Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x118
push 0
push 0x4113d4
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4113d8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4113d4], eax
call section..text
call fcn.0040df60
call fcn.0040dd4c
call fcn.0040c253
call fcn.0040bd83
call fcn.0040b730
call fcn.0040b3b9
call fcn.0040b1c0
call fcn.0040b1a2
call fcn.0040b119
call fcn.0040a881
call fcn.004098b0
call fcn.00408ac1
call fcn.00408786
call fcn.00408301
call fcn.00407f79
push dword [0x4114d8]
call fcn.004087a5
push 7
push 0x410290
lea eax, [0x4114d8]
push eax
push 8
call fcn.004086f4
push 0x4114d0
push 0x4102a0
push 7
push 0x401
push 8
call fcn.0040dc4d
mov eax, 0x200
push eax
lea eax, [0x4114e8]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0040c272
push dword [0x4114e0]
call fcn.004087a5
push 7
push 0x410298
lea eax, [0x4114e0]
push eax
push 8
call fcn.004086f4
mov edx, str.Continue_
lea ecx, [0x4113ec]
call fcn.00405068
mov edx, str.Error_
lea ecx, [0x4114b8]
call fcn.00405068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x411414]
call fcn.00405068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x411468]
call fcn.00405068
mov edx, str.Wrong_password.
lea ecx, [0x41148c]
call fcn.00405068
mov edx, 0x410025
lea ecx, [0x41146c]
call fcn.00405068
mov edx, str.The_file
lea ecx, [0x4113f0]
call fcn.00405068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x411404]
call fcn.00405068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x411464]
call fcn.00405068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x4114a0]
call fcn.00405068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x411488]
call fcn.00405068
mov edx, str.Password
lea ecx, [0x4114a4]
call fcn.00405068
mov edx, str.Please_enter_the_password.
lea ecx, [0x411434]
call fcn.00405068
call fcn.0040966f
mov ebx, eax
cmp ebx, 0x32
jge 0x40120f
push 0x10
push dword [0x4114a0]
push dword [0x4114b8]
call fcn.00407fb0
jmp 0x4021da
lea eax, [0x403274]
push eax
call fcn.00408510
call fcn.0040843f
mov dword [0x411494], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x411444], eax
mov edx, dword [0x4117b8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1f0
push 0x411490
call fcn.0040dfe0
push dword [0x411490]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x411494]
and ebx, ebx
jle 0x401378
mov dword [0x411418], 0
mov ebx, dword [0x411494]
dec ebx
cmp ebx, dword [0x411418]
jl 0x4012fb
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x411418]
call fcn.004083f1
push 0x41147c
call fcn.0040dfe0
push dword [0x41147c]
mov edx, str._b2epass
pop ecx
call fcn.0040e060
je 0x4012bf
mov dword [0x411410], 1
jmp 0x4012ef
mov ebx, dword [0x411410]
cmp ebx, 1
jne 0x4012ef
mov edx, dword [0x41147c]
push dword [0x4117b8]
call fcn.0040e090
push 0x4114ac
call fcn.0040dfe0
mov dword [0x411410], 0
inc dword [0x411418]
jno 0x401274
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1f0
inc dword [0x4117b8]
mov edx, dword [0x410358]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x4117b8]
push eax
call fcn.0040b1f0
push 0x411438
call fcn.0040dfe0
mov edx, dword [0x411490]
push dword [0x4117b8]
call fcn.0040e090
mov edx, 0x41001f
call fcn.0040e090
mov edx, dword [0x411438]
call fcn.0040e090
push 0x411438
call fcn.0040dfe0
jmp 0x401393
mov edx, dword [0x411490]
push dword [0x4117b8]
call fcn.0040e090
push 0x411438
call fcn.0040dfe0
push 0x410087
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x4013be
mov eax, dword [0x4113e0]
mov dword [0x411474], eax
push dword [0x411474]
call fcn.004033a1
jmp 0x4013de
push 0x10
push dword [0x411464]
push dword [0x4114b8]
call fcn.00407fb0
push 1
jmp 0x4021df
push str.NOPSX
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x401417
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4113f4]
push dword [0x4113e0]
call fcn.0040b240
push 0x411460
call fcn.0040dfe0
jmp 0x401437
push 0x10
push dword [0x411464]
push dword [0x4114b8]
call fcn.00407fb0
push 1
jmp 0x4021df
push 0x41006e
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x40146b
mov eax, dword [0x4113e0]
mov dword [0x41141c], eax
mov eax, dword [0x4113f4]
mov dword [0x4113e4], eax
mov eax, dword [0x41141c]
mov dword [0x41149c], eax
jmp 0x40148b
push 0x10
push dword [0x411464]
push dword [0x4114b8]
call fcn.00407fb0
push 1
jmp 0x4021df
push 0x410074
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x4014bd
mov eax, dword [0x4113e0]
mov dword [0x411424], eax
mov eax, dword [0x4113f4]
mov dword [0x41142c], eax
mov eax, dword [0x411424]
mov dword [0x411470], eax
push 0x410072
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x4014ef
mov eax, dword [0x4113e0]
mov dword [0x411420], eax
mov eax, dword [0x4113f4]
mov dword [0x4113e8], eax
mov eax, dword [0x411420]
mov dword [0x4114bc], eax
push 0x410089
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x401787
mov edx, dword [0x4114ac]
xor ecx, ecx
call fcn.0040e060
jne 0x401536
mov edx, dword [0x4114ac]
push dword [0x4117b8]
call fcn.0040e090
push 0x411484
call fcn.0040dfe0
jmp 0x4016aa
push 0xc80001
push dword [0x4114a4]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00409bc0
push dword [0x411434]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00408da3
push 0x20
push 0x41001e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00408f7c
push 0x410215
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00409289
push 4
push 0xd
push 0
call fcn.00409be3
push 2
call fcn.004092a9
call fcn.00409de7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401616
push dword [0x4114b4]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4021df
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x40165e
call fcn.0040be4c
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40165b
mov edx, dword [0x4117b8]
push edx
push edx
push 2
call fcn.004092e4
push 0x411484
call fcn.0040dfe0
push 0
call fcn.00409783
add esp, 8
jmp 0x4016aa
pop eax
jmp 0x4016a4
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4016a4
call fcn.0040be5b
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4016a3
mov edx, dword [0x4117b8]
push edx
push edx
push 2
call fcn.004092e4
push 0x411484
call fcn.0040dfe0
push 0
call fcn.00409783
add esp, 8
jmp 0x4016aa
pop eax
pop eax
jmp 0x4015ec
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x411484]
call fcn.004050d0
push eax
mov eax, dword [0x411484]
push eax
call fcn.0040c830
inc dword [0x4117b8]
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4113f4]
push dword [0x4113e0]
call fcn.0040b240
pop edx
pop ecx
mov dword [0x4117b8], ecx
add ecx, dword [0x410358]
add edx, dword [0x410358]
call fcn.0040e060
jne 0x40172e
push 0x10
push dword [0x41148c]
push dword [0x4114b8]
call fcn.00407fb0
push dword [0x4114b4]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x4021df
push 0x41008b
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x40174c
mov eax, dword [0x4113e0]
mov dword [0x411498], eax
push dword [0x4113e8]
push dword [0x41142c]
push dword [0x4113e4]
push dword [0x411498]
push dword [0x411420]
push dword [0x411424]
push dword [0x41141c]
push dword [0x411484]
push dword [0x411444]
call fcn.00403d32
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4113e4]
push dword [0x41149c]
call fcn.0040b240
push 0x41145c
call fcn.0040dfe0
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x41142c]
push dword [0x411470]
call fcn.0040b240
push 0x411408
call fcn.0040dfe0
push 0x410070
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x401a45
mov edx, dword [0x4117b8]
push edx
push edx
push 0
call fcn.004083f1
inc dword [0x4117b8]
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4113f4]
push dword [0x4113e0]
call fcn.0040b240
pop edx
pop ecx
mov dword [0x4117b8], ecx
add ecx, dword [0x410358]
add edx, dword [0x410358]
call fcn.0040e060
je 0x401843
mov ebx, dword [0x411494]
cmp ebx, 1
jne 0x401843
mov eax, 1
jmp 0x401845
xor eax, eax
and eax, eax
je 0x401a45
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
call fcn.0040b3c5
inc dword [0x4117b8]
push dword [0x411488]
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.00408023
push 0x411400
call fcn.0040dfe0
mov edx, dword [0x411400]
xor ecx, ecx
call fcn.0040e060
jne 0x4019f3
mov edx, dword [0x411400]
push dword [0x4117b8]
call fcn.0040e090
push 0x411454
call fcn.0040dfe0
push dword [0x411454]
call fcn.0040b405
mov edx, dword [0x411408]
xor ecx, ecx
call fcn.0040e060
jne 0x4018da
push dword [0x411408]
call fcn.004034cf
push dword [0x411460]
push 1
call fcn.0040b9a0
and eax, eax
je 0x4019c5
push 1
call fcn.0040b6b0
push dword [0x4117b8]
push 0x24
mov edx, dword [0x4113f0]
push dword [0x4117b8]
call fcn.0040e090
mov edx, 0x410021
call fcn.0040e090
mov edx, dword [0x411460]
call fcn.0040e090
mov edx, 0x410021
call fcn.0040e090
mov edx, dword [0x411404]
call fcn.0040e090
inc dword [0x4117b8]
push dword [0x41146c]
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.00407fb0
pop dword [0x4117b8]
mov dword [0x411458], eax
mov ebx, dword [0x411458]
cmp ebx, 7
jne 0x4019c5
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call fcn.00408452
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b417
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b405
pop dword [0x4117b8]
push dword [0x4114b4]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4021df
push dword [0x411460]
push 1
call fcn.0040b8d0
and eax, eax
je 0x4019f3
push dword [0x41145c]
push 1
call fcn.0040ba50
push 1
call fcn.0040b6b0
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call fcn.00408452
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b417
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b405
pop dword [0x4117b8]
push dword [0x4114b4]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4021df
push 0x41008d
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x401b81
push 0x400
call fcn.0040b2e0
mov dword [0x41143c], eax
mov edx, dword [0x4117b8]
push edx
push edx
call fcn.0040b48d
push 0x4114c4
call fcn.0040dfe0
push dword [0x41143c]
push 0
push 0x41001e
push dword [0x4114c4]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x41143c]
call fcn.0040b1f0
push 0x4114b0
call fcn.0040dfe0
push dword [0x41143c]
call fcn.0040b300
push dword [0x4114b0]
call fcn.0040b51c
push dword [0x4114b0]
call fcn.0040b52a
push dword [0x4114b0]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x4114b0]
push dword [0x4117b8]
call fcn.0040e090
mov edx, str.extd.exe
call fcn.0040e090
push 0x411450
call fcn.0040dfe0
push dword [0x411450]
push 0
call fcn.0040b8d0
push dword [0x4113f4]
push dword [0x4113e0]
push 0
call fcn.0040bad0
push 0
call fcn.0040b6b0
mov edx, dword [0x411450]
push dword [0x4117b8]
call fcn.0040e090
push 0x411448
call fcn.0040dfe0
push dword [0x411448]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x411448]
push str.b2eextd
call fcn.004084ad
push str._call:extd
push str.extd
call fcn.004084ad
mov edx, dword [0x4114b4]
push dword [0x4117b8]
call fcn.0040e090
mov edx, str.BDFI
call fcn.0040e090
mov edx, dword [0x411460]
call fcn.0040e090
push 0x411460
call fcn.0040dfe0
push dword [0x411460]
push 1
call fcn.0040b8d0
and eax, eax
je 0x401d60
push str._shift__0
push 1
call fcn.0040bb30
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040b1f0
inc dword [0x4117b8]
mov edx, dword [0x410358]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x4117b8]
push eax
call fcn.0040b1f0
inc dword [0x4117b8]
push str.b2eargs
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x4117b8]
push dword [0x41145c]
push 1
call fcn.0040bb30
push 0x41008d
push dword [0x411444]
call fcn.00403c1f
and eax, eax
je 0x401d54
mov edx, dword [0x4117b8]
push edx
push edx
mov ebp, 0x410355
mov ebx, ebp
mov ebp, 0x4102a8
sub ebx, ebp
push ebx
mov ebp, 0x4102a8
push ebp
call fcn.0040b240
push 0x411428
call fcn.0040dfe0
push dword [0x411428]
call fcn.004050d0
mov dword [0x411440], eax
push dword [0x411440]
call fcn.0040b2e0
mov dword [0x41144c], eax
push dword [0x411440]
call fcn.0040b2e0
mov dword [0x411430], eax
push dword [0x411428]
push dword [0x41144c]
call fcn.0040b320
mov dword [0x411418], 0
mov eax, dword [0x411440]
cmp eax, dword [0x411418]
jl 0x401d1b
mov ebx, dword [0x41144c]
add ebx, dword [0x411418]
mov eax, ebx
call fcn.0040b350
mov ebx, eax
imul ebx, ebx, 0xffffffff
push ebx
mov ebx, dword [0x411430]
add ebx, dword [0x411418]
mov eax, ebx
call fcn.0040b360
inc dword [0x411418]
jno 0x401cda
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
push dword [0x411430]
call fcn.0040b1f0
inc dword [0x4117b8]
push 1
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.0040bb30
pop dword [0x4117b8]
push 1
call fcn.0040b6b0
jmp 0x401d9b
push dword [0x411460]
call fcn.0040b51c
call fcn.00403fdf
push 0x10
push dword [0x411464]
push dword [0x4114b8]
call fcn.00407fb0
push dword [0x4114b4]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x4021df
mov edx, dword [0x411408]
xor ecx, ecx
call fcn.0040e060
jne 0x401db5
push dword [0x411408]
call fcn.004034cf
push 0x400
call fcn.0040b2e0
mov dword [0x4114a8], eax
mov edx, dword [0x4117b8]
push edx
push edx
call fcn.0040b48d
push 0x4113fc
call fcn.0040dfe0
push dword [0x4114a8]
push 0
push 0x41001e
push dword [0x4113fc]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4114a8]
call fcn.0040b1f0
push 0x4114c0
call fcn.0040dfe0
mov edx, dword [0x4117b8]
push edx
push edx
push 0x800
call fcn.00405100
push 0x411478
call fcn.0040dfe0
push dword [0x4117b8]
push 0x800
push dword [0x411478]
mov edx, dword [0x4117b8]
push edx
push edx
call fcn.00408452
inc dword [0x4117b8]
mov edx, dword [0x410358]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x4117b8]
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call fcn.00408452
inc dword [0x4117b8]
push str.b2eprogramname
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x4117b8]
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call fcn.00408452
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b648
inc dword [0x4117b8]
push str.b2eprogramfilename
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x4117b8]
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call fcn.00408452
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b417
inc dword [0x4117b8]
push str.b2eprogrampathname
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x4117b8]
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
push dword [0x411478]
call fcn.00405200
inc dword [0x4117b8]
push str.b2eprogramshortname
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x4117b8]
mov edx, dword [0x411454]
push dword [0x4117b8]
call fcn.0040e090
push 0x4114cc
call fcn.0040dfe0
push dword [0x4114cc]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x4114cc]
push 0x410076
call fcn.004084ad
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
mov eax, dword [0x4113f8]
cdq
push edx
push eax
call fcn.00405390
inc dword [0x4117b8]
push str.b2eincfilecount
mov edx, dword [0x410358]
add dword [esp + 4], edx
call fcn.004084ad
pop dword [0x4117b8]
push dword [0x4114c0]
push str.b2etempfile
call fcn.004084ad
call fcn.00403beb
and eax, eax
je 0x402056
mov edx, dword [0x4117b8]
push edx
push edx
push 0x800
call fcn.00405100
push 0x4114c8
call fcn.0040dfe0
push 0x800
push dword [0x4114c8]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [0x4114c8]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x4114c8]
push dword [0x4117b8]
call fcn.0040e090
mov edx, str.sysnative
call fcn.0040e090
push 0x4114c8
call fcn.0040dfe0
push dword [0x4114c8]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x411460]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov edx, dword [0x411460]
push dword [0x4117b8]
call fcn.0040e090
mov edx, 0x41001f
call fcn.0040e090
mov edx, dword [0x411438]
call fcn.0040e090
push 0x411438
call fcn.0040dfe0
push dword [0x411438]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
call fcn.0040966f
mov ebx, eax
cmp ebx, 0x41
jne 0x4020ed
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, 0x4100cc
call fcn.0040e090
mov edx, dword [0x411438]
call fcn.0040e090
inc dword [0x4117b8]
push dword [0x411454]
push 0x410111
mov edx, dword [0x410358]
add dword [esp + 8], edx
call fcn.004032be
pop dword [0x4117b8]
jmp 0x40214f
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, 0x4100cc
call fcn.0040e090
mov edx, dword [0x411438]
call fcn.0040e090
inc dword [0x4117b8]
push dword [0x411454]
mov edx, dword [0x4114c8]
push dword [0x4117b8]
call fcn.0040e090
mov edx, 0x410111
call fcn.0040e090
mov edx, dword [0x410358]
add dword [esp], edx
mov edx, dword [0x410358]
add dword [esp + 8], edx
call fcn.004032be
pop dword [0x4117b8]
call fcn.00403fdf
push dword [0x411460]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x411460]
call fcn.0040b51c
push dword [0x4114c0]
call fcn.0040b51c
push dword [0x411450]
call fcn.0040b51c
mov edx, dword [0x4117b8]
push edx
push edx
mov edx, dword [0x4117b8]
push edx
push edx
push dword [0x4117b8]
call fcn.00408452
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b417
mov edx, dword [0x410358]
add dword [esp], edx
call fcn.0040b405
pop dword [0x4117b8]
push dword [0x4114b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x4114b4]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4021df
push 0
call 0x4021f9
call fcn.0040dfb0
push dword [0x4113d4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00408660
call fcn.00408b31
call fcn.00409899
call fcn.0040a90f
call fcn.0040b10d
call fcn.0040b65a
call fcn.0040b720
call fcn.0040c14e
call fcn.0040b1e0
ret