Function at 0x40c680
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1f7c
call fcn.0049e5e0
mov eax, dword [0x4f2480]
xor eax, esp
mov dword [esp + 0x1f78], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0xc], 0
call fcn.004088e0
push dword [esp + 0x358]
lea ecx, [esp + 0x404]
mov dword [0x4f5a84], esi
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x408]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x62c]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x630]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x3ec]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x3f0]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x3d4]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x3d8]
call fcn.0041dad0
push 0x104
lea eax, [esp + 0x1e7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x4f0]
call fcn.004039f0
lea ecx, [esp + 0x658]
call fcn.00403c10
lea edx, [esp + 0x4f0]
lea ecx, [esp + 0x568]
call fcn.00404430
lea edx, [esp + 0x1640]
mov ecx, 0x104
call fcn.00409cd0
test eax, eax
je 0x4110d1
lea ecx, [esp + 0x568]
call fcn.004180d0
push eax
lea eax, [esp + 0x1644]
push 0x104
push eax
call fcn.004ad8da
add esp, 0xc
lea edx, [esp + 0x1640]
mov ecx, 0x6b
push 0
push 0
call fcn.004083f0
add esp, 8
test eax, eax
je 0x4110d1
lea eax, [esp + 0x568]
push eax
lea ecx, [esp + 0x554]
call fcn.00418450
lea ecx, [esp + 0x8c8]
call fcn.004149f0
push 1
push 0x40
push 1
lea eax, [esp + 0x164c]
push eax
lea ecx, [esp + 0x128]
call fcn.00413f90
push 0x34
call fcn.0049d9d0
add esp, 4
mov ecx, eax
push 0
call fcn.004148b0
mov ecx, dword [esp + 0x118]
mov esi, eax
mov ecx, dword [ecx + 4]
push dword [esp + ecx + 0x148]
lea ecx, [esp + 0x4c]
call fcn.00401bd0
push esi
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x368]
call fcn.0041c8b0
mov ecx, dword [esp + 0x118]
lea esi, [esp + 0x118]
mov edi, eax
lea eax, [esp + 0x50]
push edi
push eax
add esi, dword [ecx + 4]
mov ecx, esi
call fcn.00402e50
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x40c8a0
push edi
lea eax, [esp + 0x5c]
push eax
call fcn.00419740
lea ecx, [esp + 0x58]
call fcn.00401bf0
lea ecx, [esp + 0x50]
call fcn.00401bf0
lea ecx, [esp + 0x360]
call fcn.00401bf0
lea ecx, [esp + 0x48]
call fcn.00401bf0
cmp dword [esp + 0x174], 0
je 0x4112ea
push 1
lea ecx, [esp + 0x2ac]
call fcn.00412b30
lea ecx, [esp + 0x118]
call fcn.00413e90
push eax
lea ecx, [esp + 0x2bc]
call fcn.00412d20
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00412980
lea ecx, [esp + 0x118]
call fcn.00413e40
lea eax, [esp + 0x370]
push eax
lea eax, [esp + 0x3a4]
push eax
lea ecx, [esp + 0x8d0]
call fcn.004148d0
push eax
lea ecx, [esp + 0x554]
call fcn.00418310
lea ecx, [esp + 0x3a0]
call fcn.004182c0
lea ecx, [esp + 0x370]
call fcn.00417cd0
lea ecx, [esp + 0x2a8]
call fcn.00411400
push 0x10
push 0
lea eax, [esp + 0x6dc]
push eax
lea ecx, [esp + 0x55c]
call fcn.00417ec0
push 0x10
push 0x10
lea eax, [esp + 0x6c4]
push eax
lea ecx, [esp + 0x55c]
call fcn.00417ec0
push str..dat
lea edx, [esp + 0x6d8]
lea ecx, [esp + 0x6a8]
call fcn.0041bd50
add esp, 4
lea edx, [esp + 0xb08]
mov ecx, 0x104
call fcn.00409cd0
test eax, eax
jne 0x40cad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7dec
call fcn.0042aeb0
add esp, 8
lea ecx, [esp + 0x670]
push str.Unable_to_get_temp_path:_Error_1
call fcn.00416080
push 0x4e7a38
lea ecx, [esp + 0x364]
call fcn.00416150
lea ecx, [esp + 0x670]
call fcn.00416050
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
push eax
lea ecx, [esp + 0x678]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x6a4]
call fcn.004182c0
lea ecx, [esp + 0x6bc]
call fcn.004182c0
lea ecx, [esp + 0x6d4]
call fcn.004182c0
lea ecx, [esp + 0x118]
call fcn.00411370
lea ecx, [esp + 0x8c8]
call fcn.00414930
lea ecx, [esp + 0x550]
call fcn.004182c0
lea ecx, [esp + 0x568]
call fcn.004182c0
lea ecx, [esp + 0x658]
call fcn.004182c0
lea ecx, [esp + 0x4f0]
call fcn.004182c0
lea ecx, [esp + 0x3d0]
call fcn.004182c0
lea ecx, [esp + 0x3e8]
call fcn.004182c0
lea ecx, [esp + 0x628]
call fcn.004182c0
lea ecx, [esp + 0x400]
call fcn.004182c0
jmp 0x411125
lea ecx, [esp + 0x6a4]
call fcn.004180d0
push eax
lea eax, [esp + 0xb0c]
push 0x104
push eax
call fcn.004ad8da
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
lea eax, [esp + 0xb08]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40cb3c
push 0
push 0
lea edx, [esp + 0xb10]
mov ecx, 0x6a
call fcn.004083f0
add esp, 8
test eax, eax
je 0x40e991
push str.Released_excat1.exe_successfully._n
call fcn.0042aeb0
add esp, 4
push dword [esp + 0x358]
lea ecx, [esp + 0x38c]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x390]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x494]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x498]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x53c]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x540]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x524]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x528]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x50c]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x510]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x47c]
call fcn.0041d430
push 2
push 0x4e7e80
lea ecx, [esp + 0x480]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x464]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x468]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x44c]
call fcn.0041d430
push 1
push 0x4e7e84
lea ecx, [esp + 0x450]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x614]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x618]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x5fc]
call fcn.0041d430
push 1
push 0x4e7e88
lea ecx, [esp + 0x600]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x3bc]
call fcn.0041d430
push 0xb
push 0x4e79ec
lea ecx, [esp + 0x3c0]
call fcn.0041d510
push dword [esp + 0x358]
lea ecx, [esp + 0x5e4]
call fcn.0041d430
push 1
push 0x4e7e84
lea ecx, [esp + 0x5e8]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x5cc]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x5d0]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x4ac]
mov dword [esp + 0x48], 0x84
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x4b0]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x4c4]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x4c8]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x5b4]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x5b8]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x59c]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x5a0]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x584]
call fcn.0041d430
push 0
push 0x4e72c2
lea ecx, [esp + 0x588]
call fcn.0041dad0
push dword [esp + 0x358]
lea ecx, [esp + 0x434]
call fcn.0041d430
push 1
push 0x4e7e88
lea ecx, [esp + 0x438]
call fcn.0041dad0
lea ecx, [esp + 0x878]
call fcn.004149f0
push 1
push 0x40
push 1
lea eax, [esp + 0xb14]
push eax
lea ecx, [esp + 0x70]
call fcn.00413f90
push 0x34
call fcn.0049d9d0
add esp, 4
mov esi, eax
mov ecx, esi
push 0
call fcn.00401c90
mov dword [esi], vtable.std::codecvt_utf8_utf16_wchar_t__1114111__0_.0
mov ecx, dword [esp + 0x60]
mov ecx, dword [ecx + 4]
push dword [esp + ecx + 0x90]
lea ecx, [esp + 0x5c]
call fcn.00401bd0
push esi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x1e8]
call fcn.0041c8b0
mov edi, eax
mov ecx, dword [esp + 0x60]
lea esi, [esp + 0x60]
push edi
lea eax, [esp + 0x1dc]
push eax
add esi, dword [ecx + 4]
mov ecx, esi
call fcn.00402e50
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x40cebb
push edi
lea eax, [esp + 0x1d4]
push eax
call fcn.00419740
lea ecx, [esp + 0x1d0]
call fcn.00401bf0
lea ecx, [esp + 0x1d8]
call fcn.00401bf0
lea ecx, [esp + 0x1e0]
call fcn.00401bf0
lea ecx, [esp + 0x58]
call fcn.00401bf0
push dword [esp + 0x358]
lea ecx, [esp + 0x41c]
call fcn.0041d430
push 0
push 0x4e7428
lea ecx, [esp + 0x420]
call fcn.0041d510
cmp dword [esp + 0xbc], 0
je 0x411279
push 1
lea ecx, [esp + 0x1f4]
call fcn.00412b30
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x204]
call fcn.00412d20
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x20c]
call fcn.00419350
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x41c]
call fcn.00417d30
lea ecx, [esp + 0x370]
call fcn.00417cd0
lea ecx, [esp + 0x60]
call fcn.00413e40
lea ecx, [esp + 0x258]
call fcn.00412a70
lea ecx, [esp + 0x258]
call fcn.004143d0
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x644]
push eax
lea ecx, [esp + 0x880]
call fcn.004148d0
push 0
push 0x4e7eb8
lea ecx, [esp + 0x648]
call fcn.00417f20
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d1a0
lea ecx, [esp + 0xb08]
call fcn.00404660
test al, al
je 0x40cfdc
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
lea edx, [esp + 0xb10]
mov ecx, 0x6a
call fcn.004083f0
add esp, 8
test eax, eax
je 0x40ee44
push 1
push 0x40
push 1
lea eax, [esp + 0xb14]
push eax
lea ecx, [esp + 0x200]
call fcn.00413f90
lea ecx, [esp + 0x918]
call fcn.004149f0
push 0x34
call fcn.0049d9d0
add esp, 4
mov ecx, eax
push 0
call fcn.004148b0
push eax
lea eax, [esp + 0x708]
push eax
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x1f8]
add ecx, dword [eax + 4]
call fcn.00402e30
push eax
lea ecx, [esp + 0x838]
call fcn.0041c8b0
push eax
lea eax, [esp + 0x1ec]
push eax
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x1f8]
add ecx, dword [eax + 4]
call fcn.004142a0
lea ecx, [esp + 0x1e8]
call fcn.00401bf0
lea ecx, [esp + 0x830]
call fcn.00401bf0
lea ecx, [esp + 0x704]
call fcn.00401bf0
push 0x4e7428
lea ecx, [esp + 0x41c]
call fcn.00417ca0
lea ecx, [esp + 0x1f0]
call fcn.00413e80
test al, al
je 0x40ec99
push 1
lea ecx, [esp + 0x2ac]
call fcn.00412b30
lea ecx, [esp + 0x1f0]
call fcn.00413e90
push eax
lea ecx, [esp + 0x2bc]
call fcn.00412d20
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00412980
push eax
lea ecx, [esp + 0x41c]
call fcn.00417d30
lea ecx, [esp + 0x370]
call fcn.00417cd0
lea ecx, [esp + 0x1f0]
call fcn.00413e40
lea ecx, [esp + 0x2a8]
call fcn.00411400
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x374]
push eax
lea ecx, [esp + 0x920]
call fcn.004148d0
push eax
lea ecx, [esp + 0x644]
call fcn.00418310
lea ecx, [esp + 0x370]
call fcn.004182c0
push 0
push 0x4e7eb8
lea ecx, [esp + 0x648]
call fcn.00417f20
mov esi, eax
cmp esi, 0xffffffff
je 0x40ea56
lea ecx, [esp + 0x918]
call fcn.00414930
lea ecx, [esp + 0x1f0]
call fcn.00411370
push esi
push 0
lea eax, [esp + 0x724]
push eax
lea ecx, [esp + 0x424]
call fcn.00417990
push 0xffffffffffffffff
lea eax, [esi + 3]
push eax
lea eax, [esp + 0x76c]
push eax
lea ecx, [esp + 0x424]
call fcn.00417990
lea eax, [esp + 0x71c]
push eax
lea eax, [esp + 0x780]
push eax
lea ecx, [esp + 0x880]
call fcn.004148d0
lea eax, [esp + 0x764]
push eax
lea eax, [esp + 0x750]
push eax
lea ecx, [esp + 0x880]
call fcn.004148d0
push 0x7c
lea edx, [esp + 0x750]
lea ecx, [esp + 0x14]
call fcn.00404670
add esp, 4
lea ecx, [esp + 0x6ec]
mov edi, 1
push 0x4e72c2
call fcn.004183e0
lea ecx, [esp + 0x10]
call fcn.004171e0
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.004171d0
mov ebx, eax
cmp esi, ebx
je 0x40d438
cmp edi, 0x16
jg 0x40d2b5
push esi
lea edx, [esp + 0x6f0]
lea ecx, [esp + 0x3a4]
call fcn.0041be10
add esp, 4
mov ecx, eax
push 1
push 0x4e7f08
call fcn.00418200
push eax
lea ecx, [esp + 0x374]
call fcn.00418390
lea eax, [esp + 0x370]
push eax
lea ecx, [esp + 0x6f0]
call fcn.00418310
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
cmp edi, 1
jne 0x40d2c6
lea ecx, [esp + 0x388]
jmp 0x40d426
cmp edi, 2
jne 0x40d2d7
lea ecx, [esp + 0x490]
jmp 0x40d426
cmp edi, 3
jne 0x40d2e8
lea ecx, [esp + 0x538]
jmp 0x40d426
cmp edi, 4
jne 0x40d2f9
lea ecx, [esp + 0x520]
jmp 0x40d426
cmp edi, 5
jne 0x40d30a
lea ecx, [esp + 0x508]
jmp 0x40d426
cmp edi, 6
jne 0x40d31b
lea ecx, [esp + 0x478]
jmp 0x40d426
cmp edi, 7
jne 0x40d32c
lea ecx, [esp + 0x460]
jmp 0x40d426
cmp edi, 8
jne 0x40d33d
lea ecx, [esp + 0x448]
jmp 0x40d426
cmp edi, 9
jne 0x40d34e
lea ecx, [esp + 0x610]
jmp 0x40d426
cmp edi, 0xb
jne 0x40d35f
lea ecx, [esp + 0x5f8]
jmp 0x40d426
cmp edi, 0xc
jne 0x40d390
mov edx, esi
lea ecx, [esp + 0x370]
call fcn.00405d80
push eax
lea ecx, [esp + 0x3bc]
call fcn.00417d30
lea ecx, [esp + 0x370]
call fcn.00417cd0
jmp 0x40d42c
cmp edi, 0xd
jne 0x40d39f
mov ecx, 0x4f2f58
jmp 0x40d426
cmp edi, 0xe
jne 0x40d3ad
lea ecx, [esp + 0x5e0]
jmp 0x40d426
cmp edi, 0xf
jne 0x40d3bb
lea ecx, [esp + 0x5c8]
jmp 0x40d426
cmp edi, 0x10
jne 0x40d3d4
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
add esp, 4
mov dword [esp + 0x44], eax
jmp 0x40d42c
cmp edi, 0x11
jne 0x40d3e2
lea ecx, [esp + 0x4a8]
jmp 0x40d426
cmp edi, 0x12
jne 0x40d3f0
lea ecx, [esp + 0x4c0]
jmp 0x40d426
cmp edi, 0x15
jne 0x40d3fe
lea ecx, [esp + 0x5b0]
jmp 0x40d426
cmp edi, 0x16
jne 0x40d40c
lea ecx, [esp + 0x598]
jmp 0x40d426
cmp edi, 0x17
jne 0x40d41a
lea ecx, [esp + 0x580]
jmp 0x40d426
cmp edi, 0x18
jne 0x40d42c
lea ecx, [esp + 0x430]
push esi
call fcn.00418290
add esi, 0x18
inc edi
cmp esi, ebx
jne 0x40d252
lea edx, [esp + 0x6ec]
lea ecx, [esp + 0x734]
call fcn.00404430
lea eax, [esp + 0x580]
push eax
lea ecx, [esp + 0x738]
call fcn.0041ee70
test al, al
jne 0x40d5eb
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
lea ecx, [esp + 0x640]
call fcn.004182c0
lea ecx, [esp + 0x418]
call fcn.00417cd0
lea ecx, [esp + 0xd0]
call fcn.00413ea0
lea ecx, [esp + 0xd0]
call fcn.004143d0
lea ecx, [esp + 0x878]
call fcn.00414930
lea ecx, [esp + 0x430]
call fcn.004182c0
lea ecx, [esp + 0x580]
call fcn.004182c0
lea ecx, [esp + 0x598]
call fcn.004182c0
lea ecx, [esp + 0x5b0]
call fcn.004182c0
lea ecx, [esp + 0x4c0]
call fcn.004182c0
lea ecx, [esp + 0x4a8]
call fcn.004182c0
lea ecx, [esp + 0x5c8]
call fcn.004182c0
lea ecx, [esp + 0x5e0]
call fcn.004182c0
lea ecx, [esp + 0x3b8]
call fcn.00417cd0
lea ecx, [esp + 0x5f8]
call fcn.004182c0
lea ecx, [esp + 0x610]
call fcn.004182c0
lea ecx, [esp + 0x448]
call fcn.004182c0
lea ecx, [esp + 0x460]
call fcn.004182c0
lea ecx, [esp + 0x478]
call fcn.004182c0
lea ecx, [esp + 0x508]
call fcn.004182c0
lea ecx, [esp + 0x520]
call fcn.004182c0
lea ecx, [esp + 0x538]
call fcn.004182c0
lea ecx, [esp + 0x490]
call fcn.004182c0
lea ecx, [esp + 0x388]
call fcn.004182c0
jmp 0x40caf9
push 0x4e72c2
lea ecx, [esp + 0x4ac]
call fcn.0041ede0
test al, al
jne 0x411141
push 0x2c
lea edx, [esp + 0x4ac]
lea ecx, [esp + 0x20]
call fcn.00404670
add esp, 4
lea ecx, [esp + 0x1c]
mov edi, 1
call fcn.004171e0
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.004171d0
mov ebx, eax
cmp esi, ebx
je 0x40d689
cmp edi, 1
jne 0x40d64e
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
mov dword [esp + 0x44], eax
jmp 0x40d67e
cmp edi, 2
jne 0x40d667
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
mov dword [esp + 0x82c], eax
jmp 0x40d67e
cmp edi, 3
jne 0x40d681
push 0xa
xor edx, edx
mov ecx, esi
call fcn.004030a0
mov dword [esp + 0x36c], eax
add esp, 4
add esi, 0x18
inc edi
cmp esi, ebx
jne 0x40d638
cmp dword [esp + 0x40], 0x1388
jl 0x40d6a0
call fcn.0040c1d0
test al, al
jne 0x40ee6d
push 0x4e7e88
lea ecx, [esp + 0x494]
call fcn.0041ede0
test al, al
jne 0x40d6f8
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x388]
or eax, 3
lea ecx, [esp + 0x3a0]
mov dword [esp + 0xc], eax
call fcn.00405d80
mov edx, eax
lea ecx, [esp + 0x370]
call fcn.00406a30
lea ecx, [esp + 0x4f0]
push ecx
mov ecx, eax
call fcn.0041ee70
test al, al
je 0x40d6f8
mov bl, 1
jmp 0x40d6fa
xor bl, bl
mov eax, dword [esp + 0xc]
test al, 2
je 0x40d719
and eax, 0xfffffffd
lea ecx, [esp + 0x370]
mov dword [esp + 0xc], eax
call fcn.004182c0
mov eax, dword [esp + 0xc]
test al, 1
je 0x40d730
and eax, 0xfffffffe
lea ecx, [esp + 0x3a0]
mov dword [esp + 0xc], eax
call fcn.00417cd0
test bl, bl
jne 0x410dee
push dword [esp + 0x358]
lea ecx, [esp + 0x7b0]
call fcn.0041d430
push 0x10
push str.SbOmI5PlV3rRkPMj
lea ecx, [esp + 0x7b4]
call fcn.0041dad0
push str..dat
lea edx, [esp + 0x6c0]
lea ecx, [esp + 0x798]
call fcn.0041bd50
add esp, 4
lea edx, [esp + 0xc10]
mov ecx, 0x104
call fcn.00409cd0
test eax, eax
je 0x410dd5
lea ecx, [esp + 0x794]
call fcn.004180d0
push eax
lea eax, [esp + 0xc14]
push 0x104
push eax
call fcn.004ad8da
add esp, 0xc
lea eax, [esp + 0x460]
mov edx, str.http:__www.aqianniao.com_ver_json_
lea ecx, [esp + 0x370]
push str..json
push eax
call fcn.0041c740
add esp, 4
lea ecx, [esp + 0x7c8]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x370]
call fcn.004182c0
push 0
lea ecx, [esp + 0x2c]
call fcn.00417610
mov edx, 0x4e7e80
lea ecx, [esp + 0x478]
call fcn.0041ca40
test al, al
je 0x40d9e6
lea edx, [esp + 0x28]
lea ecx, [esp + 0x7c4]
call fcn.00408640
test al, al
je 0x40d9e6
mov edx, 0x4e7e88
lea ecx, [esp + 0x430]
call fcn.0041c710
test al, al
je 0x40d8ad
push str.auto_update
lea ecx, [esp + 0x2c]
call fcn.0041ca80
mov ecx, eax
call fcn.0041cad0
cmp eax, 1
jne 0x40d8ad
lea eax, [esp + 0x3a0]
push eax
push ecx
push str.download_url
lea ecx, [esp + 0x34]
call fcn.0041ca80
add esp, 4
mov ecx, eax
call fcn.0041cbe0
lea eax, [esp + 0xc10]
push eax
lea ecx, [esp + 0x374]
call fcn.004183e0
lea eax, [esp + 0x3a0]
push eax
push str.now_version
lea ecx, [esp + 0x30]
call fcn.0041ca80
jmp 0x40d982
mov edx, 0x4e80e4
lea ecx, [esp + 0x430]
call fcn.0041c710
test al, al
jne 0x40d8db
mov edx, 0x4e80e8
lea ecx, [esp + 0x430]
call fcn.0041c710
test al, al
je 0x40d9e6
sub esp, 0x18
lea eax, [esp + 0x448]
mov ecx, esp
mov edx, str.auto_update
push eax
call fcn.0041c740
add esp, 4
lea ecx, [esp + 0x40]
call fcn.004173b0
mov ecx, eax
call fcn.0041cad0
cmp eax, 1
jne 0x40d9e6
lea eax, [esp + 0x3a0]
mov edx, str.download_url
push eax
sub esp, 0x1c
lea eax, [esp + 0x450]
mov ecx, esp
push eax
call fcn.0041c740
add esp, 4
lea ecx, [esp + 0x48]
call fcn.004173b0
add esp, 4
mov ecx, eax
call fcn.0041cbe0
lea eax, [esp + 0xc10]
push eax
lea ecx, [esp + 0x374]
call fcn.004183e0
lea eax, [esp + 0x3a0]
mov edx, str.now_version
push eax
sub esp, 0x18
lea eax, [esp + 0x44c]
mov ecx, esp
push eax
call fcn.0041c740
add esp, 4
lea ecx, [esp + 0x44]
call fcn.004173b0
push ecx
mov ecx, eax
call fcn.0041cad0
add esp, 4
lea ecx, [esp + 0x4dc]
mov edx, eax
call fcn.00403100
push eax
lea eax, [esp + 0x378]
push eax
lea eax, [esp + 0x46c]
push eax
lea edx, [esp + 0x398]
lea ecx, [esp + 0x488]
call fcn.00409d70
add esp, 0x10
lea ecx, [esp + 0x4d8]
call fcn.004182c0
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
mov edx, 0x4e7e88
lea ecx, [esp + 0x5e0]
call fcn.0041c710
test al, al
je 0x40dafd
lea ecx, [esp + 0x3a0]
call fcn.00409700
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x3a0]
or ebx, 4
lea ecx, [esp + 0x848]
push 0x4e80ec
mov dword [esp + 0x10], ebx
call fcn.0041bf30
add esp, 4
mov ecx, eax
call fcn.00409920
test al, al
je 0x40da9a
or ebx, 8
lea edx, [esp + 0x3a0]
push 0x4e80f8
lea ecx, [esp + 0x4dc]
mov dword [esp + 0x10], ebx
call fcn.0041bf30
add esp, 4
mov ecx, eax
call fcn.00409920
test al, al
je 0x40da9a
or ebx, 0x10
lea edx, [esp + 0x3a0]
push 0x4e8100
lea ecx, [esp + 0x374]
mov dword [esp + 0x10], ebx
call fcn.0041bf30
add esp, 4
mov ecx, eax
call fcn.00409920
test al, al
je 0x40da9a
xor bl, bl
jmp 0x40da9c
mov bl, 1
mov eax, dword [esp + 0xc]
test al, 0x10
je 0x40dabb
and eax, 0xffffffef
lea ecx, [esp + 0x370]
mov dword [esp + 0xc], eax
call fcn.00417cd0
mov eax, dword [esp + 0xc]
test al, 8
je 0x40dad6
and eax, 0xfffffff7
lea ecx, [esp + 0x4d8]
mov dword [esp + 0xc], eax
call fcn.00417cd0
mov eax, dword [esp + 0xc]
and eax, 0xfffffffb
lea ecx, [esp + 0x848]
mov dword [esp + 0xc], eax
call fcn.00417cd0
test bl, bl
jne 0x40f0ad
lea ecx, [esp + 0x3a0]
call fcn.00417cd0
mov edx, 0x4e7e84
lea ecx, [esp + 0x508]
call fcn.0041ca40
test al, al
je 0x40db50
lea eax, [esp + 0x1e78]
push eax
lea ecx, [esp + 0x374]
call fcn.004183e0
lea eax, [esp + 0x520]
push eax
lea edx, [esp + 0x374]
lea ecx, [esp + 0x4f4]
call fcn.00407d60
add esp, 4
lea ecx, [esp + 0x370]
call fcn.004182c0
lea eax, [esp + 0x388]
push eax
lea eax, [esp + 0x7e0]
push eax
lea ecx, [esp + 0x880]
call fcn.00414900
lea ecx, [esp + 0xc10]
call fcn.00404660
push 1
test al, al
lea eax, [esp + 0xc14]
push 0x40
jne 0x40dd60
push 2
push eax
lea ecx, [esp + 0x978]
call fcn.00411be0
lea ecx, [esp + 0x968]
call fcn.00411a20
test al, al
je 0x40f82b
mov edx, 0x10
lea ecx, [esp + 0x370]
call fcn.00405b30
lea ecx, [esp + 0x7f4]
call fcn.00404930
push eax
push 0x4e79a8
lea edx, [esp + 0x378]
lea ecx, [esp + 0x4e0]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x84c]
mov edx, eax
call fcn.0041bf10
add esp, 4
lea ecx, [esp + 0x400]
push eax
call fcn.00418310
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x4d8]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
push str.QND.dll
lea edx, [esp + 0x374]
lea ecx, [esp + 0x7f8]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x3e8]
push eax
call fcn.00418310
lea ecx, [esp + 0x7f4]
call fcn.004182c0
push str.QND.conf
lea edx, [esp + 0x374]
lea ecx, [esp + 0x7f8]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x3d0]
push eax
call fcn.00418310
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea eax, [esp + 0x3d0]
push eax
push 0x4e7f08
lea eax, [esp + 0x3f0]
push eax
push 0x4e7f08
lea edx, [esp + 0x410]
lea ecx, [esp + 0x4e8]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x854]
mov edx, eax
call fcn.0041be60
add esp, 4
lea ecx, [esp + 0x7fc]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a4]
mov edx, eax
call fcn.0041be60
add esp, 4
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x4d8]
call fcn.004182c0
lea edx, [esp + 0x3a0]
lea ecx, [esp + 0x968]
call fcn.0041cce0
lea ecx, [esp + 0x968]
call fcn.004119e0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x968]
call fcn.00411500
jmp 0x40e064
push 1
push eax
lea ecx, [esp + 0xd28]
call fcn.004157b0
lea ecx, [esp + 0xd18]
call fcn.00413e80
test al, al
je 0x410d8d
push 1
lea ecx, [esp + 0x2ac]
call fcn.00416b70
lea ecx, [esp + 0xd18]
call fcn.00413e90
push eax
lea ecx, [esp + 0x2bc]
call fcn.00416ea0
lea eax, [esp + 0x3a0]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00416870
lea ecx, [esp + 0xd18]
call fcn.00415770
push 1
push 3
lea eax, [esp + 0x3a8]
push eax
lea ecx, [esp + 0x1fc]
call fcn.00416960
push 0x7c
lea edx, [esp + 0x404]
lea ecx, [esp + 0x1f4]
call fcn.0041bd30
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00402d90
test al, al
je 0x40de59
push 0x7c
lea edx, [esp + 0x3ec]
lea ecx, [esp + 0x1f4]
call fcn.0041bd30
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00402d90
test al, al
je 0x40de59
lea edx, [esp + 0x3d0]
lea ecx, [esp + 0x1f0]
call fcn.0041cd00
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00402d90
test al, al
jne 0x40e034
push 1
push 0x40
push 2
lea eax, [esp + 0xc1c]
push eax
lea ecx, [esp + 0x978]
call fcn.00411be0
lea ecx, [esp + 0x968]
call fcn.00411a20
test al, al
je 0x410d15
mov edx, 0x10
lea ecx, [esp + 0x370]
call fcn.00405b30
lea ecx, [esp + 0x670]
call fcn.00404930
push eax
push 0x4e79a8
lea edx, [esp + 0x378]
lea ecx, [esp + 0x850]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x7f8]
mov edx, eax
call fcn.0041bf10
add esp, 4
lea ecx, [esp + 0x400]
push eax
call fcn.00418310
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x670]
call fcn.004182c0
push str.QND.dll
lea edx, [esp + 0x374]
lea ecx, [esp + 0x674]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x3e8]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
push str.QND.conf
lea edx, [esp + 0x374]
lea ecx, [esp + 0x674]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x3d0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea eax, [esp + 0x3d0]
push eax
push 0x4e7f08
lea eax, [esp + 0x3f0]
push eax
push 0x4e7f08
lea edx, [esp + 0x410]
lea ecx, [esp + 0x858]
call fcn.0041bd50
add esp, 4
lea ecx, [esp + 0x800]
mov edx, eax
call fcn.0041be60
add esp, 4
lea ecx, [esp + 0x678]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x4dc]
mov edx, eax
call fcn.0041be60
add esp, 4
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea edx, [esp + 0x4d8]
lea ecx, [esp + 0x968]
call fcn.0041cce0
lea ecx, [esp + 0x968]
call fcn.004119e0
lea ecx, [esp + 0x4d8]
call fcn.004182c0
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x968]
call fcn.00411500
lea ecx, [esp + 0x1f0]
call fcn.004047e0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
lea ecx, [esp + 0x2a8]
call fcn.004047e0
lea ecx, [esp + 0xd18]
call fcn.0040c070
lea edx, [esp + 0x1330]
mov ecx, 0x104
call fcn.00409c40
test eax, eax
je 0x410cf5
lea ecx, [esp + 0x400]
call fcn.004180d0
push eax
lea eax, [esp + 0x1334]
push 0x104
push eax
call fcn.004ad8da
add esp, 0xc
lea edx, [esp + 0x1958]
mov ecx, 0x104
call fcn.00409cd0
test eax, eax
je 0x410cf5
lea ecx, [esp + 0x3e8]
call fcn.004180d0
push eax
lea eax, [esp + 0x195c]
push 0x104
push eax
call fcn.004ad8da
add esp, 0xc
lea edx, [esp + 0x1c68]
mov ecx, 0x104
call fcn.00409cd0
test eax, eax
je 0x410cf5
lea ecx, [esp + 0x3d0]
call fcn.004180d0
push eax
lea eax, [esp + 0x1c6c]
push 0x104
push eax
call fcn.004ad8da
add esp, 0xc
lea edx, [esp + 0x1128]
mov ecx, 0x104
call fcn.00409b20
test eax, eax
je 0x410cf5
lea edx, [esp + 0x400]
lea ecx, [esp + 0x670]
call fcn.00405d80
mov ecx, eax
call fcn.00417b60
push eax
lea eax, [esp + 0x112c]
push 0x104
push eax
call fcn.004ad9bd
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417cd0
lea edx, [esp + 0x1438]
mov ecx, 0x104
call fcn.00409bc0
test eax, eax
je 0x410cf5
lea edx, [esp + 0x3e8]
lea ecx, [esp + 0x670]
call fcn.00405d80
mov ecx, eax
call fcn.00417b60
push eax
lea eax, [esp + 0x143c]
push 0x104
push eax
call fcn.004ad9bd
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417cd0
lea edx, [esp + 0x1a60]
mov ecx, 0x104
call fcn.00409bc0
test eax, eax
je 0x410cf5
lea edx, [esp + 0x3d0]
lea ecx, [esp + 0x670]
call fcn.00405d80
mov ecx, eax
call fcn.00417b60
push eax
lea eax, [esp + 0x1a64]
push 0x104
push eax
call fcn.004ad9bd
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417cd0
mov edx, 0x4e7e88
lea ecx, [esp + 0x490]
call fcn.0041ca40
test al, al
je 0x40e2f3
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x394]
call fcn.004180d0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0
push 0xfde9
call ebx
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049da05
add esp, 4
lea ecx, [esp + 0x388]
mov edi, eax
push esi
push edi
push 0xffffffffffffffff
call fcn.004180d0
push eax
push 0
push 0xfde9
call ebx
lea ecx, [esp + 0x370]
call fcn.00408af0
lea ecx, [esp + 0x370]
call fcn.00417b60
push eax
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad9c8
add esp, 0xc
lea eax, [esp + 0xd18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea eax, [esp + 0xd1c]
push eax
lea eax, [esp + 0xf28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
call fcn.0049da00
add esp, 4
lea ecx, [esp + 0x370]
call fcn.00417cd0
jmp 0x40e3a1
lea edx, [esp + 0xd18]
mov ecx, 0x104
call fcn.00409bc0
test eax, eax
je 0x410cd5
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x394]
call fcn.004180d0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0
push 0xfde9
call ebx
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049da05
add esp, 4
lea ecx, [esp + 0x388]
mov edi, eax
push esi
push edi
push 0xffffffffffffffff
call fcn.004180d0
push eax
push 0
push 0xfde9
call ebx
push edi
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad9bd
add esp, 0xc
lea eax, [esp + 0xd18]
push eax
lea eax, [esp + 0xf24]
push 0x104
push eax
call fcn.004ad9c8
add esp, 0xc
push edi
call fcn.0049da00
add esp, 4
lea eax, [esp + 0x1330]
push eax
lea eax, [esp + 0x174c]
push 0x104
push eax
call fcn.004ada2c
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x1754]
add esp, 0xc
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x1748]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40e3e7
test al, 0x10
jne 0x40e41d
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x1748]
push 0
push eax
call edi
test eax, eax
jne 0x40e423
push 0x10
push 0x4e7a38
push str.Unable_to_create_directory
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f337
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x1958]
push eax
lea eax, [esp + 0x1854]
push 0x104
push eax
call fcn.004ada2c
add esp, 0xc
lea eax, [esp + 0x1850]
push eax
call esi
lea eax, [esp + 0x1850]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40e45d
test al, 0x10
jne 0x40e46d
push 0
lea eax, [esp + 0x1854]
push eax
call edi
test eax, eax
je 0x40e3fd
lea ecx, [esp + 0x1438]
call fcn.00404650
test al, al
jne 0x40e4d9
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
push 0
mov edx, 0x4e7e88
lea ecx, [esp + 0x464]
call fcn.0041c710
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x1454]
movzx eax, al
push eax
call fcn.004073b0
add esp, 0x20
test eax, eax
je 0x40f873
push str.Released_excat1.exe_successfully._n
call fcn.0042aeb0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 4
jmp 0x40e686
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea eax, [esp + 0x1438]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40e554
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
push eax
push esi
mov dword [esp + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e54d
mov eax, dword [esp + 0x50]
or eax, dword [esp + 0x54]
jne 0x40e54d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x1438]
jmp 0x40e7e1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xa88]
lea ecx, [esp + 0x1438]
call fcn.004040c0
test al, al
je 0x40ffd4
lea edx, [esp + 0xa98]
lea ecx, [esp + 0x5b0]
call fcn.00404260
test al, al
je 0x410126
lea ecx, [esp + 0xa88]
mov esi, 0xc
lea edx, [esp + 0xa98]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40e5b5
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40e5a0
xor eax, eax
jmp 0x40e5dc
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40e5d7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40e5d7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40e5d7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x40e5d7
xor eax, eax
jmp 0x40e5dc
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e686
lea edx, [esp + 0x1128]
lea ecx, [esp + 0x4d8]
call fcn.00404390
lea edx, [esp + 0x358]
lea ecx, [esp + 0x4d8]
call fcn.00408240
test al, al
je 0x40e629
mov ecx, dword [esp + 0x358]
call fcn.004083b0
test al, al
je 0x40e629
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
push 0
mov edx, 0x4e7e88
lea ecx, [esp + 0x464]
call fcn.0041c710
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x1454]
movzx eax, al
push eax
call fcn.004073b0
add esp, 0x20
test eax, eax
je 0x40fbda
push str.Released_excat1.exe_successfully._n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x4d8]
call fcn.00417cd0
lea ecx, [esp + 0x1958]
call fcn.0040c100
lea ecx, [esp + 0x1a60]
call fcn.00404650
push 1
test al, al
lea ecx, [esp + 0x96c]
push 0x40
lea eax, [esp + 0x1a68]
jne 0x40e6ed
push 0x20
push eax
call fcn.00411a30
mov eax, dword [esp + 0x968]
lea ecx, [esp + 0x968]
add ecx, dword [eax + 4]
call fcn.00402da0
test al, al
jne 0x40ff3c
lea ecx, [esp + 0xb08]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e6e4
jmp 0x40e727
push 0x30
push eax
call fcn.00411a30
mov eax, dword [esp + 0x968]
lea ecx, [esp + 0x968]
add ecx, dword [eax + 4]
call fcn.00402da0
test al, al
jne 0x40ff3c
lea ecx, [esp + 0xb08]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e720
push 0
sub ecx, edx
lea eax, [esp + 0xb0c]
push ecx
push eax
lea ecx, [esp + 0x974]
call fcn.00416d40
lea ecx, [esp + 0x968]
call fcn.004119e0
lea ecx, [esp + 0x968]
call fcn.00411500
lea ecx, [esp + 0x1128]
call fcn.00404650
test al, al
je 0x41050a
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea eax, [esp + 0x1140]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40ffb9
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push eax
push esi
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40ffb2
mov eax, dword [esp + 0x48]
or eax, dword [esp + 0x4c]
jne 0x40ffb2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x1128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x7dc]
call fcn.00417cd0
lea ecx, [esp + 0x28]
call fcn.004175c0
lea ecx, [esp + 0x7c4]
call fcn.004182c0
lea ecx, [esp + 0x794]
call fcn.004182c0
lea ecx, [esp + 0x7ac]
call fcn.004182c0
lea ecx, [esp + 0x1c]
call fcn.004171f0
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
lea ecx, [esp + 0x640]
call fcn.004182c0
lea ecx, [esp + 0x418]
call fcn.00417cd0
lea ecx, [esp + 0x60]
call fcn.00411370
lea ecx, [esp + 0x878]
call fcn.00414930
lea ecx, [esp + 0x430]
call fcn.004182c0
lea ecx, [esp + 0x580]
call fcn.004182c0
lea ecx, [esp + 0x598]
call fcn.004182c0
lea ecx, [esp + 0x5b0]
call fcn.004182c0
lea ecx, [esp + 0x4c0]
call fcn.004182c0
lea ecx, [esp + 0x4a8]
call fcn.004182c0
lea ecx, [esp + 0x5c8]
call fcn.004182c0
lea ecx, [esp + 0x5e0]
call fcn.004182c0
lea ecx, [esp + 0x3b8]
call fcn.00417cd0
lea ecx, [esp + 0x5f8]
call fcn.004182c0
lea ecx, [esp + 0x610]
call fcn.004182c0
lea ecx, [esp + 0x448]
call fcn.004182c0
lea ecx, [esp + 0x460]
call fcn.004182c0
lea ecx, [esp + 0x478]
call fcn.004182c0
lea ecx, [esp + 0x508]
call fcn.004182c0
lea ecx, [esp + 0x520]
call fcn.004182c0
lea ecx, [esp + 0x538]
call fcn.004182c0
lea ecx, [esp + 0x490]
call fcn.004182c0
lea ecx, [esp + 0x388]
call fcn.004182c0
jmp 0x40cb00
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aeb0
add esp, 4
lea eax, [esp + 0xb08]
push 0x10
push 0x4e7a38
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x6a4]
call fcn.004182c0
lea ecx, [esp + 0x6bc]
call fcn.004182c0
lea ecx, [esp + 0x6d4]
call fcn.004182c0
lea ecx, [esp + 0x118]
call fcn.00411370
lea ecx, [esp + 0x8c8]
call fcn.00414930
lea ecx, [esp + 0x550]
call fcn.004182c0
lea ecx, [esp + 0x568]
call fcn.004182c0
lea ecx, [esp + 0x658]
call fcn.004182c0
lea ecx, [esp + 0x4f0]
call fcn.004182c0
lea ecx, [esp + 0x3d0]
call fcn.004182c0
lea ecx, [esp + 0x3e8]
call fcn.004182c0
lea ecx, [esp + 0x628]
call fcn.004182c0
lea ecx, [esp + 0x400]
call fcn.004182c0
jmp 0x411125
push 0x4e7ebc
lea ecx, [esp + 0x834]
call fcn.00415920
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e7ed0
lea ecx, [esp + 0x708]
call fcn.00415920
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Parsing_configuration_file_error
lea ecx, [esp + 0x674]
call fcn.00416080
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x40eaf5
lea ecx, [esp + 0x704]
call fcn.00415900
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x708]
jmp 0x40eb5c
cmp eax, 3
jne 0x40eb2f
lea ecx, [esp + 0x670]
call fcn.00416050
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x678]
call fcn.004116b0
jmp 0x40eb62
lea ecx, [esp + 0x830]
call fcn.00415900
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x834]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x918]
call fcn.00414930
lea ecx, [esp + 0x1f0]
call fcn.00411370
lea ecx, [esp + 0x640]
call fcn.004182c0
lea ecx, [esp + 0x418]
call fcn.00417cd0
lea ecx, [esp + 0x60]
call fcn.00411370
lea ecx, [esp + 0x878]
call fcn.00414930
lea ecx, [esp + 0x430]
call fcn.004182c0
lea ecx, [esp + 0x580]
call fcn.004182c0
lea ecx, [esp + 0x598]
call fcn.004182c0
lea ecx, [esp + 0x5b0]
call fcn.004182c0
lea ecx, [esp + 0x4c0]
call fcn.004182c0
lea ecx, [esp + 0x4a8]
call fcn.004182c0
lea ecx, [esp + 0x5c8]
call fcn.004182c0
lea ecx, [esp + 0x5e0]
call fcn.004182c0
lea ecx, [esp + 0x3b8]
call fcn.00417cd0
lea ecx, [esp + 0x5f8]
call fcn.004182c0
lea ecx, [esp + 0x610]
call fcn.004182c0
lea ecx, [esp + 0x448]
call fcn.004182c0
lea ecx, [esp + 0x460]
call fcn.004182c0
lea ecx, [esp + 0x478]
call fcn.004182c0
lea ecx, [esp + 0x508]
call fcn.004182c0
lea ecx, [esp + 0x520]
call fcn.004182c0
lea ecx, [esp + 0x538]
call fcn.004182c0
lea ecx, [esp + 0x490]
call fcn.004182c0
lea ecx, [esp + 0x388]
call fcn.004182c0
jmp 0x40ca36
push fcn.0041c990
push ecx
mov edx, str.Unable_to_open_the_param_file_for_reading.
mov ecx, 0x4f46d0
call fcn.0041c170
add esp, 4
mov ecx, eax
call fcn.00417150
push str.Unable_to_open_the_param_file_for_reading
lea ecx, [esp + 0x674]
call fcn.00412220
push 0x4e7a38
lea ecx, [esp + 0x364]
call fcn.00416150
lea ecx, [esp + 0x670]
call fcn.004121e0
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
push eax
lea ecx, [esp + 0x678]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x918]
call fcn.00414930
lea ecx, [esp + 0x1f0]
call fcn.00411370
lea ecx, [esp + 0x640]
call fcn.004182c0
lea ecx, [esp + 0x418]
call fcn.00417cd0
lea ecx, [esp + 0x60]
call fcn.00411370
lea ecx, [esp + 0x878]
call fcn.00414930
lea ecx, [esp + 0x430]
call fcn.004182c0
lea ecx, [esp + 0x580]
call fcn.004182c0
lea ecx, [esp + 0x598]
call fcn.004182c0
lea ecx, [esp + 0x5b0]
call fcn.004182c0
lea ecx, [esp + 0x4c0]
call fcn.004182c0
lea ecx, [esp + 0x4a8]
call fcn.004182c0
lea ecx, [esp + 0x5c8]
call fcn.004182c0
lea ecx, [esp + 0x5e0]
call fcn.004182c0
lea ecx, [esp + 0x3b8]
call fcn.00417cd0
lea ecx, [esp + 0x5f8]
call fcn.004182c0
lea ecx, [esp + 0x610]
call fcn.004182c0
lea ecx, [esp + 0x448]
call fcn.004182c0
lea ecx, [esp + 0x460]
call fcn.004182c0
lea ecx, [esp + 0x478]
call fcn.004182c0
lea ecx, [esp + 0x508]
call fcn.004182c0
lea ecx, [esp + 0x520]
call fcn.004182c0
lea ecx, [esp + 0x538]
call fcn.004182c0
lea ecx, [esp + 0x490]
call fcn.004182c0
lea ecx, [esp + 0x388]
call fcn.004182c0
jmp 0x40ca36
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aeb0
add esp, 4
lea eax, [esp + 0xb08]
push 0x10
push 0x4e7a38
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40eb83
push 0
push 0x4e7f7c
push 0x4e7f88
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
call fcn.004171f0
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00413e30
lea ecx, [esp + 0x640]
call fcn.004182c0
lea ecx, [esp + 0x418]
call fcn.00417cd0
lea ecx, [esp + 0x60]
call fcn.00411370
lea ecx, [esp + 0x878]
call fcn.00414930
lea ecx, [esp + 0x430]
call fcn.004182c0
lea ecx, [esp + 0x580]
call fcn.004182c0
lea ecx, [esp + 0x598]
call fcn.004182c0
lea ecx, [esp + 0x5b0]
call fcn.004182c0
lea ecx, [esp + 0x4c0]
call fcn.004182c0
lea ecx, [esp + 0x4a8]
call fcn.004182c0
lea ecx, [esp + 0x5c8]
call fcn.004182c0
lea ecx, [esp + 0x5e0]
call fcn.004182c0
lea ecx, [esp + 0x3b8]
call fcn.00417cd0
lea ecx, [esp + 0x5f8]
call fcn.004182c0
lea ecx, [esp + 0x610]
call fcn.004182c0
lea ecx, [esp + 0x448]
call fcn.004182c0
lea ecx, [esp + 0x460]
call fcn.004182c0
lea ecx, [esp + 0x478]
call fcn.004182c0
lea ecx, [esp + 0x508]
call fcn.004182c0
lea ecx, [esp + 0x520]
call fcn.004182c0
lea ecx, [esp + 0x538]
call fcn.004182c0
lea ecx, [esp + 0x490]
call fcn.004182c0
lea ecx, [esp + 0x388]
call fcn.004182c0
lea ecx, [esp + 0x6a4]
call fcn.004182c0
lea ecx, [esp + 0x6bc]
call fcn.004182c0
lea ecx, [esp + 0x6d4]
call fcn.004182c0
lea ecx, [esp + 0x118]
call fcn.00411370
lea ecx, [esp + 0x8c8]
call fcn.00414930
lea ecx, [esp + 0x550]
call fcn.004182c0
lea ecx, [esp + 0x568]
call fcn.004182c0
lea ecx, [esp + 0x658]
call fcn.004182c0
lea ecx, [esp + 0x4f0]
call fcn.004182c0
lea ecx, [esp + 0x3d0]
call fcn.004182c0
lea ecx, [esp + 0x3e8]
call fcn.004182c0
lea ecx, [esp + 0x628]
call fcn.004182c0
lea ecx, [esp + 0x400]
call fcn.004182c0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1f78]
xor ecx, esp
call fcn.0049d991
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0xd18]
mov ecx, 0x104
call fcn.00409b20
push str.weiduan.exe
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad9bd
add esp, 0xc
lea ecx, [esp + 0x388]
push 0
push 0x4e8120
call fcn.00417f20
push eax
push 0
lea eax, [esp + 0x378]
push eax
lea ecx, [esp + 0x394]
call fcn.00417ec0
lea ecx, [esp + 0x4c0]
call fcn.00418030
test al, al
jne 0x40f126
lea eax, [esp + 0x4c0]
push eax
lea ecx, [esp + 0x374]
call fcn.00418290
push 0x4e7adc
lea ecx, [esp + 0x834]
call fcn.00408af0
push eax
push 0x4e8124
lea edx, [esp + 0x37c]
lea ecx, [esp + 0x710]
call fcn.00405d80
push eax
mov edx, 0x4e7adc
lea ecx, [esp + 0x858]
call fcn.0041c6b0
add esp, 4
lea ecx, [esp + 0x800]
mov edx, eax
call fcn.0041bfa0
add esp, 4
lea ecx, [esp + 0x678]
mov edx, eax
call fcn.0041c010
add esp, 4
lea ecx, [esp + 0x4dc]
mov edx, eax
call fcn.0041bfa0
add esp, 4
lea ecx, [esp + 0x670]
call fcn.00417cd0
lea ecx, [esp + 0x7f4]
call fcn.00417cd0
lea ecx, [esp + 0x848]
call fcn.00417cd0
lea ecx, [esp + 0x704]
call fcn.00417cd0
lea ecx, [esp + 0x830]
call fcn.00417cd0
lea ecx, [esp + 0xd18]
call fcn.00404650
test al, al
je 0x40f753
lea edx, [esp + 0xaf8]
lea ecx, [esp + 0xd18]
call fcn.004040c0
test al, al
jne 0x40f3c8
push 0x4e812c
lea ecx, [esp + 0x7f8]
call fcn.00411e60
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e8150
lea ecx, [esp + 0x674]
call fcn.00411e60
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Unable_to_open_the_specified_file_to_calculate_its_MD5_hash_value.
lea ecx, [esp + 0x91c]
call fcn.00411d80
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x40f2a2
lea ecx, [esp + 0x670]
call fcn.00411e20
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x674]
jmp 0x40f309
cmp eax, 3
jne 0x40f2dc
lea ecx, [esp + 0x918]
call fcn.00411d30
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x920]
call fcn.004116b0
jmp 0x40f30f
lea ecx, [esp + 0x7f4]
call fcn.00411e20
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x7f8]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x4d8]
call fcn.00417cd0
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.00417cd0
lea ecx, [esp + 0x28]
call fcn.004175c0
lea ecx, [esp + 0x7c4]
call fcn.004182c0
lea ecx, [esp + 0x794]
call fcn.004182c0
lea ecx, [esp + 0x7ac]
call fcn.004182c0
lea ecx, [esp + 0x1c]
call fcn.004171f0
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
jmp 0x40eb83
lea edx, [esp + 0xae8]
lea ecx, [esp + 0x5c8]
call fcn.00404260
test al, al
jne 0x40f5a8
push 0x4e81bc
lea ecx, [esp + 0x834]
call fcn.004159b0
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e81d0
lea ecx, [esp + 0x708]
call fcn.004159b0
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Conversion_of_the_mini_client_MD5_failed.
lea ecx, [esp + 0x674]
call fcn.00412220
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x40f482
lea ecx, [esp + 0x704]
call fcn.00415990
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x708]
jmp 0x40f4e9
cmp eax, 3
jne 0x40f4bc
lea ecx, [esp + 0x670]
call fcn.004121e0
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x678]
call fcn.004116b0
jmp 0x40f4ef
lea ecx, [esp + 0x830]
call fcn.00415990
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x834]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x4d8]
call fcn.00417cd0
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.00417cd0
lea ecx, [esp + 0x28]
call fcn.004175c0
lea ecx, [esp + 0x7c4]
call fcn.004182c0
lea ecx, [esp + 0x794]
call fcn.004182c0
lea ecx, [esp + 0x7ac]
call fcn.004182c0
lea ecx, [esp + 0x1c]
call fcn.004171f0
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
jmp 0x40eb83
lea ecx, [esp + 0xaf8]
mov esi, 0xc
lea edx, [esp + 0xae8]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40f5d5
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40f5c0
xor eax, eax
jmp 0x40f5fc
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40f5f7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40f5f7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40f5f7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x40f5f7
xor eax, eax
jmp 0x40f5fc
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f680
lea eax, [esp + 0xd18]
push eax
lea ecx, [esp + 0x674]
call fcn.00417dc0
lea edx, [esp + 0x358]
mov ecx, eax
call fcn.00408240
lea ecx, [esp + 0x670]
mov bl, al
call fcn.00417cd0
test bl, bl
je 0x40f653
mov ecx, dword [esp + 0x358]
call fcn.004083b0
test al, al
je 0x40f653
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
mov ecx, dword [esp + 0x5c]
push 1
push 1
lea edx, [esp + 0xd38]
call fcn.004073b0
add esp, 0x20
test eax, eax
je 0x40f6a3
lea ecx, [esp + 0x4d8]
call fcn.00417b60
push eax
push 1
mov edx, 1
lea ecx, [esp + 0xd20]
call fcn.004038b0
add esp, 8
lea ecx, [esp + 0x4d8]
call fcn.00417cd0
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.00417cd0
lea ecx, [esp + 0x28]
call fcn.004175c0
lea ecx, [esp + 0x7c4]
call fcn.004182c0
lea ecx, [esp + 0x794]
call fcn.004182c0
lea ecx, [esp + 0x7ac]
call fcn.004182c0
lea ecx, [esp + 0x1c]
call fcn.004171f0
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
jmp 0x40eee7
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0xd30]
push 1
push 1
call fcn.004073b0
add esp, 0x20
test eax, eax
jne 0x40f680
lea edx, [esp + 0xd18]
mov ecx, 0x104
call fcn.00409b20
push str..exe
push ecx
mov edx, 6
lea ecx, [esp + 0x850]
call fcn.00405b30
add esp, 4
lea ecx, [esp + 0x7f8]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x670]
mov edx, eax
call fcn.00405d80
mov ecx, eax
call fcn.00417b60
push eax
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.004ad9bd
add esp, 0xc
lea ecx, [esp + 0x670]
call fcn.00417cd0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
mov ecx, 0x84
jmp 0x40f669
lea eax, [esp + 0xc10]
push eax
push str.Unable_to_create_and_write_to_file:__s_n
call fcn.0042aeb0
add esp, 8
push 0x10
push 0x4e7a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Error1:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x968]
call fcn.00411500
lea ecx, [esp + 0x7dc]
jmp 0x40f337
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x704]
push 0x4e82ec
call fcn.00415fe0
push 0x4e8304
lea ecx, [esp + 0xa54]
call fcn.00411960
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e833c
lea ecx, [esp + 0x4dc]
call fcn.00415fe0
push 0x4e8354
lea ecx, [esp + 0xa1c]
call fcn.00411960
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x91c]
call fcn.00411890
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
lea ecx, [esp + 0x96c]
call fcn.00411f30
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
lea ecx, [esp + 0x3a0]
call fcn.00418540
lea ecx, [esp + 0x370]
call fcn.00418540
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x40f9f0
lea ecx, [esp + 0x4d8]
call fcn.00415fc0
lea ecx, [esp + 0xa18]
call fcn.00411920
lea ecx, [esp + 0x360]
call fcn.00416140
lea ecx, [esp + 0xa18]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x4e0]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x360]
jmp 0x40fb5b
cmp eax, 3
jne 0x40faaf
lea ecx, [esp + 0x918]
call fcn.00411850
lea ecx, [esp + 0x968]
call fcn.00411ee0
lea ecx, [esp + 0x368]
call fcn.00416100
lea ecx, [esp + 0x968]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x920]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x368]
call fcn.004116b0
jmp 0x40fb60
lea ecx, [esp + 0x704]
call fcn.00415fc0
lea ecx, [esp + 0xa50]
call fcn.00411920
lea ecx, [esp + 0x358]
call fcn.00416140
lea ecx, [esp + 0xa50]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x70c]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x358]
call fcn.004116b0
push eax
lea ecx, [esp + 0x374]
call fcn.00418260
push 0x135
lea ecx, [esp + 0x374]
call fcn.004180d0
push eax
lea ecx, [esp + 0x3a8]
call fcn.004180d0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
je 0x40fbbd
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea eax, [esp + 0xc10]
push eax
call fcn.004ad094
add esp, 4
call fcn.0040c130
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Failed_to_release_excat1.exe_error__n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x830]
push 0x4e82ec
call fcn.00415fe0
push 0x4e8304
lea ecx, [esp + 0xa1c]
call fcn.00411960
push 0x4e7a38
lea ecx, [esp + 0x36c]
call fcn.00416150
push 0x4e833c
lea ecx, [esp + 0x708]
call fcn.00415fe0
push 0x4e8354
lea ecx, [esp + 0xa54]
call fcn.00411960
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x91c]
call fcn.00411890
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
lea ecx, [esp + 0x96c]
call fcn.00411f30
push str.Error
lea ecx, [esp + 0x82c]
call fcn.00416120
lea ecx, [esp + 0x3a0]
call fcn.00418540
lea ecx, [esp + 0x370]
call fcn.00418540
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x40fd57
lea ecx, [esp + 0x704]
call fcn.00415fc0
lea ecx, [esp + 0xa50]
call fcn.00411920
lea ecx, [esp + 0x360]
call fcn.00416140
lea ecx, [esp + 0xa50]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x70c]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x360]
jmp 0x40fec2
cmp eax, 3
jne 0x40fe16
lea ecx, [esp + 0x918]
call fcn.00411850
lea ecx, [esp + 0x968]
call fcn.00411ee0
lea ecx, [esp + 0x828]
call fcn.00416100
lea ecx, [esp + 0x968]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x920]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x828]
call fcn.004116b0
jmp 0x40fec7
lea ecx, [esp + 0x830]
call fcn.00415fc0
lea ecx, [esp + 0xa18]
call fcn.00411920
lea ecx, [esp + 0x368]
call fcn.00416140
lea ecx, [esp + 0xa18]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x838]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x368]
call fcn.004116b0
push eax
lea ecx, [esp + 0x374]
call fcn.00418260
push 0x135
lea ecx, [esp + 0x374]
call fcn.004180d0
push eax
lea ecx, [esp + 0x3a8]
call fcn.004180d0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
je 0x40ff30
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
lea ecx, [esp + 0x4d8]
call fcn.00417cd0
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea eax, [esp + 0xc10]
jmp 0x40fbc4
push 0x4e846c
lea ecx, [esp + 0x708]
call fcn.00415920
push 0x4e7a38
lea ecx, [esp + 0x364]
call fcn.00416150
lea ecx, [esp + 0x704]
call fcn.00415900
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
push eax
lea ecx, [esp + 0x70c]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x968]
call fcn.00411500
lea ecx, [esp + 0x7dc]
jmp 0x40f337
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xad8]
lea ecx, [esp + 0x1128]
call fcn.004040c0
test al, al
jne 0x41010b
push 0x4e812c
lea ecx, [esp + 0x7f8]
call fcn.00411e60
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e8150
lea ecx, [esp + 0x674]
call fcn.00411e60
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Unable_to_open_the_specified_file_to_calculate_its_MD5_hash_value.
lea ecx, [esp + 0x91c]
call fcn.00411d80
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x410076
lea ecx, [esp + 0x670]
call fcn.00411e20
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x674]
jmp 0x4100f0
cmp eax, 3
jne 0x4100c3
lea ecx, [esp + 0x918]
call fcn.00411d30
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x920]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea ecx, [esp + 0x7f4]
call fcn.00411e20
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x7f8]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea edx, [esp + 0xac8]
lea ecx, [esp + 0x598]
call fcn.00404260
test al, al
jne 0x41025d
push 0x4e8434
lea ecx, [esp + 0x834]
call fcn.00411800
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e8444
lea ecx, [esp + 0x708]
call fcn.00411800
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Conversion_MD5_failed.
lea ecx, [esp + 0x4dc]
call fcn.00411770
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x4101c8
lea ecx, [esp + 0x704]
call fcn.004117f0
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x708]
jmp 0x410242
cmp eax, 3
jne 0x410215
lea ecx, [esp + 0x4d8]
call fcn.00411750
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x4e0]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea ecx, [esp + 0x830]
call fcn.004117f0
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x834]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea ecx, [esp + 0xad8]
mov esi, 0xc
lea edx, [esp + 0xac8]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x410285
add ecx, 4
add edx, 4
sub esi, 4
jae 0x410270
xor eax, eax
jmp 0x4102ac
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4102a7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4102a7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4102a7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4102a7
xor eax, eax
jmp 0x4102ac
sbb eax, eax
or eax, 1
test eax, eax
je 0x410887
lea edx, [esp + 0x1128]
lea ecx, [esp + 0x4d8]
call fcn.00404390
lea edx, [esp + 0x358]
lea ecx, [esp + 0x4d8]
call fcn.00408240
test al, al
je 0x4102f9
mov ecx, dword [esp + 0x358]
call fcn.004083b0
test al, al
je 0x4102f9
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
push 1
mov edx, 0x4e7e88
lea ecx, [esp + 0x464]
call fcn.0041c710
mov ecx, dword [esp + 0x844]
lea edx, [esp + 0x1144]
movzx eax, al
push eax
call fcn.004073b0
add esp, 0x20
test eax, eax
jne 0x4104ec
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4e8304
call esi
mov edx, eax
lea ecx, [esp + 0x7f8]
call fcn.004031e0
push eax
mov edx, 0x4e82ec
lea ecx, [esp + 0x678]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x3a4]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
push 0x4e7a38
lea ecx, [esp + 0x374]
call fcn.004183e0
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x41042a
push 0x4e8354
call esi
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
mov edx, 0x4e833c
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
push 0x4e7a40
jmp 0x4104a4
cmp eax, 3
jne 0x4104b0
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
call esi
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
mov edx, str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
push str.Error
lea ecx, [esp + 0x374]
call fcn.00418260
push 0x135
lea ecx, [esp + 0x374]
call fcn.004180d0
push eax
lea ecx, [esp + 0x3a8]
call fcn.004180d0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x40ff00
lea eax, [esp + 0xc10]
jmp 0x40fbc4
push str.Released_excat1.exe_successfully._n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x4d8]
call fcn.00417cd0
jmp 0x410887
sub esp, 0x18
lea eax, [esp + 0x3d0]
mov ecx, esp
push eax
call fcn.00417e10
push 1
mov edx, 0x4e7e88
lea ecx, [esp + 0x464]
call fcn.0041c710
mov ecx, dword [esp + 0x844]
lea edx, [esp + 0x1144]
movzx eax, al
push eax
call fcn.004073b0
add esp, 0x20
test eax, eax
jne 0x41087a
push 0x4e82ec
lea ecx, [esp + 0x708]
call fcn.00415fe0
push 0x4e8304
lea ecx, [esp + 0xa1c]
call fcn.00411960
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e833c
lea ecx, [esp + 0x4dc]
call fcn.00415fe0
push 0x4e8354
lea ecx, [esp + 0xa54]
call fcn.00411960
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push str.Qianniaodun_Shield_protection_program_failed_to_start__
lea ecx, [esp + 0x91c]
call fcn.00411890
push str.___please_check_if_its_being_blocked._nIf_there_is_a_prompt_about_blocking__please_click_trust_or_agree.
lea ecx, [esp + 0x96c]
call fcn.00411f30
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
lea ecx, [esp + 0x3a0]
call fcn.00418540
lea ecx, [esp + 0x370]
call fcn.00418540
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x4106c1
lea ecx, [esp + 0x4d8]
call fcn.00415fc0
lea ecx, [esp + 0xa50]
call fcn.00411920
lea ecx, [esp + 0x360]
call fcn.00416140
lea ecx, [esp + 0xa50]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x4e0]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x360]
jmp 0x41082c
cmp eax, 3
jne 0x410780
lea ecx, [esp + 0x918]
call fcn.00411850
lea ecx, [esp + 0x968]
call fcn.00411ee0
lea ecx, [esp + 0x368]
call fcn.00416100
lea ecx, [esp + 0x968]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x920]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x368]
call fcn.004116b0
jmp 0x410831
lea ecx, [esp + 0x704]
call fcn.00415fc0
lea ecx, [esp + 0xa18]
call fcn.00411920
lea ecx, [esp + 0x358]
call fcn.00416140
lea ecx, [esp + 0xa18]
call fcn.004116b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x84c]
call fcn.004031e0
push eax
lea ecx, [esp + 0x70c]
call fcn.004116b0
mov edx, eax
lea ecx, [esp + 0x7fc]
call fcn.0041c7a0
add esp, 4
lea ecx, [esp + 0x674]
mov edx, eax
call fcn.0041bdb0
add esp, 4
lea ecx, [esp + 0x3a0]
push eax
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
lea ecx, [esp + 0x7f4]
call fcn.004182c0
lea ecx, [esp + 0x848]
call fcn.004182c0
lea ecx, [esp + 0x358]
call fcn.004116b0
push eax
lea ecx, [esp + 0x374]
call fcn.00418260
push 0x135
lea ecx, [esp + 0x374]
call fcn.004180d0
push eax
lea ecx, [esp + 0x3a8]
call fcn.004180d0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x40fb99
lea eax, [esp + 0xc10]
jmp 0x40fbc4
push str.Released_excat1.exe_successfully._n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x1330]
call fcn.0040c100
mov edx, 0x10
lea ecx, [esp + 0x670]
call fcn.00405b30
push eax
mov ecx, 0x4f2f70
call fcn.00418310
lea ecx, [esp + 0x670]
call fcn.004182c0
mov ecx, 0x4f2f70
call fcn.004180d0
push eax
lea eax, [esp + 0xb0c]
push eax
push str.___file___s____debug__s
lea eax, [esp + 0x1d7c]
push 0x104
push eax
call fcn.0042ae40
add esp, 0x14
lea eax, [esp + 0x1d70]
mov edx, 1
lea ecx, [esp + 0x1330]
push eax
push 1
call fcn.00403950
add esp, 8
lea ecx, [esp + 0xf20]
call fcn.00404650
test al, al
jne 0x4109d7
sub esp, 0x18
mov ecx, esp
push 0x4e79ec
call fcn.00417dc0
push 0
mov edx, 0x4e7e84
lea ecx, [esp + 0x464]
call fcn.0041ca40
mov ecx, dword [esp + 0x384]
lea edx, [esp + 0xf3c]
movzx eax, al
push eax
call fcn.004073b0
add esp, 0x20
test eax, eax
jne 0x4109c5
push str.release_excat222.exe2333_error__n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x670]
push str.release_excat2.exe_error
call fcn.004116e0
push 0x4e7a38
lea ecx, [esp + 0x364]
call fcn.00416150
lea ecx, [esp + 0x670]
call fcn.004116c0
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
push eax
lea ecx, [esp + 0x678]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x7dc]
jmp 0x40f337
push str.run_excat2.exe_ok__n
call fcn.0042aeb0
add esp, 4
jmp 0x410b02
lea edx, [esp + 0xab8]
lea ecx, [esp + 0xf20]
call fcn.004040c0
test al, al
je 0x40ffd4
lea edx, [esp + 0xaa8]
lea ecx, [esp + 0x610]
call fcn.00404260
test al, al
je 0x410126
lea ecx, [esp + 0xab8]
mov esi, 0xc
lea edx, [esp + 0xaa8]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x410a35
add ecx, 4
add edx, 4
sub esi, 4
jae 0x410a20
xor eax, eax
jmp 0x410a5c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x410a57
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x410a57
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x410a57
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x410a57
xor eax, eax
jmp 0x410a5c
sbb eax, eax
or eax, 1
test eax, eax
je 0x410b02
lea edx, [esp + 0xf20]
lea ecx, [esp + 0x370]
call fcn.00404390
lea edx, [esp + 0x358]
lea ecx, [esp + 0x370]
call fcn.00408240
test al, al
je 0x410aa9
mov ecx, dword [esp + 0x358]
call fcn.004083b0
test al, al
je 0x410aa9
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov ecx, esp
push 0x4e79ec
call fcn.00417dc0
push 0
mov edx, 0x4e7e84
lea ecx, [esp + 0x464]
call fcn.0041ca40
mov ecx, dword [esp + 0x384]
lea edx, [esp + 0xf3c]
movzx eax, al
push eax
call fcn.004073b0
add esp, 0x20
test eax, eax
je 0x410af6
push str.Re_released_excat1.exe_due_to_size_mismatch._n
call fcn.0042aeb0
add esp, 4
lea ecx, [esp + 0x370]
call fcn.00417cd0
lea edx, [esp + 0x1128]
lea ecx, [esp + 0x670]
call fcn.00404390
push eax
mov ecx, 0x4f2f28
call fcn.00417d30
lea ecx, [esp + 0x670]
call fcn.00417cd0
lea eax, [esp + 0x1438]
mov ecx, 0x4f2f40
push eax
call fcn.00417ca0
xor ecx, ecx
mov al, byte [esp + ecx + 0xb08]
lea ecx, [ecx + 1]
mov byte [ecx + 0x4f5777], al
test al, al
jne 0x410b40
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0xf20]
call fcn.00404650
test al, al
je 0x410b7b
lea ecx, [esp + 0xf20]
call fcn.00407380
mov edx, 0x4e7e88
lea ecx, [esp + 0x538]
call fcn.0041c710
lea ecx, [esp + 0xf20]
mov edx, 1
push 0
push 2
test al, al
je 0x410ba7
call fcn.00403830
jmp 0x410bac
call fcn.004038b0
add esp, 8
lea ecx, [esp + 0xf20]
call fcn.00404650
test al, al
je 0x410cc9
mov edx, 0x4e7e88
lea ecx, [esp + 0x5f8]
call fcn.0041c710
test al, al
je 0x410cc9
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0xf20]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call edi
mov esi, eax
test esi, esi
jle 0x410cc9
lea ecx, [esp + 0x3f]
call fcn.004116b0
push eax
push esi
lea ecx, [esp + 0x70c]
call fcn.00411620
push 0
push 0
push esi
push 0
lea ecx, [esp + 0x714]
call fcn.004115a0
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xf34]
push eax
push 0
push 0
call edi
test eax, eax
jle 0x410cbd
push 1
lea eax, [esp + 0x364]
push eax
lea eax, [esp + 0x360]
push eax
lea ecx, [esp + 0x710]
call fcn.004115b0
mov ecx, eax
call fcn.00411590
mov edi, eax
lea ecx, [esp + 0x704]
lea eax, [esp + 0x368]
push eax
call fcn.004115c0
lea ecx, [esp + 0x3f]
mov esi, eax
call fcn.004116b0
push eax
push dword [edi]
lea ecx, [esp + 0x378]
push dword [esi]
call fcn.0041cdb0
lea ecx, [esp + 0x370]
call fcn.004180d0
mov ecx, eax
call fcn.0040c100
lea ecx, [esp + 0x370]
call fcn.004182c0
lea ecx, [esp + 0x704]
call fcn.004115d0
lea ecx, [esp + 0x7dc]
jmp 0x40f6c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_temp_path:_Error__d_n
call fcn.0042aee0
add esp, 8
lea ecx, [esp + 0x7dc]
jmp 0x40f337
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7dec
call fcn.0042aeb0
add esp, 8
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea eax, [esp + 0xc10]
push eax
push str.Unable_to_create_and_write_to_file:__s_n
call fcn.0042aeb0
add esp, 8
push 0x10
push 0x4e7a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Error1:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x968]
call fcn.00411500
lea ecx, [esp + 0x1f0]
call fcn.004047e0
lea ecx, [esp + 0x3a0]
call fcn.004182c0
lea ecx, [esp + 0x2a8]
call fcn.004047e0
lea ecx, [esp + 0xd18]
call fcn.0040c070
lea ecx, [esp + 0x7dc]
jmp 0x40f337
lea eax, [esp + 0xc10]
push eax
push str.Unable_to_read_from_existing_file:__s_n
call fcn.0042aeb0
add esp, 8
push 0x10
push 0x4e7a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.Error2:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0xd18]
call fcn.0040c070
lea ecx, [esp + 0x7dc]
jmp 0x40f337
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7dec
call fcn.0042aeb0
add esp, 8
jmp 0x40f351
push 0x4e7fa8
lea ecx, [esp + 0x7f8]
call fcn.00412000
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e7fdc
lea ecx, [esp + 0x674]
call fcn.00412000
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push 0x4e8010
lea ecx, [esp + 0x96c]
call fcn.00411f30
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x410e8d
lea ecx, [esp + 0x670]
call fcn.00411fc0
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x674]
jmp 0x410ef4
cmp eax, 3
jne 0x410ec7
lea ecx, [esp + 0x968]
call fcn.00411ee0
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x970]
call fcn.004116b0
jmp 0x410efa
lea ecx, [esp + 0x7f4]
call fcn.00411fc0
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x7f8]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
call fcn.004171f0
lea ecx, [esp + 0x734]
call fcn.004182c0
lea ecx, [esp + 0x6ec]
call fcn.004182c0
lea ecx, [esp + 0x10]
call fcn.004171f0
lea ecx, [esp + 0x74c]
call fcn.004182c0
lea ecx, [esp + 0x77c]
call fcn.004182c0
lea ecx, [esp + 0x764]
call fcn.00417cd0
lea ecx, [esp + 0x71c]
call fcn.00417cd0
lea ecx, [esp + 0x640]
call fcn.004182c0
lea ecx, [esp + 0x418]
call fcn.00417cd0
lea ecx, [esp + 0xd0]
call fcn.00413ea0
lea ecx, [esp + 0xd0]
call fcn.004143d0
lea ecx, [esp + 0x878]
call fcn.00414930
lea ecx, [esp + 0x430]
call fcn.004182c0
lea ecx, [esp + 0x580]
call fcn.004182c0
lea ecx, [esp + 0x598]
call fcn.004182c0
lea ecx, [esp + 0x5b0]
call fcn.004182c0
lea ecx, [esp + 0x4c0]
call fcn.004182c0
lea ecx, [esp + 0x4a8]
call fcn.004182c0
lea ecx, [esp + 0x5c8]
call fcn.004182c0
lea ecx, [esp + 0x5e0]
call fcn.004182c0
lea ecx, [esp + 0x3b8]
call fcn.00417cd0
lea ecx, [esp + 0x5f8]
call fcn.004182c0
lea ecx, [esp + 0x610]
call fcn.004182c0
lea ecx, [esp + 0x448]
call fcn.004182c0
lea ecx, [esp + 0x460]
call fcn.004182c0
lea ecx, [esp + 0x478]
call fcn.004182c0
lea ecx, [esp + 0x508]
call fcn.004182c0
lea ecx, [esp + 0x520]
call fcn.004182c0
lea ecx, [esp + 0x538]
call fcn.004182c0
lea ecx, [esp + 0x490]
call fcn.004182c0
lea ecx, [esp + 0x388]
call fcn.004182c0
lea ecx, [esp + 0x6a4]
call fcn.004182c0
lea ecx, [esp + 0x6bc]
call fcn.004182c0
lea ecx, [esp + 0x6d4]
call fcn.004182c0
lea ecx, [esp + 0x188]
call fcn.00413ea0
lea ecx, [esp + 0x188]
call fcn.004143d0
lea ecx, [esp + 0x8c8]
call fcn.00414930
lea ecx, [esp + 0x550]
call fcn.004182c0
lea ecx, [esp + 0x568]
call fcn.004182c0
lea ecx, [esp + 0x658]
call fcn.004182c0
lea ecx, [esp + 0x4f0]
call fcn.004182c0
lea ecx, [esp + 0x3d0]
call fcn.004182c0
lea ecx, [esp + 0x3e8]
call fcn.004182c0
lea ecx, [esp + 0x628]
call fcn.004182c0
lea ecx, [esp + 0x400]
call fcn.004182c0
mov ecx, dword [esp + 0x1f84]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049d991
mov esp, ebp
pop ebp
ret 0x10
push 0x4e7f0c
lea ecx, [esp + 0x7f8]
call fcn.00412170
push 0x4e7a38
lea ecx, [esp + 0x35c]
call fcn.00416150
push 0x4e7f2c
lea ecx, [esp + 0x674]
call fcn.00412170
push 0x4e7a40
lea ecx, [esp + 0x364]
call fcn.00416150
push 0x4e7f4c
lea ecx, [esp + 0x84c]
call fcn.004120c0
push str.Error
lea ecx, [esp + 0x36c]
call fcn.00416120
mov eax, dword [0x4f5a7c]
cmp eax, 2
jne 0x4111f2
lea ecx, [esp + 0x670]
call fcn.00412150
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
lea ecx, [esp + 0x674]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f372
cmp eax, 3
jne 0x411238
lea ecx, [esp + 0x848]
call fcn.00412080
lea ecx, [esp + 0x368]
call fcn.00416100
push 0x10
lea ecx, [esp + 0x36c]
call fcn.004116b0
push eax
lea ecx, [esp + 0x850]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f372
lea ecx, [esp + 0x7f4]
call fcn.00412150
lea ecx, [esp + 0x358]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x35c]
call fcn.004116b0
lea ecx, [esp + 0x7f8]
push eax
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f372
mov edx, str.Unable_to_open_the_param_file_for_reading.
mov ecx, 0x4f46d0
call fcn.0041c170
push eax
call fcn.0041c990
add esp, 4
lea ecx, [esp + 0x670]
push str.Unable_to_open_the_param_file_for_reading
call fcn.00412220
push 0x4e7a38
lea ecx, [esp + 0x364]
call fcn.00416150
lea ecx, [esp + 0x670]
call fcn.004121e0
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea eax, [esp + 0x364]
push eax
lea eax, [esp + 0x678]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x410f69
push fcn.0041c990
push ecx
mov edx, str.Unable_to_open_the_param_file_for_reading.
mov ecx, 0x4f46d0
call fcn.0041c170
add esp, 4
mov ecx, eax
call fcn.00417150
push str.Unable_to_open_the_versionfile_file_for_reading
lea ecx, [esp + 0x674]
call fcn.004122e0
push 0x4e7a38
lea ecx, [esp + 0x364]
call fcn.00416150
lea ecx, [esp + 0x670]
call fcn.004122a0
lea ecx, [esp + 0x360]
call fcn.00416140
push 0x10
lea ecx, [esp + 0x364]
call fcn.004116b0
push eax
lea ecx, [esp + 0x678]
call fcn.004116b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ca5a