Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, str.Continue_
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e460]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e3f4]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e408]
call fcn.00404068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40e45c]
call fcn.00404068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40e49c]
call fcn.00404068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40e484]
call fcn.00404068
mov edx, str.Password
lea ecx, [0x40e4a0]
call fcn.00404068
mov edx, str.Please_enter_the_password.
lea ecx, [0x40e434]
call fcn.00404068
call fcn.0040633f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40e49c]
push dword [0x40e4b4]
call fcn.004048a4
jmp 0x401fd0
lea eax, [0x403274]
push eax
call fcn.00405330
call fcn.00404d33
mov dword [0x40e490], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e440], eax
mov edx, dword [0x40e7a8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407ec0
push 0x40e48c
call fcn.0040ab90
push dword [0x40e48c]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x40e490]
and ebx, ebx
jle 0x401333
mov dword [0x40e420], 0
mov ebx, dword [0x40e490]
dec ebx
cmp ebx, dword [0x40e420]
jl 0x4012b6
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e420]
call fcn.00404ce5
push 0x40e478
call fcn.0040ab90
push dword [0x40e478]
mov edx, str._b2epass
pop ecx
call fcn.0040ac10
je 0x40127a
mov dword [0x40e414], 1
jmp 0x4012aa
mov ebx, dword [0x40e414]
cmp ebx, 1
jne 0x4012aa
mov edx, dword [0x40e478]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e4a8
call fcn.0040ab90
mov dword [0x40e414], 0
inc dword [0x40e420]
jno 0x40122f
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407ec0
inc dword [0x40e7a8]
mov edx, dword [0x40d338]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e7a8]
push eax
call fcn.00407ec0
push 0x40e438
call fcn.0040ab90
mov edx, dword [0x40e48c]
push dword [0x40e7a8]
call fcn.0040ac40
mov edx, 0x40d01f
call fcn.0040ac40
mov edx, dword [0x40e438]
call fcn.0040ac40
push 0x40e438
call fcn.0040ab90
jmp 0x40134e
mov edx, dword [0x40e48c]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e438
call fcn.0040ab90
push 0x40d085
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401379
mov eax, dword [0x40e3e4]
mov dword [0x40e470], eax
push dword [0x40e470]
call fcn.00403297
jmp 0x401399
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp 0x401fd5
push str.NOPSX
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x4013d2
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3f8]
push dword [0x40e3e4]
call fcn.00407f10
push 0x40e458
call fcn.0040ab90
jmp 0x4013f2
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp 0x401fd5
push 0x40d06c
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401426
mov eax, dword [0x40e3e4]
mov dword [0x40e424], eax
mov eax, dword [0x40e3f8]
mov dword [0x40e3e8], eax
mov eax, dword [0x40e424]
mov dword [0x40e498], eax
jmp 0x401446
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp 0x401fd5
push 0x40d072
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401478
mov eax, dword [0x40e3e4]
mov dword [0x40e42c], eax
mov eax, dword [0x40e3f8]
mov dword [0x40e430], eax
mov eax, dword [0x40e42c]
mov dword [0x40e46c], eax
push 0x40d070
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x4014aa
mov eax, dword [0x40e3e4]
mov dword [0x40e428], eax
mov eax, dword [0x40e3f8]
mov dword [0x40e3ec], eax
mov eax, dword [0x40e428]
mov dword [0x40e4b8], eax
push 0x40d087
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401742
mov edx, dword [0x40e4a8]
xor ecx, ecx
call fcn.0040ac10
jne 0x4014f1
mov edx, dword [0x40e4a8]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e480
call fcn.0040ab90
jmp 0x401665
push 0xc80001
push dword [0x40e4a0]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00406890
push dword [0x40e434]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00405a73
push 0x20
push 0x40d01e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00405c4c
push 0x40d1fc
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00405f59
push 4
push 0xd
push 0
call fcn.004068b3
push 2
call fcn.00405f79
call fcn.00406ab7
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4015d1
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401619
call fcn.00408adc
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401616
mov edx, dword [0x40e7a8]
push edx
push edx
push 2
call fcn.00405fb4
push 0x40e480
call fcn.0040ab90
push 0
call fcn.00406453
add esp, 8
jmp 0x401665
pop eax
jmp 0x40165f
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40165f
call fcn.00408aeb
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40165e
mov edx, dword [0x40e7a8]
push edx
push edx
push 2
call fcn.00405fb4
push 0x40e480
call fcn.0040ab90
push 0
call fcn.00406453
add esp, 8
jmp 0x401665
pop eax
pop eax
jmp 0x4015a7
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e480]
call fcn.004040c0
push eax
mov eax, dword [0x40e480]
push eax
call fcn.004094a0
inc dword [0x40e7a8]
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3f8]
push dword [0x40e3e4]
call fcn.00407f10
pop edx
pop ecx
mov dword [0x40e7a8], ecx
add ecx, dword [0x40d338]
add edx, dword [0x40d338]
call fcn.0040ac10
jne 0x4016e9
push 0x10
push dword [0x40e488]
push dword [0x40e4b4]
call fcn.004048a4
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401fd5
push 0x40d089
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401707
mov eax, dword [0x40e3e4]
mov dword [0x40e494], eax
push dword [0x40e3ec]
push dword [0x40e430]
push dword [0x40e3e8]
push dword [0x40e494]
push dword [0x40e428]
push dword [0x40e42c]
push dword [0x40e424]
push dword [0x40e480]
push dword [0x40e440]
call fcn.00403858
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3e8]
push dword [0x40e498]
call fcn.00407f10
push 0x40e454
call fcn.0040ab90
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e430]
push dword [0x40e46c]
call fcn.00407f10
push 0x40e40c
call fcn.0040ab90
push 0x40d06e
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401a00
mov edx, dword [0x40e7a8]
push edx
push edx
push 0
call fcn.00404ce5
inc dword [0x40e7a8]
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e3f8]
push dword [0x40e3e4]
call fcn.00407f10
pop edx
pop ecx
mov dword [0x40e7a8], ecx
add ecx, dword [0x40d338]
add edx, dword [0x40d338]
call fcn.0040ac10
je 0x4017fe
mov ebx, dword [0x40e490]
cmp ebx, 1
jne 0x4017fe
mov eax, 1
jmp 0x401800
xor eax, eax
and eax, eax
je 0x401a00
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
call fcn.00408055
inc dword [0x40e7a8]
push dword [0x40e484]
mov edx, dword [0x40d338]
add dword [esp + 4], edx
call fcn.00404917
push 0x40e404
call fcn.0040ab90
mov edx, dword [0x40e404]
xor ecx, ecx
call fcn.0040ac10
jne 0x4019ae
mov edx, dword [0x40e404]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e44c
call fcn.0040ab90
push dword [0x40e44c]
call fcn.00408095
mov edx, dword [0x40e40c]
xor ecx, ecx
call fcn.0040ac10
jne 0x401895
push dword [0x40e40c]
call fcn.004033c5
push dword [0x40e458]
push 1
call fcn.00408630
and eax, eax
je 0x401980
push 1
call fcn.00408340
push dword [0x40e7a8]
push 0x24
mov edx, dword [0x40e3f4]
push dword [0x40e7a8]
call fcn.0040ac40
mov edx, 0x40d021
call fcn.0040ac40
mov edx, dword [0x40e458]
call fcn.0040ac40
mov edx, 0x40d021
call fcn.0040ac40
mov edx, dword [0x40e408]
call fcn.0040ac40
inc dword [0x40e7a8]
push dword [0x40e464]
mov edx, dword [0x40d338]
add dword [esp + 4], edx
call fcn.004048a4
pop dword [0x40e7a8]
mov dword [0x40e450], eax
mov ebx, dword [0x40e450]
cmp ebx, 7
jne 0x401980
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
call fcn.00404d46
mov edx, dword [0x40d338]
add dword [esp], edx
call fcn.004080a7
mov edx, dword [0x40d338]
add dword [esp], edx
call fcn.00408095
pop dword [0x40e7a8]
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
push dword [0x40e458]
push 1
call fcn.00408560
and eax, eax
je 0x4019ae
push dword [0x40e454]
push 1
call fcn.004086e0
push 1
call fcn.00408340
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
call fcn.00404d46
mov edx, dword [0x40d338]
add dword [esp], edx
jmp loc.00410000
push 0x40d08b
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401b3c
push 0x400
call fcn.00407fb0
mov dword [0x40e43c], eax
mov edx, dword [0x40e7a8]
push edx
push edx
call fcn.0040811d
push 0x40e4c0
call fcn.0040ab90
push dword [0x40e43c]
push 0
push 0x40d01e
push dword [0x40e4c0]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e43c]
call fcn.00407ec0
push 0x40e4ac
call fcn.0040ab90
push dword [0x40e43c]
call fcn.00407fd0
push dword [0x40e4ac]
call fcn.004081ac
push dword [0x40e4ac]
call fcn.004081ba
push dword [0x40e4ac]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x40e4ac]
push dword [0x40e7a8]
call fcn.0040ac40
mov edx, str.extd.exe
call fcn.0040ac40
push 0x40e448
call fcn.0040ab90
push dword [0x40e448]
push 0
call fcn.00408560
push dword [0x40e3f8]
push dword [0x40e3e4]
push 0
call fcn.00408760
push 0
call fcn.00408340
mov edx, dword [0x40e448]
push dword [0x40e7a8]
call fcn.0040ac40
push 0x40e444
call fcn.0040ab90
push dword [0x40e444]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x40e444]
push str.b2eextd
call fcn.00404da1
push str._call:extd
push str.extd
call fcn.00404da1
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
mov edx, str.BDFI
call fcn.0040ac40
mov edx, dword [0x40e458]
call fcn.0040ac40
push 0x40e458
call fcn.0040ab90
push dword [0x40e458]
push 1
call fcn.00408560
and eax, eax
je 0x401c6e
push str._shift__0
push 1
call fcn.004087c0
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00407ec0
inc dword [0x40e7a8]
mov edx, dword [0x40d338]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40e7a8]
push eax
call fcn.00407ec0
inc dword [0x40e7a8]
push 0x40d08d
mov edx, dword [0x40d338]
add dword [esp + 4], edx
call fcn.00404da1
pop dword [0x40e7a8]
push dword [0x40e454]
push 1
call fcn.004087c0
push 0x40d08b
push dword [0x40e440]
call fcn.004037f1
and eax, eax
je 0x401c62
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
mov ebp, 0x40d335
mov ebx, ebp
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
sub ebx, ebp
push ebx
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
push ebp
call fcn.00407f10
inc dword [0x40e7a8]
push 1
mov edx, dword [0x40d338]
add dword [esp + 4], edx
call fcn.004087c0
pop dword [0x40e7a8]
push 1
call fcn.00408340
jmp 0x401ca9
push dword [0x40e458]
call fcn.004081ac
call fcn.00403b05
push 0x10
push dword [0x40e45c]
push dword [0x40e4b4]
call fcn.004048a4
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401fd5
mov edx, dword [0x40e40c]
xor ecx, ecx
call fcn.0040ac10
jne 0x401cc3
push dword [0x40e40c]
call fcn.004033c5
push 0x400
call fcn.00407fb0
mov dword [0x40e4a4], eax
mov edx, dword [0x40e7a8]
push edx
push edx
call fcn.0040811d
push 0x40e400
call fcn.0040ab90
push dword [0x40e4a4]
push 0
push 0x40d01e
push dword [0x40e400]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e4a4]
call fcn.00407ec0
push 0x40e4bc
call fcn.0040ab90
mov edx, dword [0x40e7a8]
push edx
push edx
push 0x800
call fcn.004040f0
push 0x40e474
call fcn.0040ab90
push dword [0x40e7a8]
push 0x800
push dword [0x40e474]
mov edx, dword [0x40e7a8]
push edx
push edx
call fcn.00404d46
inc dword [0x40e7a8]
mov edx, dword [0x40d338]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x40e7a8]
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
call fcn.00404d46
inc dword [0x40e7a8]
push str.b2eprogramname
mov edx, dword [0x40d338]
add dword [esp + 4], edx
call fcn.00404da1
pop dword [0x40e7a8]
mov edx, dword [0x40e7a8]
push edx
push edx
mov edx, dword [0x40e7a8]
push edx
push edx
push dword [0x40e7a8]
jmp loc.00410850
push 0
call 0x401fef
call fcn.0040ab60
push dword [0x40e3d8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405480
call fcn.00405801
call fcn.00406569
call fcn.004075df
call fcn.00407ddd
call fcn.004082ea
call fcn.004083b0
call fcn.00408dde
call fcn.00407eb0
ret