax
push eax
push str.Exec:_command__s_
call fcn.0040728c
add esp, 8
push edi
push 0xffffffffffffffeb
call fcn.004068cc
push edi
call fcn.00406d9e
test eax, eax
je 0x402dc1
mov esi, eax
push edi
push str.Exec:_success____s__
call fcn.0040728c
add esp, 8
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x403468
push esi
call fcn.004081a0
cmp dword [esp + 0x18], 0
js 0x403461
push eax
push dword [esp + 0x30]
call fcn.00407d5e
jmp 0x403468
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp], eax
push dword [esp + 0x1c]
push 0x4180ec
call fcn.00407938
mov dword [esp + 4], eax
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x41c0ec
call fcn.00407938
mov ebx, eax
push ebp
call fcn.00407efe
add esp, 4
mov edi, eax
push ebx
push ebp
call fcn.00403832
test eax, eax
je 0x402dcc
mov ebp, eax
mov dword [esp + 8], edi
cmp esi, 4
mov dword [esp + 0x2c], ebx
je 0x403407
cmp esi, 3
je 0x403390
mov edi, dword [esp + 4]
xor ebx, ebx
cmp esi, 1
mov esi, dword [esp + 8]
jne 0x4035bf
mov eax, dword [0x42c12c]
mov esi, 0x4200ec
push dword [eax + 0xc]
push esi
call fcn.00407938
push esi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [eax + eax + 2]
cmp dword [esp], 1
jne 0x4035a3
push 0x4200ec
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegStr:___s_s____s___s_
jmp 0x4035b7
mov dword [esp], ecx
push ebp
push 0x4180ec
call fcn.00407938
mov edi, eax
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x4240ec
call fcn.00407938
mov ebx, eax
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x4200ec
call fcn.00407938
mov ebp, eax
mov eax, dword [0x42c12c]
mov esi, 0x41c0ec
push dword [eax + 0x14]
push esi
call fcn.00407938
push esi
push 0xffffffffffffffec
call fcn.004068cc
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x64], eax
xor eax, eax
cmp word [edi], 0
mov ecx, 0
je 0x401a94
mov ecx, edi
mov dword [esp + 0x54], ecx
mov esi, ebx
mov dword [esp + 0x58], ebx
cmp word [ebp], 0
je 0x401aa7
mov eax, ebp
lea ecx, [esp + 0x48]
mov dword [ecx + 0x14], eax
mov ebx, dword [esp]
add ebx, 0x58000
mov dword [ecx + 0x18], ebx
push ecx
call fcn.00406de6
test eax, eax
je 0x402de0
test byte [esp + 0x4c], 0x40
je 0x401ae8
push dword [esp + 0x80]
call fcn.004081a0
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push esi
push edi
push str.ExecShell:_success____s_:_file:__s__params:__s__
call fcn.0040728c
add esp, 0x10
jmp 0x40353d
mov ebp, dword [esp + 4]
push ebp
mov ebx, edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov ecx, 2
call fcn.0040376c
mov esi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x48
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x42c134], eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 3
call fcn.0040376c
mov dword [0x42c144], eax
mov al, byte [esp + 0x24]
mov ecx, eax
and cl, 1
mov byte [0x42c148], cl
mov ecx, eax
and cl, 2
mov byte [0x42c149], cl
and al, 4
mov byte [0x42c14a], al
mov byte [0x42c14b], 1
push dword [esp + 0x18]
push 0x42c150
call fcn.00407938
push 0x42c134
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push ebx
jmp 0x403538
push ebp
push 0x4180ec
call fcn.00407938
mov edi, eax
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x41c0ec
call fcn.00407938
mov esi, eax
mov eax, dword [0x42c12c]
push dword [eax + 0xc]
push 0x4200ec
call fcn.00407938
mov ebx, eax
push esi
push edi
push str.CopyFiles___s_____s_
call fcn.0040728c
add esp, 0xc
push edi
call fcn.004072fa
test eax, eax
je 0x401c38
lea ebp, [esp + 0x48]
mov eax, dword [esp + 4]
mov dword [ebp], eax
mov dword [ebp + 4], 2
push edi
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
push esi
call sub.KERNEL32.dll_lstrlenW
mov ecx, ebx
xor ebx, ebx
xor edx, edx
mov word [esi + eax*2 + 2], dx
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x1a], ecx
movzx eax, word [esp + 0x1c]
mov word [ebp + 0x10], ax
push ecx
push 0
call fcn.004068cc
push ebp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4030b5
push 0
push 0xfffffffffffffff9
call fcn.004068cc
xor ebx, ebx
inc ebx
jmp 0x4030b5
mov ebx, edi
xor ecx, ecx
call fcn.0040376c
mov esi, eax
mov eax, dword [0x40a00c]
cmp dword [eax + 0xc], esi
jbe 0x4034c9
mov eax, dword [eax + 8]
imul ecx, esi, 0x4018
lea edi, [eax + ecx]
mov edx, dword [esp + 0x1c]
test edx, edx
js 0x403311
je 0x403524
push dword [edi + edx*4]
jmp 0x401b8b
mov dword [esp], ecx
push ebx
push 0x4240ec
call fcn.00407938
mov edi, eax
mov eax, dword [esp + 0x14]
mov ebp, eax
and ebp, 7
shr eax, 3
and eax, 2
push edi
push eax
push ebp
push str.File:_overwriteflag_d__allowskipfilesflag_d__name__s_
call fcn.0040728c
add esp, 0x10
push edi
call fcn.00407384
test eax, eax
mov dword [esp + 4], edi
je 0x402dfc
push edi
push 0x4180ec
call fcn.00407239
jmp 0x402e1c
xor ecx, ecx
inc ecx
mov esi, edx
call fcn.0040376c
mov edi, eax
mov ecx, 2
call fcn.0040376c
push eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401ec4
push 0xfffffffffffffff0
call fcn.00403728
mov edi, eax
push eax
push str.RMDir:___s_
jmp 0x401f04
push dword [ebx*4 + 0x4180ac]
push edx
jmp 0x403538
push ebx
push 0x4180ec
mov esi, edx
call fcn.00407938
mov edi, eax
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
test eax, eax
je 0x401d56
xor ebx, ebx
cmp dword [esp + 0x1c], 0
je 0x401d5e
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, esi
test eax, eax
jne 0x401d5e
mov word [ecx], 0
xor ebx, ebx
inc ebx
mov dword [esp], ebx
mov word [ecx + 0x3ffe], 0
jmp case.0x40152e.67
mov ecx, 2
mov dword [esp + 8], edx
call fcn.0040376c
mov dword [esp], eax
mov ebp, edx
mov ecx, 3
call fcn.0040376c
mov edi, eax
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x4180ec
call fcn.00407938
mov ebx, eax
push eax
call sub.KERNEL32.dll_lstrlenW
mov edx, dword [esp + 8]
mov word [edx], 0
test ebp, ebp
mov esi, eax
je 0x401dba
mov esi, dword [esp]
test esi, esi
mov dword [esp], 0
je case.0x40152e.67
mov ecx, edi
sar ecx, 0x1f
and ecx, eax
add ecx, edi
mov dword [esp], 0
js case.0x40152e.67
cmp ecx, eax
jl 0x401de5
mov ecx, eax
lea eax, [ebx + ecx*2]
push eax
push edx
mov edi, edx
call fcn.00407239
test esi, esi
jns 0x401dfd
push edi
call sub.KERNEL32.dll_lstrlenW
add esi, eax
cmp esi, 0x1fff
mov dword [esp], 0
mov eax, dword [esp + 8]
jg case.0x40152e.67
test esi, esi
jg 0x401e1a
xor esi, esi
mov word [eax + esi*2], 0
jmp 0x40353d
mov ebx, edi
mov edi, edx
push dword [esp + 0x1c]
push 0x4180ec
call fcn.00407938
push eax
call fcn.004072fa
test eax, eax
je 0x402f20
mov esi, eax
push dword [eax + 0x14]
push ebx
call fcn.00407d5e
push dword [esi + 0x18]
jmp 0x403537
push ebp
push 0x4180ec
call fcn.00407938
mov esi, eax
push eax
call fcn.004072fa
test eax, eax
je 0x402f2d
push dword [esp + 0x18]
push esi
push str.IfFileExists:_file___s__exists__jumping__d
call fcn.0040728c
add esp, 0xc
jmp 0x4028da
push ebx
push 0x4180ec
mov esi, edx
call fcn.00407938
mov edi, eax
mov ecx, 2
call fcn.0040376c
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x402f9b
push ebx
push 0x4180ec
mov esi, edx
call fcn.00407938
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
push esi
jmp 0x403538
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x4180ac]
xor edx, edx
test ecx, ecx
sete dl
mov esi, dword [esp + edx*4 + 0x14]
and ecx, dword [esp + 0x20]
mov dword [eax*4 + 0x4180ac], ecx
jmp 0x40354f
push ebp
push 0x4180ec
call fcn.00407938
mov edi, eax
push eax
push str.Delete:___s_
call fcn.0040728c
add esp, 8
push dword [esp + 0x18]
push edi
call fcn.00406f0b
jmp 0x40353d
push 0xffffffffffffffee
mov dword [esp + 0xc], edx
call fcn.00403728
mov esi, eax
push 0xa
call fcn.00406d65
lea ecx, [esp + 0x48]
push ecx
push esi
call eax
mov ebp, eax
xor eax, eax
mov ecx, dword [esp + 8]
mov word [ecx], ax
mov dword [esp + 0x2c], edi
mov word [edi], ax
xor ebx, ebx
inc ebx
test ebp, ebp
je 0x4030b5
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4030b5
mov edi, eax
push 0xb
call fcn.00406d65
mov ebx, eax
push 0xc
call fcn.00406d65
mov dword [esp], eax
push edi
push ebp
push 0
push esi
call ebx
xor ebx, ebx
inc ebx
test eax, eax
je 0x401fcc
lea eax, [esp + 0x34]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x40a90c
push edi
call dword [esp + 0x10]
test eax, eax
je 0x401fcc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 8]
push dword [esp + 0xc]
call fcn.00407d5e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 0xc]
push dword [esp + 0x30]
call fcn.00407d5e
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4030b5
mov eax, dword [0x40ae10]
inc dword [eax]
mov esi, 0x7fffffff
cmp dword [esp + 4], 0
je 0x40354f
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40354f
mov esi, dword [0x42c130]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402f41
test esi, esi
je 0x402d20
lea ecx, [eax - 1]
mov esi, dword [esi]
add ecx, 0xffffffff
jae 0x402024
test esi, esi
jne 0x402019
test esi, esi
je 0x402d20
add esi, 4
mov edi, 0x4180ec
push esi
push edi
call fcn.00407239
mov eax, dword [0x42c130]
add eax, 4
push eax
push esi
call fcn.00407239
mov eax, dword [0x42c130]
add eax, 4
push edi
push eax
jmp 0x402b7e
xor ecx, ecx
call fcn.0040376c
mov edi, eax
push eax
push str.Sleep__d_
call fcn.0040728c
add esp, 8
cmp edi, 2
jge 0x402078
xor edi, edi
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40353d
cmp dword [esp + 0x1c], 0
je 0x402f6e
mov eax, dword [ebp*4 + 0x42c0f0]
mov dword [ebp*4 + 0x4180ac], eax
jmp 0x40353d
push ebp
push 0x4200ec
call fcn.00407938
mov esi, eax
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x4240ec
call fcn.00407938
cmp dword [esp + 0x24], 0
je 0x402fa3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x402fab
cmp ebp, 0xbadf00d
jne 0x402d2e
inc dword [0x4180c0]
jmp 0x40353d
push ebp
push 0x40a15c
call fcn.0040728c
add esp, 8
mov esi, dword [esp + 0x14]
jmp 0x40354f
xor ecx, ecx
call fcn.0040376c
mov edi, eax
xor ecx, ecx
inc ecx
call fcn.0040376c
mov ebx, eax
cmp dword [esp + 0x1c], 0
je 0x40212e
push str.HideWindow
call fcn.0040728c
add esp, 4
cmp dword [esp + 0x20], 0
je 0x402fbc
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40353d
push ebx
call fcn.00407efe
add esp, 4
mov esi, eax
cmp dword [esp + 0x24], 0
je 0x402fc9
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x4200ec
call fcn.00407938
mov edi, eax
push eax
push esi
push str.DeleteRegKey:___s_s_
call fcn.0040728c
add esp, 0xc
mov eax, dword [esp + 0x24]
sar eax, 1
push eax
push edi
push ebx
call fcn.004037d8
mov ebp, eax
jmp 0x403013
push ebp
push 0x4180ec
call fcn.00407938
push eax
push str.Aborting:___s_
call fcn.0040728c
add esp, 8
push 0
push dword [esp + 0x18]
call fcn.004068cc
jmp 0x402d42
push str.BringToFront
call fcn.0040728c
add esp, 4
push dword [esp + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x40353d
mov eax, dword [0x40ae1c]
mov eax, dword [eax]
test eax, eax
je 0x4021ec
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x40ae18]
mov eax, dword [eax]
test eax, eax
mov dword [esp], 0
je case.0x40152e.67
push dword [esp + 0x14]
push eax
jmp 0x402fbe
mov esi, 0x41c0ec
push str._RM_
push esi
call fcn.00407239
push esi
push 0x4200ec
call fcn.00407239
xor ebx, ebx
cmp dword [esp + 0x14], 0
mov esi, 0
je 0x402248
mov eax, dword [0x42c12c]
push dword [eax]
push 0x4180ec
call fcn.00407938
mov esi, eax
cmp dword [esp + 0x18], 0
je 0x402263
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x41c0ec
call fcn.00407938
mov ebx, eax
cmp dword [esp + 0x24], 0
je 0x40301f
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x4200ec
call fcn.00407938
mov ebp, eax
jmp 0x403021
push 0xffffffffffffffd0
call fcn.00403728
mov edi, eax
push 0xffffffffffffffdf
call fcn.00403728
mov ebp, eax
mov eax, dword [0x42c12c]
push dword [eax + 0xc]
push 0x41c0ec
call fcn.00407938
mov ebx, eax
push eax
push str.Rename:__s
call fcn.0040728c
add esp, 8
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x403060
push 0x41c0ec
push 0xffffffffffffffe3
jmp 0x40238a
push ebp
push 0x4180ec
call fcn.00407938
mov esi, eax
lea eax, [esp + 0x48]
push eax
push edi
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
mov eax, edi
je 0x403097
mov edi, eax
mov eax, dword [esp + 0x48]
xor ebx, ebx
cmp eax, esi
jbe 0x4030a1
cmp word [eax], 0
je 0x4030a1
push esi
call fcn.004072fa
test eax, eax
je 0x403600
add eax, 0x2c
push eax
push dword [esp + 0x4c]
call fcn.00407239
jmp 0x4030a1
test ebp, ebp
jns 0x40234d
not ebp
shl ebp, 0xe
add ecx, ebp
push ecx
call fcn.00407d77
mov ebp, eax
dec ebp
push ebp
push str.Call:__d
call fcn.0040728c
add esp, 8
push 0
push ebp
call fcn.004013e0
mov esi, eax
jmp 0x40354f
push ebp
push 0x4180ec
call fcn.00407938
push eax
push str.DetailPrint:__s
call fcn.0040728c
add esp, 8
push 0
push dword [esp + 0x18]
call fcn.004068cc
jmp 0x40353d
mov eax, dword [0x40a00c]
add ebx, dword [eax + 0x28]
mov dword [esp], 0
xor ecx, ecx
call fcn.0040376c
push ebx
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40152e.67
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403728
mov edi, eax
push dword [esp + 0x18]
push eax
push str.CreateDirectory:___s____d_
call fcn.0040728c
add esp, 0xc
push edi
call fcn.004073b5
xor esi, esi
test eax, eax
je 0x402473
push 0x5c
push eax
call fcn.00407351
mov ebx, eax
movzx ebp, word [eax]
mov word [eax], 0
test bp, bp
jne 0x402416
cmp dword [esp + 0x1c], 0
je 0x402416
call fcn.00406d4b
test eax, eax
je 0x402416
push edi
call fcn.00406cb0
jmp 0x40241c
push edi
call fcn.00406d2d
test eax, eax
je 0x402442
cmp eax, 0xb7
jne 0x402452
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x402462
push edi
push str.CreateDirectory:_cant_create___s____a_file_already_exists
call fcn.0040728c
add esp, 8
jmp 0x402461
push edi
push str.CreateDirectory:___s__created
call fcn.0040728c
add esp, 8
jmp 0x402462
push eax
push edi
push str.CreateDirectory:_cant_create___s___err_d_
call fcn.0040728c
add esp, 0xc
inc esi
mov eax, ebx
add eax, 2
test bp, bp
mov word [ebx], bp
jne 0x4023e7
cmp dword [esp + 0x18], 0
je 0x4030bd
push 0x41c0ec
push 0xffffffffffffffe6
call fcn.004068cc
mov eax, dword [esp]
add eax, 0x58000
push edi
push eax
call fcn.00407239
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4030c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.SetCurrentDirectory__s__failed___d_
call fcn.0040728c
add esp, 0xc
inc esi
jmp 0x4030c9
push 0xfffffffffffffff0
call fcn.00403728
mov edi, eax
push dword [esp + 0x18]
push eax
push str.SetFileAttributes:___s_:_08X
call fcn.0040728c
add esp, 0xc
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
mov dword [esp], 0
jne case.0x40152e.67
push str.SetFileAttributes_failed.
jmp 0x4030e2
push 0xffffffffffffffef
mov esi, edx
call fcn.00403728
push eax
push esi
call fcn.004075e6
jmp 0x403051
push 0xffffffffffffffff
mov esi, edx
call fcn.00403728
lea ecx, [esp + 0x48]
xor edi, edi
push ecx
push esi
push 0x2000
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x402542
mov word [esi], 0
xor edi, edi
inc edi
mov dword [esp], edi
jmp case.0x40152e.67
cmp dword [0x42c128], 0
js 0x4030d1
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403728
mov ebx, eax
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x4180ec
call fcn.00407938
mov esi, eax
cmp dword [esp + 0x24], 0
je 0x40258b
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x4025a0
push 8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test eax, eax
je 0x4034af
push esi
push edi
call fcn.0040815a
test eax, eax
je 0x403371
mov ebp, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40355e
push 0x41c0ec
push eax
call fcn.004068cc
call ebp
xor ebx, ebx
test eax, eax
setne bl
jmp 0x40357c
cmp word [edx], 0
mov dword [esp], 0
je case.0x40152e.67
push edx
call fcn.00407d77
mov esi, eax
mov ecx, 2
call fcn.0040376c
push dword [esp + 0x20]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x18], 0
mov dword [esp], 0
jns 0x403536
jmp case.0x40152e.67
push 0xfffffffffffffff0
call fcn.00403728
mov edi, eax
push eax
call fcn.00407384
test eax, eax
jne 0x402638
push 0xffffffffffffffed
call fcn.00403728
push edi
call fcn.00406ee3
push 2
push 0x40000000
push edi
call fcn.004075ae
cmp eax, 0xffffffff
je 0x4030ef
mov ebx, eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0
je 0x402706
mov dword [esp], eax
mov eax, dword [0x40ae08]
mov esi, dword [eax]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
mov eax, dword [esp]
test ebp, ebp
je 0x402706
push 0
call fcn.00403d3c
push esi
push ebp
call fcn.00403d26
push dword [esp + 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4026f4
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
push dword [esp + 0x1c]
push eax
push 0
push dword [esp + 0x24]
mov esi, eax
call fcn.00403d53
mov dword [esp], esi
cmp byte [esi], 0
je 0x4026e3
mov esi, dword [esp]
mov ebx, dword [esi]
lea eax, [esi + 8]
mov ecx, dword [esi + 4]
add ecx, ebp
push ebx
push eax
push ecx
call fcn.0040758a
lea esi, [esi + ebx + 8]
cmp byte [esi], 0
jne 0x4026c8
push dword [esp]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
push esi
push ebp
push ebx
call fcn.00407686
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
dec eax
mov esi, ebx
xor ebx, ebx
push ebx
push ebx
push esi
push eax
call fcn.00403d53
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push str.created_uninstaller:__d____s_
call fcn.0040728c
add esp, 0xc
mov eax, 0xfffffff3
test ebp, ebp
jns 0x403111
jmp 0x403102
test ebp, ebp
je 0x40311f
push ebx
push str.settings_logging_to__d
call fcn.0040728c
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [0x40ae20]
mov dword [ecx], eax
push eax
push str.logging_set_to__d
call fcn.0040728c
add esp, 8
cmp dword [esp + 0x18], 0
je 0x40329c
call fcn.004046fc
jmp 0x40353d
push ebx
push 0x4240ec
call fcn.00407938
mov edi, eax
push eax
push dword [esp + 0x18]
push str.MessageBox:__d___s_
call fcn.0040728c
add esp, 0xc
push dword [esp + 0x14]
push edi
call fcn.00406e20
test eax, eax
je 0x4034c9
cmp eax, dword [esp + 0x1c]
je 0x403145
cmp eax, dword [esp + 0x24]
mov dword [esp], 0
jne case.0x40152e.67
mov esi, dword [esp + 0x28]
jmp 0x40354f
xor ecx, ecx
call fcn.0040376c
cmp eax, 0x1f
ja 0x4034c9
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x1c]
je 0x403331
test ecx, ecx
je 0x40352f
push eax
call fcn.004012fb
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
call fcn.00401247
jmp case.0x40152e.67
mov esi, edx
xor ebx, ebx
inc ebx
mov ecx, ebx
call fcn.0040376c
mov edi, eax
mov ecx, 2
call fcn.0040376c
mov ecx, eax
xor ebp, ebp
mov eax, dword [esp + 0x20]
cmp eax, 0xd
ja case.default.0x402843
jmp dword [eax*4 + 0x40a124]
add edi, ecx
jmp case.default.0x402843
mov edi, dword [esp + 0x28]
xor ecx, ecx
call fcn.0040376c
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.0040376c
test edi, edi
je 0x40313d
cmp esi, eax
jb 0x403145
jbe 0x402fb3
jmp 0x403357
push edx
call fcn.00407d77
test eax, eax
mov dword [esp], 0
je case.0x40152e.67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40353d
mov dword [esp + 8], edx
test byte [esp + 0x21], 1
jne 0x402c71
push dword [esp + 0x1c]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402c7b
xor ecx, ecx
call fcn.0040376c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402fb3
mov esi, dword [esp + 0x18]
jmp 0x40354f
mov eax, dword [0x40ae2c]
and ebp, dword [eax]
push 0
push ebp
push 0xb
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x14], 0
mov dword [esp], 0
je case.0x40152e.67
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x40152e.67
lea esi, [esp + 0x48]
mov dword [esi], 0xa
push ebx
push 0x4180ec
mov ebp, edx
call fcn.00407938
mov edi, eax
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x41c0ec
call fcn.00407938
mov ebx, eax
push 0xffffffffffffffdd
call fcn.00403728
push eax
push 0x1fff
push ebp
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp word [ebp], 0xa
jne 0x4034cc
mov word [ebp], 0
jmp 0x4034c9
mov esi, edx
push edi
call fcn.00407d77
test eax, eax
je 0x4029a2
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402b78
mov word [esi], 0
jmp 0x4034c9
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403728
mov dword [esp + 4], eax
push 0xffffffffffffffdf
call fcn.00403728
mov esi, eax
mov eax, dword [0x42c12c]
push dword [eax + 8]
push 0x4180ec
call fcn.00407938
mov dword [esp + 8], eax
push 0xffffffffffffffcd
call fcn.00403728
mov dword [esp + 0x2c], eax
mov eax, dword [0x42c12c]
push dword [eax + 0x14]
push 0x4280ec
call fcn.00407938
mov dword [esp + 0x44], eax
mov ebp, dword [esp + 0x24]
mov ebx, ebp
and ebx, 0xfff
mov edi, ebp
shr edi, 0xc
and edi, 7
mov dword [esp + 0x38], ebp
shr ebp, 0x10
mov dword [esp + 0x30], esi
push esi
call fcn.00407384
test eax, eax
jne 0x402a35
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x4200ec
call fcn.00407938
mov dword [esp + 0x3c], ebp
push ebp
push edi
mov dword [esp + 0x48], ebx
push ebx
push dword [esp + 0x38]
push dword [esp + 0x18]
mov ebx, dword [esp + 0x44]
push ebx
push dword [esp + 0x1c]
push str.CreateShortcut:_out:___s___in:___s__s___icon:__s__d__sw_d__hk_d
call fcn.0040728c
add esp, 0x20
lea eax, [esp + 0x48]
mov ecx, dword [0x40ae04]
mov edx, dword [0x40adfc]
push eax
push ecx
push 1
push 0
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
xor esi, esi
inc esi
mov ebp, 0xfffffff0
test eax, eax
js 0x40349c
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push dword [0x40ae00]
push eax
call dword [ecx]
test eax, eax
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx]
js 0x4032a8
push ebx
push ecx
call dword [eax + 0x50]
mov dword [esp + 0x30], eax
cmp word [esp + 0x38], 0
js 0x402ad2
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
mov edx, dword [esp]
add edx, 0x58000
push edx
push eax
call dword [ecx + 0x24]
test edi, edi
mov esi, dword [esp + 4]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x40]
je 0x402aed
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push dword [esp + 0x3c]
push eax
call dword [ecx + 0x34]
mov edx, dword [esp + 0x2c]
cmp word [edx], 0
je 0x402b11
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ebp
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push dword [esp + 0x44]
push eax
call dword [ecx + 0x1c]
cmp dword [esp + 0x30], 0
js 0x403477
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x18]
mov ebx, eax
shr ebx, 0x1f
jmp 0x403479
mov esi, edx
push dword [esp + 0x1c]
push 0x4180ec
call fcn.00407938
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40314e
push eax
push edi
call fcn.00407d5e
lea eax, [esp + 0x74]
push eax
push esi
call fcn.00407239
jmp 0x40353d
push 0x20019
mov esi, edx
call fcn.00403789
mov edi, eax
mov ecx, 3
call fcn.0040376c
mov word [esi], 0
test edi, edi
je 0x4034c9
mov dword [esp + 0x48], 0x1fff
cmp dword [esp + 0x24], 0
je 0x4032b1
push 0x1fff
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ebx, ebx
jmp 0x4032cc
push edx
call fcn.00407d77
test eax, eax
mov dword [esp], 0
je case.0x40152e.67
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40353d
cmp esi, 0x38
jne 0x402d4c
mov esi, 0x4200ec
push ebx
push esi
call fcn.00407938
mov edi, 0x41c0ec
push 0x2000
push edi
push esi
call fcn.00407e18
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
jmp 0x402d61
mov word [ebx], 0
jmp 0x4034c9
sar ecx, 2
lea edx, [esp + 0x48]
push edx
push ecx
push 0
push esi
push edi
push eax
push ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ebx, ebx
test eax, eax
sete bl
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 8]
js 0x4030b5
push dword [esp + 0x48]
push esi
call fcn.00407d5e
jmp 0x4030b5
mov ecx, 2
call fcn.0040376c
mov edi, eax
mov ebp, dword [esp + 0x20]
mov esi, ebp
and esi, 3
bt ebp, 0x10
jb 0x402c93
movzx eax, word [esp + 0x18]
jmp 0x402ca5
mov eax, dword [0x42c12c]
push dword [eax + 4]
push 0x41c0ec
call fcn.00407938
mov dword [esp], eax
lea ebx, [esp + 0x48]
push ebx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, ebp
shl eax, 0x1d
sar eax, 0x1f
mov ecx, dword [0x40ae0c]
and eax, dword [ecx]
mov ecx, ebp
sar ecx, 0x1f
and ecx, dword [ebx + 8]
add ebp, ebp
sar ebp, 0x1f
and ebp, dword [ebx + 0xc]
mov edx, 0xfef0
and edx, dword [esp + 0x20]
push edx
push ebp
push ecx
push esi
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebx, eax
push eax
push esi
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
jne 0x402d0b
test eax, eax
je 0x402d0b
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x14], 0
js 0x40353d
push ebx
push dword [esp + 0xc]
jmp 0x403538
push eax
push str.Exch:_stack____d_elements
call fcn.0040728c
add esp, 8
push 0xffffffffffffffe8
push 0
call fcn.00407938
push 0x200010
push eax
call fcn.00406e20
mov esi, 0x7fffffff
jmp 0x40354f
push ebx
push 0x41c0ec
call fcn.00407938
push eax
call sub.KERNEL32.dll_lstrlenW
mov ecx, eax
add ecx, eax
xor edx, edx
inc edx
mov eax, dword [esp + 8]
cmp word [eax], 0
je 0x402db9
mov esi, ecx
xor ebx, ebx
mov cl, byte [esp]
mov bl, cl
push eax
call fcn.00407d77
mov edi, eax
or ebp, ebx
jne 0x402d99
cmp dword [esp + 0x20], 0
je 0x402d99
push edi
push edi
call fcn.004076b8
test eax, eax
js 0x4034c9
push esi
push 0x41c0ec
push edi
call fcn.00407686
test eax, eax
mov dword [esp], 0
jne case.0x40152e.67
jmp 0x4034c9
mov dword [esp], edx
jmp case.0x40152e.67
push edi
push str.Exec:_failed_createprocess____s__
jmp 0x4034c1
push ebx
push edi
push str.WriteReg:_error_creating_key___s_s_
call fcn.0040728c
add esp, 0xc
jmp 0x4034c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push esi
push edi
push str.ExecShell:_warning:_error____s_:_file:__s__params:__s___d
call fcn.0040728c
add esp, 0x14
jmp 0x4034c9
mov eax, dword [esp]
add eax, 0x58000
push eax
push 0x4180ec
call fcn.00407239
push eax
call fcn.00407322
push edi
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x4180ec
call fcn.0040742a
mov edi, 0x41c0ec
mov esi, 0x4200ec
cmp ebp, 3
jb 0x402e6b
push 0x4180ec
call fcn.004072fa
test eax, eax
je 0x402e54
add eax, 0x14
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x402e56
xor eax, eax
add ebp, 0x7ffffffd
or ebp, 0x80000000
xor ecx, ecx
test eax, ebp
sete cl
mov ebp, ecx
test ebp, ebp
jne 0x402e79
push 0x4180ec
call fcn.00406ee3
xor eax, eax
cmp ebp, 1
setne al
inc eax
push eax
push 0x40000000
push 0x4180ec
call fcn.004075ae
cmp eax, 0xffffffff
jne 0x40319f
test ebp, ebp
jne 0x403233
mov ebp, 0x4180ec
push ebp
push str.File:_error_creating___s_
call fcn.0040728c
add esp, 8
mov ebx, dword [esp]
push ebx
push esi
call fcn.00407239
push ebp
push ebx
call fcn.00407239
push dword [esp + 0x28]
push edi
call fcn.00407938
push esi
push ebx
call fcn.00407239
mov eax, dword [esp + 0x14]
sar eax, 3
push eax
push edi
call fcn.00406e20
cmp eax, 4
jne 0x402eff
push str.File:_error__user_retry
call fcn.0040728c
add esp, 4
xor ebp, ebp
jmp 0x402e30
cmp eax, 5
jne 0x403261
push str.File:_error__user_cancel
call fcn.0040728c
add esp, 4
inc dword [0x4180b4]
jmp 0x40354d
xor eax, eax
mov word [edi], ax
mov word [ebx], ax
jmp 0x4034c9
push dword [esp + 0x1c]
push esi
push str.IfFileExists:_file___s__does_not_exist__jumping__d
call fcn.0040728c
add esp, 0xc
jmp 0x402fb3
test ebx, ebx
je 0x4034d1
test esi, esi
je 0x403599
lea eax, [esi + 4]
push eax
push edx
call fcn.00407239
mov eax, dword [esi]
mov dword [0x42c130], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40353d
mov eax, dword [ebp*4 + 0x4180ac]
mov dword [ebp*4 + 0x42c0f0], eax
xor ecx, ecx
inc ecx
call fcn.0040376c
mov ecx, dword [esp + 0x14]
mov dword [ecx*4 + 0x4180ac], eax
push eax
push ecx
push str.SetFlag:__d_d
call fcn.0040728c
add esp, 0xc
jmp 0x40353d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403145
mov esi, dword [esp + 0x1c]
jmp 0x40354f
push ebx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40353d
push 2
call fcn.00403789
test eax, eax
je 0x4034c9
mov ebx, eax
mov eax, dword [0x42c12c]
push dword [eax + 0xc]
push 0x4240ec
call fcn.00407938
mov edi, eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, eax
push edi
push 0x4200ec
push esi
push str.DeleteRegValue:___s_s____s_
call fcn.0040728c
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebp, ebp
setne al
jmp 0x4034cc
xor ebp, ebp
push 0xffffffffffffffcd
call fcn.00403728
mov edi, eax
push eax
push 0x4200ec
push 0x41c0ec
push 0x4180ec
push str.WriteINIStr:_wrote___s___s_s_in__s
call fcn.0040728c
add esp, 0x14
push edi
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp], ecx
jmp case.0x40152e.67
cmp dword [esp + 0x1c], 0
je 0x4032dd
push edi
call fcn.004072fa
test eax, eax
je 0x4032dd
push ebp
push edi
call fcn.004072cb
push 0x41c0ec
push 0xffffffffffffffe4
call fcn.004068cc
push ebx
push str.Rename_on_reboot:__s
jmp 0x403130
mov edi, eax
mov word [eax], 0
xor ebx, ebx
inc ebx
cmp dword [esp + 0x1c], 0
jne 0x4030b5
push 0x2000
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [esp], ebx
jmp case.0x40152e.67
push 0x41c0ec
push 0xfffffffffffffff5
call fcn.004068cc
mov dword [esp], esi
jmp case.0x40152e.67
push 0x41c0ec
push 0xffffffffffffffe7
call fcn.004068cc
push str.Error_registering_DLL:_Could_not_initialize_OLE
call fcn.0040728c
add esp, 4
jmp 0x4034c9
push edi
push 0xfffffd66
push str.created_uninstaller:__d____s_
call fcn.0040728c
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
mov eax, 0xffffffef
mov dword [esp], ebx
push 0x41c0ec
push eax
jmp 0x4034a5
push ebx
push 0x4180ec
call fcn.00407938
push eax
push 0x40a6d4
call fcn.0040728c
add esp, 8
jmp 0x40353d
cmp esi, eax
jge 0x403351
mov esi, dword [esp + 0x20]
jmp 0x40354f
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x4034c9
mov ecx, 2
call fcn.0040376c
mov esi, eax
mov ecx, 4
call fcn.0040376c
mov dword [esp + 0x48], 0
movzx ecx, al
shr eax, 0x18
test esi, esi
mov edx, 0x4180ac
je 0x40318a
mov edx, esi
add edx, eax
lea esi, [esp + 0x48]
push ecx
push edx
push esi
call fcn.0040758a
push dword [esi]
jmp 0x403537
mov ebx, eax
push dword [esp + 4]
push 0xffffffffffffffea
call fcn.004068cc
inc dword [0x4180e0]
xor eax, eax
push eax
push eax
push ebx
push dword [esp + 0x28]
call fcn.00403d53
mov ebp, eax
dec dword [0x4180e0]
push 0x4180ec
push eax
push str.File:_wrote__d_to___s_
call fcn.0040728c
add esp, 0xc
cmp dword [esp + 0x20], 0xffffffff
jne 0x4031e9
cmp dword [esp + 0x24], 0xffffffff
je 0x4031f8
lea eax, [esp + 0x20]
push eax
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
test ebp, ebp
jns case.0x40152e.67
cmp ebp, 0xfffffffe
jne 0x4036cc
mov esi, 0x4180ec
push 0xffffffffffffffe9
push esi
call fcn.00407938
push dword [esp + 4]
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x4036d8
push dword [esp + 4]
push 0xffffffffffffffe2
call fcn.004068cc
xor eax, eax
cmp ebp, 2
sete al
mov dword [esp], eax
push ebp
push 0x4180ec
push str.File:_skipped:___s___overwriteflag_d_
call fcn.0040728c
add esp, 0xc
jmp case.0x40152e.67
push str.File:_error__user_abort
call fcn.0040728c
add esp, 4
push 0x4180ec
push 0xfffffffffffffffa
jmp 0x4021b3
mov eax, dword [esp + 0xc]
lea ecx, [eax - 1]
cmp ecx, 2
jae 0x4034fc
mov ebp, dword [esp + 0x24]
mov word [esi + 0x3ffe], 0
jmp 0x40351b
push 1
call fcn.00407e33
jmp 0x40353d
push ecx
call dword [eax + 8]
jmp 0x40349c
xor ecx, ecx
lea edx, [esp + 0x48]
push ecx
push ecx
push ecx
push ecx
push edx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
mov word [esi + 0x3ffe], 0
jmp 0x40351e
push ebx
push str.Rename_failed:__s
jmp 0x4034c1
movzx eax, word [esp + 0xc]
cmp di, ax
je 0x403439
movzx ecx, ax
cmp ecx, 0xa
je 0x403307
cmp ecx, 0xd
jne 0x403439
mov word [ebx + esi*2], ax
inc esi
jmp 0x40344a
cmp edx, 0xffffffff
not edx
mov dword [esp + 0x1c], edx
je 0x40360a
xor ecx, ecx
inc ecx
call fcn.0040376c
mov dword [esp + 0x18], eax
jmp 0x403620
test ecx, ecx
je 0x40363d
mov ecx, dword [esp + 0x18]
mov edx, dword [0x40a004]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x94], ecx
jmp 0x40353d
jle 0x402fb3
mov esi, dword [esp + 0x24]
jmp 0x40354f
movzx eax, word [esp + 0xc]
push eax
push ebx
call fcn.00407d5e
jmp 0x40354d
push esi
push 0xfffffffffffffff7
call fcn.004068cc
push ebx
push esi
push 0x40a910
call fcn.0040728c
add esp, 0xc
xor ebx, ebx
inc ebx
jmp 0x40357c
cmp dword [esp], 7
mov eax, str.WriteRegMultiStr
je 0x4033a0
mov eax, str.WriteRegBin
mov edi, dword [esp + 4]
cmp dword [esp], 0
mov ecx, str.WriteRegNone
je 0x4033b1
mov ecx, eax
mov dword [esp + 0x30], ecx
mov eax, 0x4200ec
push 0xc000
push eax
push 0
push dword [esp + 0x2c]
call fcn.00403d53
mov ebx, eax
lea esi, [esp + 0x48]
push eax
mov eax, 0x4200ec
push eax
push 0x80
push esi
call fcn.00408039
add esp, 0x10
push esi
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push dword [esp + 0x40]
push str._s:___s_s____s___s_
call fcn.0040728c
add esp, 0x18
jmp 0x4035bf
mov ecx, 3
call fcn.0040376c
mov dword [0x4200ec], eax
push eax
mov edi, dword [esp + 8]
push edi
push ebx
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegDWORD:___s_s____s__0x_08x_
call fcn.0040728c
add esp, 0x14
mov ebx, 4
jmp 0x4035bf
neg ebp
push 1
push 0
push ebp
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [ebx + esi*2], 0
mov dword [esp], 0
test esi, esi
jne case.0x40152e.67
jmp 0x4034c9
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40152e.67
mov bl, 1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movzx esi, bl
xor bl, 1
movzx ebp, bl
shl ebp, 2
or ebp, 0xfffffff0
mov dword [esp], esi
push 0x41c0ec
push ebp
call fcn.004068cc
jmp case.0x40152e.67
push 0x41c0ec
push 0xfffffffffffffff6
call fcn.004068cc
push ebx
push str.Error_registering_DLL:_Could_not_load__s
call fcn.0040728c
add esp, 8
xor eax, eax
inc eax
mov dword [esp], eax
jmp case.0x40152e.67
push 0x4004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
add eax, 4
push dword [esp + 0x14]
push eax
call fcn.00407938
mov eax, dword [0x42c130]
mov dword [edi], eax
mov dword [0x42c130], edi
jmp 0x40353d
cmp eax, 4
mov ebx, esi
jne 0x4018bc
xor eax, eax
cmp dword [esp + 0x24], 0
sete al
mov ebp, eax
push dword [ebx]
push ebx
call fcn.00407d5e
mov dword [esp], ebp
push edi
jmp 0x4035f5
lea eax, [eax + ecx + 0x18]
push eax
push ebx
jmp 0x402b7e
push 0
call fcn.00401345
push eax
push edi
call fcn.00407d5e
mov dword [esp], 0
mov eax, dword [esp]
add dword [0x4180b4], eax
xor esi, esi
mov eax, esi
add esp, 0x298
pop esi
pop edi
pop ebx
pop ebp
ret 4
push section..data
push 0x42c130
push dword [esp + 8]
push 0x2000
push dword [esp + 0x14]
call ebp
add esp, 0x14
xor ebx, ebx
cmp dword [esp + 0x20], 0
mov dword [esp], ebx
jne case.0x40152e.67
push edi
call fcn.00404693
test eax, eax
je case.0x40152e.67
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x40152e.67
push str.Pop:_stack_empty
jmp 0x4030e2
push 0x4200ec
push edi
push dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push esi
push str.WriteRegExpandStr:___s_s____s___s_
call fcn.0040728c
add esp, 0x14
push ebx
push 0x4200ec
push dword [esp + 8]
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4035ef
push edi
push dword [esp + 0x30]
push esi
push str.WriteReg:_error_writing_into___s_s____s_
call fcn.0040728c
add esp, 0x10
xor ebx, ebx
inc ebx
jmp 0x4035f1
xor ebx, ebx
mov dword [esp], ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40152e.67
mov word [edi], 0
jmp 0x40309e
lea ebx, [eax + ecx + 0x18]
push dword [esp + 0x24]
push ebx
call fcn.00407938
or byte [ebx - 0xf], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [edi + ecx*4], eax
cmp dword [esp + 0x20], 0
je 0x40353d
push esi
call fcn.004011dc
jmp 0x40353d
mov ecx, dword [0x40a004]
mov ecx, dword [ecx]
push dword [ecx + eax*4 + 0x94]
push edi
call fcn.00407938
jmp 0x40353d
shl edi, cl
jmp case.default.0x402843
or edi, ecx
jmp case.default.0x402843
sar edi, cl
jmp case.default.0x402843
test edi, edi
setne al
test ecx, ecx
setne cl
and cl, al
movzx edi, cl
jmp case.default.0x402843
imul edi, ecx
jmp case.default.0x402843
test ecx, ecx
je 0x4036b9
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
jmp 0x4036b5
xor eax, eax
test edi, edi
sete al
jmp 0x4036b5
sub edi, ecx
jmp case.default.0x402843
and edi, ecx
jmp case.default.0x402843
shr edi, cl
jmp case.default.0x402843
xor edi, ecx
jmp case.default.0x402843
test ecx, ecx
je 0x4036b9
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
mov edi, edx
jmp case.default.0x402843
xor eax, eax
or edi, ecx
setne al
mov edi, eax
jmp case.default.0x402843
xor edi, edi
mov ebp, ebx
mov dword [esp], ebp
push edi
push esi
call fcn.00407d5e
jmp case.0x40152e.67
push 0xffffffffffffffee
push 0x4180ec
call fcn.00407938
mov esi, 0x4180ec
push esi
push 0x40a6d4
call fcn.0040728c
add esp, 8
push 0x200010
push esi
jmp 0x402d3d
xor esi, esi
jmp 0x40344a