Function at 0x4014cf
Capabilities:
Copy file
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28c
mov eax, dword [esp + 0x2a0]
mov ecx, dword [0x40a008]
mov ecx, dword [ecx]
mov dword [esp + 4], ecx
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0xc]
lea eax, [esp + 0x10]
movups xmmword [eax - 4], xmm0
movups xmmword [eax + 8], xmm1
mov esi, dword [eax - 4]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
mov dword [0x419934], eax
lea eax, [esi - 2]
mov dword [esp], 0
cmp eax, 0x43
ja case.0x40153c.66
mov ecx, dword [0x40a174]
mov ecx, dword [ecx]
mov edx, ebx
shl edx, 0xb
add edx, ecx
mov edi, ebp
shl edi, 0xb
add edi, ecx
mov dword [esp], 0
jmp dword [eax*4 + 0x40a010]
mov dword [esp + 0x28], edx
mov ecx, 3
call fcn.0040320b
mov ebp, eax
mov ecx, 4
call fcn.0040320b
mov ebx, eax
mov eax, dword [esp + 0x24]
test al, 1
je 0x40157f
mov eax, dword [0x419934]
push dword [eax + 0xc]
push 0x4188f4
call fcn.00407492
mov ebp, eax
mov eax, dword [esp + 0x24]
test al, 2
je 0x401597
mov eax, dword [0x419934]
push dword [eax + 0x10]
push 0x4190f4
call fcn.00407492
mov ebx, eax
cmp dword [esp + 0xc], 0x21
jne 0x4028d6
xor ecx, ecx
inc ecx
call fcn.0040320b
mov esi, eax
mov ecx, 2
call fcn.0040320b
mov ecx, dword [esp + 0x24]
cmp ecx, 4
jae 0x402a28
push ebx
push ebp
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x3c], eax
xor edi, edi
jmp 0x402a46
mov eax, dword [esp + 0x18]
cmp esi, 0x38
sete bl
test eax, eax
mov dword [esp], eax
mov edi, edx
je 0x402942
xor ecx, ecx
inc ecx
call fcn.0040320b
xor ecx, ecx
cmp esi, 0x38
mov word [0x4178f4], ax
setne cl
inc ecx
jmp 0x402d0c
mov ecx, 2
mov esi, edx
call fcn.0040320b
mov dword [esp], 0
test eax, eax
jle case.0x40153c.66
mov ecx, esi
mov ebp, edi
mov edx, 0x3ff
cmp eax, edx
cmovl edx, eax
mov dword [esp + 4], edx
cmp word [esi], 0
je 0x402a63
mov edi, 2
push ecx
call fcn.004078e8
mov dword [esp], eax
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x2c], ebp
cmp dword [esp + 0xc], 0x39
jne 0x40171f
mov eax, 2
sub eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x40]
push ecx
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402fbb
mov edi, dword [esp + 0x3c]
test edi, edi
je 0x402fbb
movzx eax, byte [esp + 0x30]
mov word [esp + 8], ax
cmp dword [esp + 0x1c], 0
jne 0x402f3b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], esi
push 1
lea eax, [esp + 0xc]
push eax
push edi
lea eax, [esp + 0x3c]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401711
xor esi, esi
inc esi
sub esi, edi
mov word [esp + 8], 0xfffd
dec dword [esp + 0x3c]
je 0x401711
dec edi
xor ebx, ebx
inc ebx
push ebx
xor ebp, ebp
push ebp
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x3c]
push eax
push 8
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc esi
test eax, eax
je 0x4016d4
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
jmp 0x401752
mov eax, dword [esp + 0x1c]
or eax, esi
jne 0x40173a
push 0
push dword [esp + 4]
call fcn.004071f9
test eax, eax
js 0x4031d9
push 2
lea eax, [esp + 0xc]
push eax
push dword [esp + 8]
call fcn.00407195
test eax, eax
je 0x402fbb
cmp dword [esp + 0x1c], 0
jne 0x402f3b
cmp bx, 0xd
je 0x402ed1
movzx eax, bx
cmp eax, 0xa
je 0x402ed1
movzx ebx, word [esp + 8]
mov word [ebp + esi*2], bx
inc esi
test bx, bx
je 0x402fbb
cmp esi, dword [esp + 4]
jl 0x401658
jmp 0x402fbb
push edx
call fcn.004078e8
mov dword [esp], 0
test eax, eax
je case.0x40153c.66
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x403098
mov eax, dword [0x40a188]
and ebx, dword [eax]
push 0
push ebx
push 0xb
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x10], 0
mov dword [esp], 0
je case.0x40153c.66
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x40153c.66
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403228
mov esi, eax
push 0xffffffffffffffdf
call fcn.00403228
mov ebx, eax
mov eax, dword [0x419934]
push dword [eax + 8]
push 0x4170f4
call fcn.00407492
mov dword [esp + 4], eax
push 0xffffffffffffffcd
call fcn.00403228
mov dword [esp + 0x34], eax
mov eax, dword [0x419934]
push dword [eax + 0x14]
push 0x4190f4
call fcn.00407492
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
push ebx
call fcn.00406ecb
test eax, eax
jne 0x40186a
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4180f4
call fcn.00407492
lea eax, [esp + 0x3c]
mov ecx, dword [0x40a164]
mov edx, dword [0x40a15c]
push eax
push ecx
push 1
push 0
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
xor ebp, ebp
inc ebp
mov edi, 0xfffffff0
test eax, eax
js 0x402ff8
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 8]
mov esi, dword [0x40a160]
push edx
push esi
push eax
call dword [ecx]
mov edx, dword [esp + 0x3c]
mov ecx, dword [edx]
test eax, eax
js 0x402e61
mov ebp, dword [esp + 0x2c]
mov esi, ebp
shr esi, 0xc
and esi, 7
push ebx
push edx
call dword [ecx + 0x50]
mov ebx, eax
test bp, bp
js 0x4018ea
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [esp]
add edx, 0xb000
push edx
push eax
call dword [ecx + 0x24]
mov edi, ebp
shr edi, 0x10
test esi, esi
je 0x4018fe
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x34]
mov edx, dword [esp + 0x34]
cmp word [edx], 0
je 0x401925
and ebp, 0xfff
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push ebp
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push dword [esp + 4]
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push dword [esp + 0x28]
push eax
call dword [ecx + 0x1c]
test ebx, ebx
mov edx, dword [esp + 0x38]
js 0x402fd3
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov ebx, eax
shr ebx, 0x1f
jmp 0x402fd5
push 0x20019
mov esi, edx
call fcn.00403268
mov edi, eax
mov eax, dword [0x419934]
push dword [eax + 0xc]
push 0x4188f4
call fcn.00407492
mov word [esi], 0
test edi, edi
je 0x40302c
mov ebx, esi
lea ecx, [esp + 0x3c]
mov dword [ecx], 0x800
lea edx, [esp + 8]
push ecx
push esi
push edx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402e6a
mov word [ebx], 0
xor ebp, ebp
inc ebp
jmp 0x40307e
mov dword [esp + 0x28], edx
test byte [esp + 0x1d], 1
jne 0x402979
push dword [esp + 0x18]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x402983
mov esi, edx
push 0xffffffffffffffed
call fcn.00403228
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call fcn.004070f5
cmp eax, 0xffffffff
jne 0x402021
jmp 0x40283f
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp], eax
push dword [esp + 0x18]
push 0x4170f4
call fcn.00407492
mov esi, eax
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4178f4
call fcn.00407492
push eax
push ebx
call fcn.0040330f
test eax, eax
je 0x40302c
mov edi, eax
cmp ebp, 4
je 0x402f73
cmp ebp, 3
je 0x402f5c
xor eax, eax
cmp ebp, 1
jne 0x402f87
mov eax, dword [0x419934]
mov ebp, 0x4180f4
push dword [eax + 0xc]
push ebp
call fcn.00407492
push ebp
call sub.KERNEL32.dll_lstrlenW
lea eax, [eax*2 + 2]
jmp 0x402f87
mov ebp, edi
push ebx
push 0x4170f4
call fcn.00407492
mov esi, eax
push eax
push 0xffffffffffffffeb
call fcn.004064bb
push esi
call fcn.00406965
test eax, eax
je 0x40302c
mov edi, eax
cmp dword [esp + 0x18], 0
je 0x402e8c
push edi
call fcn.00407aa0
cmp dword [esp + 0x14], 0
js 0x40300b
xor esi, esi
push eax
push ebp
call fcn.004078cf
jmp 0x403014
xor ecx, ecx
call fcn.0040320b
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x401f29
mov edi, dword [esp + 0x24]
xor ecx, ecx
call fcn.0040320b
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.0040320b
test edi, edi
je 0x402a93
cmp esi, eax
jb 0x402c1a
ja 0x402aa1
jmp 0x402c23
push ebx
push 0x4170f4
mov ebx, ecx
call fcn.00407492
mov edi, eax
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4188f4
call fcn.00407492
mov dword [esp], eax
mov eax, dword [0x419934]
push dword [eax + 8]
push 0x4180f4
call fcn.00407492
mov ebp, eax
mov eax, dword [0x419934]
mov esi, 0x4178f4
push dword [eax + 0x14]
push esi
call fcn.00407492
push esi
push 0xffffffffffffffec
call fcn.004064bb
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x1c], ecx
xor ecx, ecx
cmp word [edi], 0
cmove edi, ecx
mov dword [eax + 0xc], edi
mov ecx, dword [esp]
mov dword [eax + 0x10], ecx
xor ecx, ecx
cmp word [ebp], 0
cmove ebp, ecx
mov dword [eax + 0x14], ebp
add ebx, 0xb000
mov dword [eax + 0x18], ebx
push eax
call fcn.004069ce
test eax, eax
je 0x402aaa
test byte [esp + 0x40], 0x40
jne 0x402d9f
xor esi, esi
jmp 0x402db4
mov ebp, dword [esp + 4]
push ebp
mov ebx, edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov ecx, 2
call fcn.0040320b
mov esi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x48
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x41993c], eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 3
call fcn.0040320b
mov dword [0x41994c], eax
mov al, byte [esp + 0x20]
mov ecx, eax
and cl, 1
mov byte [0x419950], cl
mov ecx, eax
and cl, 2
mov byte [0x419951], cl
and al, 4
mov byte [0x419952], al
mov byte [0x419953], 1
push dword [esp + 0x14]
push 0x419958
call fcn.00407492
push 0x41993c
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
jmp 0x402d99
push ebx
push 0x4170f4
call fcn.00407492
mov edi, eax
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4178f4
call fcn.00407492
mov ebx, eax
mov eax, dword [0x419934]
push dword [eax + 0xc]
push 0x4180f4
call fcn.00407492
mov esi, eax
push edi
call fcn.00406e41
test eax, eax
je 0x401cfc
mov dword [esp], esi
lea esi, [esp + 0x3c]
mov eax, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], 2
push edi
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
push ebx
call sub.KERNEL32.dll_lstrlenW
xor ebp, ebp
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov ecx, dword [esp]
mov dword [esi + 0x1a], ecx
movzx eax, word [esp + 0x18]
mov word [esi + 0x10], ax
push ecx
push 0
call fcn.004064bb
push esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x401d08
push 0
push 0xfffffffffffffff9
call fcn.004064bb
xor ebp, ebp
inc ebp
mov dword [esp], ebp
jmp case.0x40153c.66
mov esi, ecx
push ebp
push 0x4188f4
call fcn.00407492
mov edi, eax
mov ebp, dword [esp + 0x10]
push eax
call fcn.00406ecb
test eax, eax
mov dword [esp + 4], edi
je 0x402ab2
push edi
push 0x4170f4
call fcn.00406dbf
jmp 0x402ad0
push 0xfffffffffffffff0
call fcn.00403228
jmp 0x40207c
push dword [ebp*4 + 0x4170b4]
push edx
jmp 0x403093
mov eax, dword [0x40a17c]
mov eax, dword [eax]
test eax, eax
je 0x401d71
push ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x40a178]
mov eax, dword [eax]
mov dword [esp], 0
test eax, eax
je case.0x40153c.66
push dword [esp + 0x10]
push eax
jmp 0x402c90
push ebp
push 0x4170f4
mov esi, edx
call fcn.00407492
mov edi, eax
push 0x400
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
test eax, eax
je 0x401dca
xor ebx, ebx
cmp dword [esp + 0x18], 0
je 0x401dd2
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, esi
test eax, eax
jne 0x401dd2
mov word [ecx], 0
xor ebx, ebx
inc ebx
mov dword [esp], ebx
mov word [ecx + 0x7fe], 0
jmp case.0x40153c.66
push 0xfffffffffffffff0
call fcn.00403228
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x402c7f
mov ecx, 2
mov dword [esp + 0x28], edx
call fcn.0040320b
mov edi, eax
mov esi, edx
mov ecx, 3
call fcn.0040320b
mov ebp, eax
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4170f4
call fcn.00407492
mov ebx, eax
push eax
call sub.KERNEL32.dll_lstrlenW
mov edx, dword [esp + 0x28]
mov word [edx], 0
test esi, esi
cmove edi, eax
mov dword [esp], 0
test edi, edi
je case.0x40153c.66
mov ecx, ebp
sar ecx, 0x1f
and ecx, eax
add ecx, ebp
mov dword [esp], 0
js case.0x40153c.66
cmp ecx, eax
cmovl eax, ecx
lea eax, [ebx + eax*2]
push eax
push edx
mov esi, edx
call fcn.00406dbf
test edi, edi
jns 0x401e82
push esi
call sub.KERNEL32.dll_lstrlenW
add edi, eax
mov dword [esp], 0
cmp edi, 0x3ff
mov eax, dword [esp + 0x28]
jg case.0x40153c.66
xor ecx, ecx
test edi, edi
mov dword [esp], 0
cmovle edi, ecx
mov word [eax + edi*2], 0
jmp case.0x40153c.66
xor ecx, ecx
call fcn.0040320b
cmp eax, 0x1f
ja 0x40302c
cmp dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
je 0x402efb
test ecx, ecx
je 0x40308a
push eax
call fcn.00401304
xor eax, eax
push eax
mov dword [esp + 4], 0
push eax
call fcn.00401248
jmp case.0x40153c.66
xor ecx, ecx
inc ecx
mov edi, edx
call fcn.0040320b
mov esi, eax
mov ecx, 2
call fcn.0040320b
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x403091
push ebx
push 0x4170f4
call fcn.00407492
push eax
call fcn.00406e41
test eax, eax
je 0x402c23
mov ebx, dword [esp + 0x14]
jmp case.0x40153c.2
push ebp
push 0x4170f4
mov edi, edx
call fcn.00407492
mov esi, eax
mov ecx, 2
call fcn.0040320b
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403098
push dword [esp + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403098
push 0
push ebx
call fcn.004064bb
jmp 0x402938
mov ebx, edi
mov edi, edx
push dword [esp + 0x18]
push 0x4170f4
call fcn.00407492
push eax
call fcn.00406e41
test eax, eax
je 0x402bac
mov esi, eax
push dword [eax + 0x14]
push ebx
call fcn.004078cf
push dword [esi + 0x18]
jmp 0x403092
mov esi, dword [0x419938]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x402bb9
test esi, esi
je 0x402924
dec eax
mov esi, dword [esi]
add eax, 0xffffffff
jae 0x401fd9
test esi, esi
jne 0x401fce
test esi, esi
je 0x402924
add esi, 4
mov edi, 0x4170f4
push esi
push edi
call fcn.00406dbf
mov eax, dword [0x419938]
add eax, 4
push eax
push esi
call fcn.00406dbf
mov eax, dword [0x419938]
add eax, 4
push edi
push eax
jmp 0x4028cc
push ebp
push 0x4170f4
mov esi, edx
call fcn.00407492
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
push esi
jmp 0x403093
mov eax, dword [esp + 0x18]
mov ecx, dword [eax*4 + 0x4170b4]
xor edx, edx
test ecx, ecx
sete dl
mov ebx, dword [esp + edx*4 + 0x10]
and ecx, dword [esp + 0x1c]
mov dword [eax*4 + 0x4170b4], ecx
jmp case.0x40153c.2
test ebx, ebx
jns 0x402061
not ebx
shl ebx, 0xb
add ecx, ebx
push ecx
call fcn.004078e8
mov ebx, eax
dec ebx
push 0
push ebx
call fcn.004013ec
mov ebx, eax
jmp case.0x40153c.2
push ebx
push 0x4170f4
call fcn.00407492
push dword [esp + 0x14]
push eax
call fcn.00406af3
jmp 0x403098
cmp dword [esp + 0x18], 0
jle 0x402be6
mov eax, dword [ebx*4 + 0x4198f8]
mov dword [ebx*4 + 0x4170b4], eax
jmp 0x403098
mov eax, dword [0x40a170]
inc dword [eax]
mov ebx, 0x7fffffff
cmp dword [esp + 4], 0
je case.0x40153c.2
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x40153c.2
push 0xffffffffffffffee
mov dword [esp + 0x2c], edx
call fcn.00403228
mov ebp, eax
push 0xb
call fcn.0040692c
lea ecx, [esp + 0x3c]
push ecx
push ebp
call eax
mov esi, eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov word [ecx], ax
mov word [edi], ax
xor ebx, ebx
inc ebx
test esi, esi
je 0x402183
mov dword [esp + 0x2c], edi
mov edi, ebp
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x402183
mov ebp, eax
push 0xc
call fcn.0040692c
mov ebx, eax
push 0xd
call fcn.0040692c
mov dword [esp], eax
push ebp
push esi
push 0
push edi
call ebx
xor ebx, ebx
inc ebx
test eax, eax
je 0x40217c
lea eax, [esp + 0x30]
lea ecx, [esp + 8]
push eax
push ecx
push 0x40a158
push ebp
call dword [esp + 0x10]
test eax, eax
je 0x40217c
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
push dword [eax + ecx*4 + 8]
push dword [esp + 0x2c]
call fcn.004078cf
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
push dword [eax + ecx*4 + 0xc]
push dword [esp + 0x30]
call fcn.004078cf
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp], ebx
jmp case.0x40153c.66
push ebx
push 0x4180f4
call fcn.00407492
mov esi, eax
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4188f4
call fcn.00407492
cmp dword [esp + 0x20], 0
je 0x402c0e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x402c16
cmp ebx, 0xbadf00d
jne 0x402924
inc dword [0x4170c8]
jmp 0x403098
push 0
push ebx
jmp 0x4022ee
cmp dword [esp + 0x20], 0
je 0x402c2c
push dword [esp + 0x18]
push 0x4180f4
call fcn.00407492
mov ecx, dword [esp + 0x20]
sar ecx, 1
push ecx
push eax
push ebp
call fcn.004032b7
mov esi, eax
jmp 0x402c60
xor edi, edi
mov eax, 0
test ebx, ebx
je 0x402229
push ebx
push 0x4170f4
call fcn.00407492
mov ebp, dword [esp + 0x14]
mov ebx, eax
test ebp, ebp
je 0x402243
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4178f4
call fcn.00407492
mov edi, eax
cmp dword [esp + 0x20], 0
je 0x402c6c
mov eax, dword [0x419934]
push dword [eax + 8]
push 0x4180f4
call fcn.00407492
mov esi, eax
jmp 0x402c6e
xor ecx, ecx
call fcn.0040320b
mov esi, eax
xor ecx, ecx
inc ecx
call fcn.0040320b
cmp dword [esp + 0x1c], 0
je 0x402c8e
push eax
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x403098
mov dword [esp], 0
xor ecx, ecx
call fcn.0040320b
xor ecx, ecx
inc ecx
cmp eax, 2
cmovge ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40153c.66
push 0xffffffffffffffd0
call fcn.00403228
mov edi, eax
push 0xffffffffffffffdf
call fcn.00403228
mov ebx, eax
mov eax, dword [0x419934]
push dword [eax + 0xc]
push 0x4178f4
call fcn.00407492
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x402c9b
push 0x4178f4
push 0xffffffffffffffe3
call fcn.004064bb
jmp 0x403098
push ebx
push 0x4170f4
call fcn.00407492
mov ebx, eax
lea eax, [esp + 0x3c]
push eax
push edi
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x402a6e
mov eax, dword [esp + 0x3c]
xor esi, esi
cmp eax, ebx
jbe 0x402a76
cmp word [eax], 0
je 0x402a76
push ebx
call fcn.00406e41
test eax, eax
je 0x402a6e
add eax, 0x2c
push eax
push dword [esp + 0x40]
call fcn.00406dbf
jmp 0x402a76
mov dword [esp], ecx
push 0xfffffffffffffff0
call fcn.00403228
mov edi, eax
push eax
call fcn.00406efc
xor esi, esi
test eax, eax
je 0x4023cf
push 0x5c
push eax
call fcn.00406e98
mov ebx, eax
movzx ebp, word [eax]
mov word [eax], 0
test bp, bp
jne 0x40239e
cmp dword [esp + 0x18], 0
je 0x40239e
call fcn.00406912
test eax, eax
je 0x40239e
push edi
call fcn.004068a0
jmp 0x4023a4
push edi
call fcn.004068f4
test eax, eax
je 0x4023c2
cmp eax, 0xb7
jne 0x4023c1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
cmp eax, 1
adc esi, 0
jmp 0x4023c2
inc esi
mov eax, ebx
add eax, 2
mov word [ebx], bp
test bp, bp
jne 0x40236f
cmp dword [esp + 0x14], 0
je 0x402ccd
push 0x4178f4
push 0xffffffffffffffe6
call fcn.004064bb
mov eax, dword [esp]
add eax, 0xb000
push edi
push eax
call fcn.00406dbf
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, 1
adc esi, 0
jmp 0x402db4
push 0xffffffffffffffef
mov esi, edx
call fcn.00403228
push eax
push esi
call fcn.00407127
jmp 0x402c7f
mov eax, dword [0x40a00c]
add ebp, dword [eax + 0x28]
mov dword [esp], 0
xor ecx, ecx
call fcn.0040320b
push ebp
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40153c.66
push 0xffffffffffffffff
mov esi, edx
call fcn.00403228
lea ecx, [esp + 0x3c]
xor edi, edi
push ecx
push esi
push 0x400
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x402a5b
mov word [esi], 0
xor edi, edi
inc edi
jmp 0x402a5b
cmp dword [0x419930], 0
js 0x402cde
mov esi, ecx
push 0xfffffffffffffff0
call fcn.00403228
mov ebp, eax
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4170f4
call fcn.00407492
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x4024b5
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x4024ca
push 8
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test eax, eax
je 0x403020
push ebx
push edi
call fcn.00407a5a
test eax, eax
je 0x402f4c
mov ebp, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4030c5
push 0x4178f4
push eax
call fcn.004064bb
call ebp
xor ecx, ecx
test eax, eax
setne cl
jmp 0x4030e0
push ebp
push 0x4188f4
call fcn.00407492
push dword [esp + 0x10]
push eax
call fcn.00406a08
test eax, eax
je 0x40302c
cmp eax, dword [esp + 0x18]
je 0x402c1a
mov dword [esp], 0
cmp eax, dword [esp + 0x20]
jne case.0x40153c.66
mov ebx, dword [esp + 0x24]
jmp case.0x40153c.2
push 0xfffffffffffffff0
call fcn.00403228
mov edi, eax
push eax
call fcn.00406ecb
test eax, eax
jne 0x40255b
push 0xffffffffffffffed
call fcn.00403228
push edi
call fcn.00406acb
push 2
push 0x40000000
push edi
call fcn.004070f5
cmp eax, 0xffffffff
je 0x402649
mov ebx, eax
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], 0
je 0x40262a
mov eax, dword [0x40a168]
mov eax, dword [eax]
mov dword [esp], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x40262a
mov ebp, eax
push 0
call fcn.004038ef
push dword [esp]
push ebp
call fcn.004038d9
push dword [esp + 0x18]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test eax, eax
mov eax, dword [esp]
je 0x402618
mov dword [esp + 0x28], ebx
push dword [esp + 0x18]
push esi
push 0
push dword [esp + 0x20]
call fcn.00403906
mov dword [esp + 4], esi
cmp byte [esi], 0
je 0x402607
mov esi, dword [esp + 4]
mov ebx, dword [esi]
lea eax, [esi + 8]
mov ecx, dword [esi + 4]
add ecx, ebp
push ebx
push eax
push ecx
call fcn.004070d1
add esi, ebx
add esi, 8
cmp byte [esi], 0
jne 0x4025eb
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp]
push eax
push ebp
push ebx
call fcn.004071c7
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
dec esi
mov ebp, ebx
xor ebx, ebx
push ebx
push ebx
push ebp
push esi
call fcn.00403906
mov esi, eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffff3
test esi, esi
jns 0x402658
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
mov eax, 0xffffffef
mov dword [esp], ebx
push 0x4178f4
push eax
jmp 0x403001
mov ebx, edi
xor ecx, ecx
call fcn.0040320b
mov edi, eax
mov eax, dword [0x40a00c]
cmp dword [eax + 0xc], edi
jbe 0x40302c
mov eax, dword [eax + 8]
imul ecx, edi, 0x818
lea esi, [eax + ecx]
mov edx, dword [esp + 0x18]
test edx, edx
js 0x402f1b
je 0x4030b9
push dword [esi + edx*4]
jmp 0x402d99
cmp word [edx], 0
mov dword [esp], 0
je case.0x40153c.66
push edx
call fcn.004078e8
mov esi, eax
mov ecx, 2
call fcn.0040320b
push dword [esp + 0x1c]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x14], 0
mov dword [esp], 0
jns 0x403091
jmp case.0x40153c.66
mov esi, edx
xor ebx, ebx
inc ebx
mov ecx, ebx
call fcn.0040320b
mov edi, eax
mov ecx, 2
call fcn.0040320b
mov ecx, eax
xor ebp, ebp
mov eax, dword [esp + 0x1c]
cmp eax, 0xd
ja case.default.0x402716
jmp dword [eax*4 + 0x40a120]
add edi, ecx
jmp case.default.0x402716
push edx
call fcn.004078e8
mov dword [esp], 0
test eax, eax
je case.0x40153c.66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403098
mov ebx, edi
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x402d5d
mov dword [esp], 0
test eax, eax
jne case.0x40153c.66
push 5
call fcn.0040692c
mov edi, eax
mov eax, dword [0x419934]
push dword [eax + 8]
push 0x4180f4
call fcn.00407492
test edi, edi
je 0x402815
lea esi, [esp + 0x3c]
push esi
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x402815
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x24]
push esi
call edi
test eax, eax
js 0x402815
push dword [esp + 8]
push ebx
call fcn.00406dbf
push dword [esp + 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x403098
lea eax, [esp + 0x3c]
mov dword [eax], 0xa
push ebp
push 0x4170f4
mov ebx, edx
call fcn.00407492
mov edi, eax
mov eax, dword [0x419934]
push dword [eax + 8]
push 0x4178f4
call fcn.00407492
mov esi, eax
push 0xffffffffffffffdd
call fcn.00403228
push eax
push 0x3ff
push ebx
lea eax, [esp + 0x48]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp word [ebx], 0xa
jne 0x40302f
mov word [ebx], 0
jmp 0x40302c
mov esi, edx
push edi
call fcn.004078e8
test eax, eax
je 0x40283f
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4028c6
mov word [esi], 0
jmp 0x40302c
push 0x20019
mov esi, edx
call fcn.00403268
mov edi, eax
mov ecx, 3
call fcn.0040320b
mov word [esi], 0
test edi, edi
je 0x40302c
mov edx, esi
mov dword [esp + 0x3c], 0x3ff
cmp dword [esp + 0x20], 0
je 0x402e93
push 0x3ff
push edx
push eax
push edi
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ebx, ebx
jmp 0x402ec0
mov esi, edx
push dword [esp + 0x18]
push 0x4170f4
call fcn.00407492
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x402cea
push eax
push edi
call fcn.004078cf
lea eax, [esp + 0x68]
push eax
push esi
call fcn.00406dbf
jmp 0x403098
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4170f4
call fcn.00407492
mov esi, eax
mov eax, dword [0x419934]
push dword [eax + 8]
push 0x4178f4
call fcn.00407492
xor ecx, ecx
cmp word [esi], 0
cmove esi, ecx
cmp word [eax], 0
mov edi, 0
cmove eax, ecx
push eax
push esi
push ebx
push ebp
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x3c], eax
jmp 0x402a46
push 0xffffffffffffffe8
push 0
call fcn.00407492
push 0x200010
push eax
call fcn.00406a08
mov ebx, 0x7fffffff
jmp case.0x40153c.2
cmp esi, 0x38
jne 0x402cf7
mov esi, 0x4180f4
push ebp
push esi
call fcn.00407492
mov ebp, 0x4178f4
push 0x400
push ebp
push esi
call fcn.0040798f
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
jmp 0x402d0c
mov ecx, 2
call fcn.0040320b
mov edi, eax
mov ebp, dword [esp + 0x1c]
mov esi, ebp
and esi, 3
bt ebp, 0x10
jb 0x40299b
movzx eax, word [esp + 0x14]
jmp 0x4029ad
mov eax, dword [0x419934]
push dword [eax + 4]
push 0x4178f4
call fcn.00407492
mov dword [esp], eax
lea ebx, [esp + 0x3c]
push ebx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, ebp
shl eax, 0x1d
sar eax, 0x1f
mov ecx, dword [0x40a16c]
and eax, dword [ecx]
mov ecx, ebp
sar ecx, 0x1f
and ecx, dword [ebx + 8]
add ebp, ebp
sar ebp, 0x1f
and ebp, dword [ebx + 0xc]
mov edx, 0xfef0
and edx, dword [esp + 0x1c]
push edx
push ebp
push ecx
push esi
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebx, eax
push eax
push esi
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
jne 0x402a13
test eax, eax
je 0x402a13
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x10], 0
js 0x403098
push ebx
push dword [esp + 0x2c]
jmp 0x403093
sar ecx, 2
lea edx, [esp + 0x3c]
push edx
push ecx
push 0
push ebx
push ebp
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ecx, ecx
test eax, eax
sete cl
mov edi, ecx
cmp dword [esp + 0x10], 0
mov ebp, dword [esp + 0x28]
js 0x402a5b
push dword [esp + 0x3c]
push ebp
call fcn.004078cf
mov dword [esp], edi
jmp case.0x40153c.66
mov word [ebp], 0
jmp 0x40302c
mov word [edi], 0
xor esi, esi
inc esi
cmp dword [esp + 0x18], 0
jne 0x402db4
push 0x400
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x402db4
cmp esi, eax
jl 0x402c1a
jle 0x402c23
mov ebx, dword [esp + 0x20]
jmp case.0x40153c.2
xor esi, esi
inc esi
jmp 0x402db4
lea eax, [esi + 0xb000]
push eax
push 0x4170f4
call fcn.00406dbf
push eax
call fcn.00406e69
push edi
push eax
call sub.KERNEL32.dll_lstrcatW
and ebp, 7
push 0x4170f4
call fcn.00406f71
mov edi, 0x4178f4
cmp ebp, 3
jb 0x402b1d
push 0x4170f4
call fcn.00406e41
test eax, eax
je 0x402b06
add eax, 0x14
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x402b08
xor eax, eax
add ebp, 0x7ffffffd
or ebp, 0x80000000
xor ecx, ecx
test eax, ebp
sete cl
mov ebp, ecx
test ebp, ebp
jne 0x402b2b
push 0x4170f4
call fcn.00406acb
xor eax, eax
cmp ebp, 1
setne al
inc eax
push eax
push 0x40000000
push 0x4170f4
call fcn.004070f5
cmp eax, 0xffffffff
jne 0x402dbc
test ebp, ebp
jne 0x402e3d
mov ebx, esi
push esi
mov ebp, 0x4180f4
push ebp
call fcn.00406dbf
push 0x4170f4
push esi
call fcn.00406dbf
push dword [esp + 0x24]
push edi
call fcn.00407492
push ebp
push esi
call fcn.00406dbf
mov eax, dword [esp + 0x10]
sar eax, 3
xor ebp, ebp
push eax
push edi
call fcn.00406a08
cmp eax, 4
je 0x402ae2
cmp eax, 5
jne 0x402e55
inc dword [0x4170bc]
jmp 0x4030a8
xor eax, eax
mov word [edi], ax
mov word [ebx], ax
jmp 0x40302c
test ebp, ebp
je 0x403034
test esi, esi
je 0x40302c
lea eax, [esi + 4]
push eax
push edx
call fcn.00406dbf
mov eax, dword [esi]
mov dword [0x419938], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403098
jne 0x402bf6
mov eax, dword [ebx*4 + 0x4170b4]
mov dword [ebx*4 + 0x4198f8], eax
xor ecx, ecx
inc ecx
call fcn.0040320b
mov ecx, dword [esp + 0x10]
mov dword [ecx*4 + 0x4170b4], eax
jmp 0x403098
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402c23
mov ebx, dword [esp + 0x1c]
jmp case.0x40153c.2
mov ebx, dword [esp + 0x18]
jmp case.0x40153c.2
push 2
call fcn.00403268
test eax, eax
je 0x40302c
mov edi, eax
mov eax, dword [0x419934]
push dword [eax + 0xc]
push 0x4188f4
call fcn.00407492
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
setne al
jmp 0x40302f
xor esi, esi
push 0xffffffffffffffcd
call fcn.00403228
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp], ecx
jmp case.0x40153c.66
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403098
xor esi, esi
inc esi
cmp dword [esp + 0x18], 0
mov dword [esp], esi
je case.0x40153c.66
push edi
call fcn.00406e41
test eax, eax
je case.0x40153c.66
push ebx
push edi
call fcn.00406e12
push 0x4178f4
push 0xffffffffffffffe4
jmp 0x4022ee
push 0x4178f4
push 0xfffffffffffffff5
call fcn.004064bb
jmp 0x402db4
push 0x4178f4
push 0xffffffffffffffe7
jmp 0x403027
xor eax, eax
mov word [edi], ax
mov word [esi], ax
jmp 0x40302c
push ebp
push 0x4178f4
call fcn.00407492
push eax
call sub.KERNEL32.dll_lstrlenW
mov ecx, eax
add ecx, eax
xor esi, esi
inc esi
cmp word [edi], 0
je 0x402db4
mov ebp, ecx
mov eax, ebx
xor ebx, ebx
mov bl, al
push edi
call fcn.004078e8
mov edi, eax
or dword [esp], ebx
jne 0x402d40
cmp dword [esp + 0x1c], 0
je 0x402d40
push edi
push edi
call fcn.004071f9
test eax, eax
js 0x402db4
push ebp
push 0x4178f4
push edi
call fcn.004071c7
mov dword [esp], 0
test eax, eax
jne case.0x40153c.66
jmp 0x402db4
mov ecx, 2
call fcn.0040320b
mov esi, eax
mov ecx, 4
call fcn.0040320b
lea edi, [esp + 0x3c]
mov dword [edi], 0
movzx ecx, al
shr eax, 0x18
test esi, esi
mov edx, 0x4170b4
cmovne edx, esi
add edx, eax
push ecx
push edx
push edi
call fcn.004070d1
push dword [edi]
push ebx
jmp 0x403093
xor esi, esi
push dword [esp + 0x74]
call fcn.00407aa0
push dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], esi
jmp case.0x40153c.66
mov ebx, eax
push dword [esp + 4]
push 0xffffffffffffffea
call fcn.004064bb
inc dword [0x4170e8]
xor eax, eax
push eax
push eax
push ebx
push dword [esp + 0x24]
call fcn.00403906
dec dword [0x4170e8]
mov esi, eax
cmp dword [esp + 0x1c], 0xffffffff
jne 0x402df3
cmp dword [esp + 0x20], 0xffffffff
je 0x402e02
lea eax, [esp + 0x1c]
push eax
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
test esi, esi
jns case.0x40153c.66
cmp esi, 0xfffffffe
jne 0x4031be
mov esi, 0x4170f4
push 0xffffffffffffffe9
push esi
call fcn.00407492
push dword [esp + 4]
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x4031ca
push dword [esp + 4]
push 0xffffffffffffffe2
call fcn.004064bb
xor eax, eax
cmp ebp, 2
sete al
jmp 0x40302f
push 0x4170f4
push 0xfffffffffffffffa
jmp 0x401f76
push edx
call dword [ecx + 8]
jmp 0x402ff8
mov eax, dword [esp + 8]
lea ecx, [eax - 1]
cmp ecx, 2
jae 0x40305f
mov ebp, dword [esp + 0x20]
mov word [esi + 0x7fe], 0
jmp 0x40307e
xor esi, esi
jmp 0x403014
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea ecx, [esp + 0x5c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp], ebx
mov word [esi + 0x7fe], 0
jmp 0x403081
movzx eax, word [esp + 8]
cmp bx, ax
je 0x402faa
movzx ecx, ax
cmp ecx, 0xa
je 0x402ef0
cmp ecx, 0xd
jne 0x402faa
mov word [ebp + esi*2], ax
inc esi
jmp 0x402fbb
test ecx, ecx
je 0x4030fd
mov ecx, dword [esp + 0x14]
mov edx, dword [0x40a004]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x94], ecx
jmp 0x403098
cmp edx, 0xffffffff
not edx
mov dword [esp + 0x18], edx
je 0x403114
xor ecx, ecx
inc ecx
call fcn.0040320b
mov dword [esp + 0x14], eax
jmp 0x40312c
movzx eax, word [esp + 8]
push eax
push ebp
call fcn.004078cf
jmp 0x4030a8
push ebx
push 0xfffffffffffffff7
call fcn.004064bb
xor ecx, ecx
inc ecx
jmp 0x4030e0
push 0x1800
push 0x4180f4
push 0
push dword [esp + 0x28]
call fcn.00403906
jmp 0x402f87
mov ecx, 3
call fcn.0040320b
mov dword [0x4180f4], eax
mov eax, 4
push eax
push 0x4180f4
push dword [esp + 8]
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp], ecx
jmp 0x403081
neg edi
push 1
push 0
push edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [ebp + esi*2], 0
mov dword [esp], 0
test esi, esi
jne case.0x40153c.66
jmp 0x40302c
mov bl, 1
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movzx ebp, bl
xor bl, 1
movzx edi, bl
shl edi, 2
or edi, 0xfffffff0
mov dword [esp], ebp
push 0x4178f4
push edi
call fcn.004064bb
jmp case.0x40153c.66
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
mov dword [esp], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40153c.66
push 0x4178f4
push 0xfffffffffffffff6
call fcn.004064bb
xor eax, eax
inc eax
mov dword [esp], eax
jmp case.0x40153c.66
push 0x804
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
add eax, 4
push dword [esp + 0x10]
push eax
call fcn.00407492
mov eax, dword [0x419938]
mov dword [esi], eax
mov dword [0x419938], esi
jmp 0x403098
cmp eax, 4
mov ebx, esi
jne 0x4019b6
xor eax, eax
cmp dword [esp + 0x20], 0
sete al
mov ebp, eax
push dword [ebx]
push ebx
call fcn.004078cf
mov dword [esp], ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40153c.66
push 0
call fcn.00401351
push eax
push edi
call fcn.004078cf
mov dword [esp], 0
mov eax, dword [esp]
add dword [0x4170bc], eax
xor ebx, ebx
mov eax, ebx
add esp, 0x28c
pop esi
pop edi
pop ebx
pop ebp
ret 4
add eax, ecx
add eax, 0x18
push eax
push ebx
jmp 0x4028cc
push section..data
push 0x419938
push esi
push 0x400
push dword [esp + 0x14]
call ebp
add esp, 0x14
xor ecx, ecx
cmp dword [esp + 0x1c], 0
mov dword [esp], ecx
jne case.0x40153c.66
push edi
call fcn.0040432b
test eax, eax
je case.0x40153c.66
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x40153c.66
mov ecx, dword [0x40a004]
mov ecx, dword [ecx]
push dword [ecx + eax*4 + 0x94]
push edi
call fcn.00407492
jmp 0x403098
lea ebx, [eax + ecx]
add ebx, 0x18
push dword [esp + 0x20]
push ebx
call fcn.00407492
or byte [ebx - 0xf], 1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi + ecx*4], eax
cmp dword [esp + 0x1c], 0
je 0x403098
push edi
call fcn.004011dc
jmp 0x403098
shl edi, cl
jmp case.default.0x402716
or edi, ecx
jmp case.default.0x402716
sar edi, cl
jmp case.default.0x402716
test edi, edi
setne al
test ecx, ecx
setne cl
and cl, al
movzx edi, cl
jmp case.default.0x402716
imul edi, ecx
jmp case.default.0x402716
test ecx, ecx
je 0x4031ab
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
jmp 0x4031a7
xor eax, eax
test edi, edi
sete al
jmp 0x4031a7
sub edi, ecx
jmp case.default.0x402716
and edi, ecx
jmp case.default.0x402716
shr edi, cl
jmp case.default.0x402716
xor edi, ecx
jmp case.default.0x402716
test ecx, ecx
je 0x4031ab
mov eax, edi
cdq
idiv ecx
xor ebp, ebp
mov edi, edx
jmp case.default.0x402716
xor eax, eax
or edi, ecx
setne al
mov edi, eax
jmp case.default.0x402716
xor edi, edi
mov ebp, ebx
mov dword [esp], ebp
push edi
push esi
call fcn.004078cf
jmp case.0x40153c.66
push 0xffffffffffffffee
push 0x4170f4
call fcn.00407492
push 0x200010
push 0x4170f4
jmp 0x402933
xor esi, esi
jmp 0x402fbb