Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path
Write file on windows

Disassembly:
push 0x108
push 0
push 0x40e3a0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3a4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3a0], eax
call section..text
call fcn.0040abe0
call fcn.0040aa8c
call fcn.00408fb3
call fcn.00408ae3
call fcn.00408490
call fcn.00408119
call fcn.00407f50
call fcn.00407f32
call fcn.00407ea9
call fcn.00407611
call fcn.00406640
call fcn.00405851
call fcn.004055e9
call fcn.00404c35
call fcn.004048ad
push dword [0x40e4a0]
call fcn.00405608
push 7
push 0x40d244
lea eax, [0x40e4a0]
push eax
push 8
call fcn.00405557
push 0x40e498
push 0x40d24c
push 7
push 0x401
push 8
call fcn.0040a98d
mov edx, str.Continue_
lea ecx, [0x40e3b8]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e480]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e3e4]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e42c]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e454]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e430]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e3bc]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e3d0]
call fcn.00404068
mov edx, 0x40d01e
lea ecx, [0x40e428]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40e468]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40e450]
call fcn.00404068
mov edx, str.Password
lea ecx, [0x40e46c]
call fcn.00404068
mov edx, str.Please_enter_the_password.
lea ecx, [0x40e400]
call fcn.00404068
call fcn.004063ff
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40e468]
push dword [0x40e480]
call fcn.004048e4
jmp 0x4020f3
lea eax, [0x403274]
push eax
call fcn.00405370
call fcn.00404d73
mov dword [0x40e45c], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e40c], eax
mov edx, dword [0x40e778]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407f80
push 0x40e458
call fcn.0040ac60
push dword [0x40e458]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x40e45c]
and ebx, ebx
jle 0x401333
mov dword [0x40e3e8], 0
mov ebx, dword [0x40e45c]
dec ebx
cmp ebx, dword [0x40e3e8]
jl 0x4012b6
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e3e8]
call fcn.00404d25
push 0x40e444
call fcn.0040ac60
push dword [0x40e444]
mov edx, str._b2epass
pop ecx
call fcn.0040ace0
je 0x40127a
mov dword [0x40e3dc], 1
jmp 0x4012aa
mov ebx, dword [0x40e3dc]
cmp ebx, 1
jne 0x4012aa
mov edx, dword [0x40e444]
push dword [0x40e778]
call fcn.0040ad10
push 0x40e474
call fcn.0040ac60
mov dword [0x40e3dc], 0
inc dword [0x40e3e8]
jno 0x40122f
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407f80
inc dword [0x40e778]
mov edx, dword [0x40d304]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e778]
push eax
call fcn.00407f80
push 0x40e404
call fcn.0040ac60
mov edx, dword [0x40e458]
push dword [0x40e778]
call fcn.0040ad10
mov edx, 0x40d01f
call fcn.0040ad10
mov edx, dword [0x40e404]
call fcn.0040ad10
push 0x40e404
call fcn.0040ac60
jmp 0x40134e
mov edx, dword [0x40e458]
push dword [0x40e778]
call fcn.0040ad10
push 0x40e404
call fcn.0040ac60
push 0x40d04b
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x401379
mov eax, dword [0x40e3ac]
mov dword [0x40e43c], eax
push dword [0x40e43c]
call fcn.004032ed
jmp 0x4013e1
push 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x40e3f8], eax
push dword [0x40e778]
mov edx, str.Error:
call fcn.0040ad10
mov edx, dword [0x40e778]
push edx
push edx
call fcn.004053f0
pop eax
push 0x40e494
call fcn.0040ac60
push 0
push 0x40e3e8
push dword [0x40e494]
call fcn.004040d0
push eax
mov eax, dword [0x40e494]
push eax
push dword [0x40e3f8]
call sub.KERNEL32.dll_WriteFile
push 0x63
jmp 0x4020f8
push str.NOPSX
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x40141a
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e3c0]
push dword [0x40e3ac]
call fcn.00407fd0
push 0x40e424
call fcn.0040ac60
jmp 0x401482
push 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x40e3f8], eax
push dword [0x40e778]
mov edx, str.Error:
call fcn.0040ad10
mov edx, dword [0x40e778]
push edx
push edx
call fcn.004053f0
pop eax
push 0x40e494
call fcn.0040ac60
push 0
push 0x40e3e8
push dword [0x40e494]
call fcn.004040d0
push eax
mov eax, dword [0x40e494]
push eax
push dword [0x40e3f8]
call sub.KERNEL32.dll_WriteFile
push 0x63
jmp 0x4020f8
push 0x40d032
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x4014b6
mov eax, dword [0x40e3ac]
mov dword [0x40e3ec], eax
mov eax, dword [0x40e3c0]
mov dword [0x40e3b0], eax
mov eax, dword [0x40e3ec]
mov dword [0x40e464], eax
jmp 0x40151e
push 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x40e3f8], eax
push dword [0x40e778]
mov edx, str.Error:
call fcn.0040ad10
mov edx, dword [0x40e778]
push edx
push edx
call fcn.004053f0
pop eax
push 0x40e494
call fcn.0040ac60
push 0
push 0x40e3e8
push dword [0x40e494]
call fcn.004040d0
push eax
mov eax, dword [0x40e494]
push eax
push dword [0x40e3f8]
call sub.KERNEL32.dll_WriteFile
push 0x63
jmp 0x4020f8
push 0x40d038
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x401550
mov eax, dword [0x40e3ac]
mov dword [0x40e3f4], eax
mov eax, dword [0x40e3c0]
mov dword [0x40e3fc], eax
mov eax, dword [0x40e3f4]
mov dword [0x40e438], eax
push 0x40d036
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x401582
mov eax, dword [0x40e3ac]
mov dword [0x40e3f0], eax
mov eax, dword [0x40e3c0]
mov dword [0x40e3b4], eax
mov eax, dword [0x40e3f0]
mov dword [0x40e484], eax
push 0x40d04d
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x40181a
mov edx, dword [0x40e474]
xor ecx, ecx
call fcn.0040ace0
jne 0x4015c9
mov edx, dword [0x40e474]
push dword [0x40e778]
call fcn.0040ad10
push 0x40e44c
call fcn.0040ac60
jmp 0x40173d
push 0xc80001
push dword [0x40e46c]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00406950
push dword [0x40e400]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00405b33
push 0x20
push 0x40d01e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00405d0c
push 0x40d1ca
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00406019
push 4
push 0xd
push 0
call fcn.00406973
push 2
call fcn.00406039
call fcn.00406b77
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4016a9
push dword [0x40e47c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4020f8
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4016f1
call fcn.00408bac
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4016ee
mov edx, dword [0x40e778]
push edx
push edx
push 2
call fcn.00406074
push 0x40e44c
call fcn.0040ac60
push 0
call fcn.00406513
add esp, 8
jmp 0x40173d
pop eax
jmp 0x401737
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401737
call fcn.00408bbb
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401736
mov edx, dword [0x40e778]
push edx
push edx
push 2
call fcn.00406074
push 0x40e44c
call fcn.0040ac60
push 0
call fcn.00406513
add esp, 8
jmp 0x40173d
pop eax
pop eax
jmp 0x40167f
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e44c]
call fcn.00404100
push eax
mov eax, dword [0x40e44c]
push eax
call fcn.00409570
inc dword [0x40e778]
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e3c0]
push dword [0x40e3ac]
call fcn.00407fd0
pop edx
pop ecx
mov dword [0x40e778], ecx
add ecx, dword [0x40d304]
add edx, dword [0x40d304]
call fcn.0040ace0
jne 0x4017c1
push 0x10
push dword [0x40e454]
push dword [0x40e480]
call fcn.004048e4
push dword [0x40e47c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x4020f8
push 0x40d04f
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x4017df
mov eax, dword [0x40e3ac]
mov dword [0x40e460], eax
push dword [0x40e3b4]
push dword [0x40e3fc]
push dword [0x40e3b0]
push dword [0x40e460]
push dword [0x40e3f0]
push dword [0x40e3f4]
push dword [0x40e3ec]
push dword [0x40e44c]
push dword [0x40e40c]
call fcn.0040392b
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e3b0]
push dword [0x40e464]
call fcn.00407fd0
push 0x40e420
call fcn.0040ac60
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e3fc]
push dword [0x40e438]
call fcn.00407fd0
push 0x40e3d4
call fcn.0040ac60
push 0x40d034
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x401ad8
mov edx, dword [0x40e778]
push edx
push edx
push 0
call fcn.00404d25
inc dword [0x40e778]
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e3c0]
push dword [0x40e3ac]
call fcn.00407fd0
pop edx
pop ecx
mov dword [0x40e778], ecx
add ecx, dword [0x40d304]
add edx, dword [0x40d304]
call fcn.0040ace0
je 0x4018d6
mov ebx, dword [0x40e45c]
cmp ebx, 1
jne 0x4018d6
mov eax, 1
jmp 0x4018d8
xor eax, eax
and eax, eax
je 0x401ad8
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
call fcn.00408125
inc dword [0x40e778]
push dword [0x40e450]
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404957
push 0x40e3cc
call fcn.0040ac60
mov edx, dword [0x40e3cc]
xor ecx, ecx
call fcn.0040ace0
jne 0x401a86
mov edx, dword [0x40e3cc]
push dword [0x40e778]
call fcn.0040ad10
push 0x40e418
call fcn.0040ac60
push dword [0x40e418]
call fcn.00408165
mov edx, dword [0x40e3d4]
xor ecx, ecx
call fcn.0040ace0
jne 0x40196d
push dword [0x40e3d4]
call fcn.0040341b
push dword [0x40e424]
push 1
call fcn.00408700
and eax, eax
je 0x401a58
push 1
call fcn.00408410
push dword [0x40e778]
push 0x24
mov edx, dword [0x40e3bc]
push dword [0x40e778]
call fcn.0040ad10
mov edx, 0x40d021
call fcn.0040ad10
mov edx, dword [0x40e424]
call fcn.0040ad10
mov edx, 0x40d021
call fcn.0040ad10
mov edx, dword [0x40e3d0]
call fcn.0040ad10
inc dword [0x40e778]
push dword [0x40e430]
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.004048e4
pop dword [0x40e778]
mov dword [0x40e41c], eax
mov ebx, dword [0x40e41c]
cmp ebx, 7
jne 0x401a58
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call fcn.00404d86
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408177
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408165
pop dword [0x40e778]
push dword [0x40e47c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4020f8
push dword [0x40e424]
push 1
call fcn.00408630
and eax, eax
je 0x401a86
push dword [0x40e420]
push 1
call fcn.004087b0
push 1
call fcn.00408410
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call fcn.00404d86
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408177
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408165
pop dword [0x40e778]
push dword [0x40e47c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4020f8
push 0x40d051
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x401c14
push 0x400
call fcn.00408070
mov dword [0x40e408], eax
mov edx, dword [0x40e778]
push edx
push edx
call fcn.004081ed
push 0x40e48c
call fcn.0040ac60
push dword [0x40e408]
push 0
push 0x40d01e
push dword [0x40e48c]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e408]
call fcn.00407f80
push 0x40e478
call fcn.0040ac60
push dword [0x40e408]
call fcn.00408090
push dword [0x40e478]
call fcn.0040827c
push dword [0x40e478]
call fcn.0040828a
push dword [0x40e478]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x40e478]
push dword [0x40e778]
call fcn.0040ad10
mov edx, str.extd.exe
call fcn.0040ad10
push 0x40e414
call fcn.0040ac60
push dword [0x40e414]
push 0
call fcn.00408630
push dword [0x40e3c0]
push dword [0x40e3ac]
push 0
call fcn.00408830
push 0
call fcn.00408410
mov edx, dword [0x40e414]
push dword [0x40e778]
call fcn.0040ad10
push 0x40e410
call fcn.0040ac60
push dword [0x40e410]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x40e410]
push str.b2eextd
call fcn.00404de1
push str._call:extd
push str.extd
call fcn.00404de1
mov edx, dword [0x40e47c]
push dword [0x40e778]
call fcn.0040ad10
mov edx, str.BDFI
call fcn.0040ad10
mov edx, dword [0x40e424]
call fcn.0040ad10
push 0x40e424
call fcn.0040ac60
push dword [0x40e424]
push 1
call fcn.00408630
and eax, eax
je 0x401d49
push str._shift__0
push 1
call fcn.00408890
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407f80
inc dword [0x40e778]
mov edx, dword [0x40d304]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e778]
push eax
call fcn.00407f80
inc dword [0x40e778]
push 0x40d053
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404de1
pop dword [0x40e778]
push dword [0x40e420]
push 1
call fcn.00408890
push 0x40d051
push dword [0x40e40c]
call fcn.00403847
and eax, eax
je 0x401d3a
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
mov ebp, 0x40d301
mov ebx, ebp
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
sub ebx, ebp
push ebx
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
push ebp
call fcn.00407fd0
inc dword [0x40e778]
push 1
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00408890
pop dword [0x40e778]
push 1
call fcn.00408410
jmp 0x401dcc
push dword [0x40e424]
call fcn.0040827c
call fcn.00403bd8
push 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x40e3f8], eax
push dword [0x40e778]
mov edx, str.Error:
call fcn.0040ad10
mov edx, dword [0x40e778]
push edx
push edx
call fcn.004053f0
pop eax
push 0x40e494
call fcn.0040ac60
push 0
push 0x40e3e8
push dword [0x40e494]
call fcn.004040d0
push eax
mov eax, dword [0x40e494]
push eax
push dword [0x40e3f8]
call sub.KERNEL32.dll_WriteFile
push dword [0x40e47c]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0x63
jmp 0x4020f8
mov edx, dword [0x40e3d4]
xor ecx, ecx
call fcn.0040ace0
jne 0x401de6
push dword [0x40e3d4]
call fcn.0040341b
push 0x400
call fcn.00408070
mov dword [0x40e470], eax
mov edx, dword [0x40e778]
push edx
push edx
call fcn.004081ed
push 0x40e3c8
call fcn.0040ac60
push dword [0x40e470]
push 0
push 0x40d01e
push dword [0x40e3c8]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e470]
call fcn.00407f80
push 0x40e488
call fcn.0040ac60
mov edx, dword [0x40e778]
push edx
push edx
push 0x800
call fcn.00404130
push 0x40e440
call fcn.0040ac60
push dword [0x40e778]
push 0x800
push dword [0x40e440]
mov edx, dword [0x40e778]
push edx
push edx
call fcn.00404d86
inc dword [0x40e778]
mov edx, dword [0x40d304]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x40e778]
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call fcn.00404d86
inc dword [0x40e778]
push str.b2eprogramname
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404de1
pop dword [0x40e778]
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call fcn.00404d86
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.004083a8
inc dword [0x40e778]
push str.b2eprogramfilename
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404de1
pop dword [0x40e778]
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call fcn.00404d86
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408177
inc dword [0x40e778]
push str.b2eprogrampathname
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404de1
pop dword [0x40e778]
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
push dword [0x40e440]
call fcn.00404230
inc dword [0x40e778]
push str.b2eprogramshortname
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404de1
pop dword [0x40e778]
mov edx, dword [0x40e418]
push dword [0x40e778]
call fcn.0040ad10
push 0x40e490
call fcn.0040ac60
push dword [0x40e490]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x40e490]
push 0x40d03a
call fcn.00404de1
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
mov eax, dword [0x40e3c4]
cdq
push edx
push eax
call fcn.004043c0
inc dword [0x40e778]
push str.b2eincfilecount
mov edx, dword [0x40d304]
add dword [esp + 4], edx
call fcn.00404de1
pop dword [0x40e778]
push dword [0x40e488]
push str.b2etempfile
call fcn.00404de1
push 0x44
push dword [0x40e418]
push dword [0x40e404]
push dword [0x40e424]
call fcn.0040525d
mov dword [0x40e434], eax
push dword [0x40e434]
call fcn.00405277
mov ebx, eax
and ebx, ebx
jne 0x40204b
jmp 0x402057
push 5
call fcn.004064f2
jmp 0x402038
push dword [0x40e434]
call fcn.004052be
mov dword [0x40e3e0], eax
push dword [0x40e434]
call fcn.004052dc
call fcn.00403bd8
push dword [0x40e424]
call fcn.0040827c
push dword [0x40e488]
call fcn.0040827c
push dword [0x40e414]
call fcn.0040827c
mov edx, dword [0x40e778]
push edx
push edx
mov edx, dword [0x40e778]
push edx
push edx
push dword [0x40e778]
call fcn.00404d86
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408177
mov edx, dword [0x40d304]
add dword [esp], edx
call fcn.00408165
pop dword [0x40e778]
push dword [0x40e478]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x40e47c]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x40e3e0]
jmp 0x4020f8
push 0
call 0x402112
call fcn.0040ac30
push dword [0x40e3a0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405540
call fcn.004058c1
call fcn.00406629
call fcn.0040769f
call fcn.00407e9d
call fcn.004083ba
call fcn.00408480
call fcn.00408eae
call fcn.00407f70
ret