Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0xf8
push 0
push 0x40d330
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40d334], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40d330], eax
call section..text
call fcn.004095f0
call fcn.0040949c
call fcn.004079c3
call fcn.004074f3
call fcn.00406ea0
call fcn.00406b29
call fcn.00406970
call fcn.00406952
call fcn.004068c9
call fcn.00406031
call fcn.00405060
call fcn.00404271
call fcn.00404009
call fcn.00403bf5
call fcn.0040386d
push dword [0x40d420]
call fcn.00404028
push 7
push 0x40c27c
lea eax, [0x40d420]
push eax
push 8
call fcn.00403f77
push 0x40d418
push 0x40c284
push 7
push 0x401
push 8
call fcn.0040939d
mov edx, str.Continue_
lea ecx, [0x40d348]
call fcn.00403068
mov edx, str.Error_
lea ecx, [0x40d404]
call fcn.00403068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40d370]
call fcn.00403068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40d3b4]
call fcn.00403068
mov edx, str.Wrong_password.
lea ecx, [0x40d3d8]
call fcn.00403068
mov edx, 0x40c025
lea ecx, [0x40d3b8]
call fcn.00403068
mov edx, str.The_file
lea ecx, [0x40d34c]
call fcn.00403068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40d360]
call fcn.00403068
mov edx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea ecx, [0x40d3b0]
call fcn.00403068
mov edx, str.This_program_is_not_supported_on_your_operating_system.
lea ecx, [0x40d3ec]
call fcn.00403068
mov edx, str.Choose_a_location_to_save_the_files.
lea ecx, [0x40d3d4]
call fcn.00403068
mov edx, str.Password
lea ecx, [0x40d3f0]
call fcn.00403068
mov edx, str.Please_enter_the_password.
lea ecx, [0x40d388]
call fcn.00403068
call fcn.00404e1f
mov ebx, eax
cmp ebx, 0x32
jge 0x4011ca
push 0x10
push dword [0x40d3ec]
push dword [0x40d404]
call fcn.004038a4
jmp 0x401f8b
lea eax, [0x402274]
push eax
call fcn.00403e10
call fcn.00403d33
mov dword [0x40d3e0], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40d394], eax
mov edx, dword [0x40d6f0]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004069a0
push 0x40d3dc
call fcn.00409670
push dword [0x40d3dc]
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov ebx, dword [0x40d3e0]
and ebx, ebx
jle 0x401333
mov dword [0x40d374], 0
mov ebx, dword [0x40d3e0]
dec ebx
cmp ebx, dword [0x40d374]
jl 0x4012b6
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d374]
call fcn.00403ce5
push 0x40d3c8
call fcn.00409670
push dword [0x40d3c8]
mov edx, str._b2epass
pop ecx
call fcn.004096f0
je 0x40127a
mov dword [0x40d36c], 1
jmp 0x4012aa
mov ebx, dword [0x40d36c]
cmp ebx, 1
jne 0x4012aa
mov edx, dword [0x40d3c8]
push dword [0x40d6f0]
call fcn.00409720
push 0x40d3f8
call fcn.00409670
mov dword [0x40d36c], 0
inc dword [0x40d374]
jno 0x40122f
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004069a0
inc dword [0x40d6f0]
mov edx, dword [0x40c33c]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40d6f0]
push eax
call fcn.004069a0
push 0x40d38c
call fcn.00409670
mov edx, dword [0x40d3dc]
push dword [0x40d6f0]
call fcn.00409720
mov edx, 0x40c01f
call fcn.00409720
mov edx, dword [0x40d38c]
call fcn.00409720
push 0x40d38c
call fcn.00409670
jmp 0x40134e
mov edx, dword [0x40d3dc]
push dword [0x40d6f0]
call fcn.00409720
push 0x40d38c
call fcn.00409670
push 0x40c085
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401379
mov eax, dword [0x40d33c]
mov dword [0x40d3c0], eax
push dword [0x40d3c0]
call fcn.0040237a
jmp 0x401399
push 0x10
push dword [0x40d3b0]
push dword [0x40d404]
call fcn.004038a4
push 1
jmp 0x401f90
push str.NOPSX
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x4013d2
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d350]
push dword [0x40d33c]
call fcn.004069f0
push 0x40d3ac
call fcn.00409670
jmp 0x4013f2
push 0x10
push dword [0x40d3b0]
push dword [0x40d404]
call fcn.004038a4
push 1
jmp 0x401f90
push 0x40c06c
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401426
mov eax, dword [0x40d33c]
mov dword [0x40d378], eax
mov eax, dword [0x40d350]
mov dword [0x40d340], eax
mov eax, dword [0x40d378]
mov dword [0x40d3e8], eax
jmp 0x401446
push 0x10
push dword [0x40d3b0]
push dword [0x40d404]
call fcn.004038a4
push 1
jmp 0x401f90
push 0x40c072
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401478
mov eax, dword [0x40d33c]
mov dword [0x40d380], eax
mov eax, dword [0x40d350]
mov dword [0x40d384], eax
mov eax, dword [0x40d380]
mov dword [0x40d3bc], eax
push 0x40c070
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x4014aa
mov eax, dword [0x40d33c]
mov dword [0x40d37c], eax
mov eax, dword [0x40d350]
mov dword [0x40d344], eax
mov eax, dword [0x40d37c]
mov dword [0x40d408], eax
push 0x40c087
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401742
mov edx, dword [0x40d3f8]
xor ecx, ecx
call fcn.004096f0
jne 0x4014f1
mov edx, dword [0x40d3f8]
push dword [0x40d6f0]
call fcn.00409720
push 0x40d3d0
call fcn.00409670
jmp 0x401665
push 0xc80001
push dword [0x40d3f0]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00405370
push dword [0x40d388]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00404553
push 0x20
push 0x40c01e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.0040472c
push 0x40c201
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00404a39
push 4
push 0xd
push 0
call fcn.00405393
push 2
call fcn.00404a59
call fcn.00405597
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4015d1
push dword [0x40d400]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401f90
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401619
call fcn.004075bc
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401616
mov edx, dword [0x40d6f0]
push edx
push edx
push 2
call fcn.00404a94
push 0x40d3d0
call fcn.00409670
push 0
call fcn.00404f33
add esp, 8
jmp 0x401665
pop eax
jmp 0x40165f
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40165f
call fcn.004075cb
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40165e
mov edx, dword [0x40d6f0]
push edx
push edx
push 2
call fcn.00404a94
push 0x40d3d0
call fcn.00409670
push 0
call fcn.00404f33
add esp, 8
jmp 0x401665
pop eax
pop eax
jmp 0x4015a7
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d3d0]
call fcn.004030c0
push eax
mov eax, dword [0x40d3d0]
push eax
call fcn.00407f80
inc dword [0x40d6f0]
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d350]
push dword [0x40d33c]
call fcn.004069f0
pop edx
pop ecx
mov dword [0x40d6f0], ecx
add ecx, dword [0x40c33c]
add edx, dword [0x40c33c]
call fcn.004096f0
jne 0x4016e9
push 0x10
push dword [0x40d3d8]
push dword [0x40d404]
call fcn.004038a4
push dword [0x40d400]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401f90
push 0x40c089
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401707
mov eax, dword [0x40d33c]
mov dword [0x40d3e4], eax
push dword [0x40d344]
push dword [0x40d384]
push dword [0x40d340]
push dword [0x40d3e4]
push dword [0x40d37c]
push dword [0x40d380]
push dword [0x40d378]
push dword [0x40d3d0]
push dword [0x40d394]
call fcn.0040293b
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d340]
push dword [0x40d3e8]
call fcn.004069f0
push 0x40d3a8
call fcn.00409670
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d384]
push dword [0x40d3bc]
call fcn.004069f0
push 0x40d364
call fcn.00409670
push 0x40c06e
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401a00
mov edx, dword [0x40d6f0]
push edx
push edx
push 0
call fcn.00403ce5
inc dword [0x40d6f0]
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d350]
push dword [0x40d33c]
call fcn.004069f0
pop edx
pop ecx
mov dword [0x40d6f0], ecx
add ecx, dword [0x40c33c]
add edx, dword [0x40c33c]
call fcn.004096f0
je 0x4017fe
mov ebx, dword [0x40d3e0]
cmp ebx, 1
jne 0x4017fe
mov eax, 1
jmp 0x401800
xor eax, eax
and eax, eax
je 0x401a00
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
call fcn.00406b35
inc dword [0x40d6f0]
push dword [0x40d3d4]
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403917
push 0x40d35c
call fcn.00409670
mov edx, dword [0x40d35c]
xor ecx, ecx
call fcn.004096f0
jne 0x4019ae
mov edx, dword [0x40d35c]
push dword [0x40d6f0]
call fcn.00409720
push 0x40d3a0
call fcn.00409670
push dword [0x40d3a0]
call fcn.00406b75
mov edx, dword [0x40d364]
xor ecx, ecx
call fcn.004096f0
jne 0x401895
push dword [0x40d364]
call fcn.004024a8
push dword [0x40d3ac]
push 1
call fcn.00407110
and eax, eax
je 0x401980
push 1
call fcn.00406e20
push dword [0x40d6f0]
push 0x24
mov edx, dword [0x40d34c]
push dword [0x40d6f0]
call fcn.00409720
mov edx, 0x40c021
call fcn.00409720
mov edx, dword [0x40d3ac]
call fcn.00409720
mov edx, 0x40c021
call fcn.00409720
mov edx, dword [0x40d360]
call fcn.00409720
inc dword [0x40d6f0]
push dword [0x40d3b8]
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.004038a4
pop dword [0x40d6f0]
mov dword [0x40d3a4], eax
mov ebx, dword [0x40d3a4]
cmp ebx, 7
jne 0x401980
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call fcn.00403d46
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b87
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b75
pop dword [0x40d6f0]
push dword [0x40d400]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401f90
push dword [0x40d3ac]
push 1
call fcn.00407040
and eax, eax
je 0x4019ae
push dword [0x40d3a8]
push 1
call fcn.004071c0
push 1
call fcn.00406e20
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call fcn.00403d46
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b87
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b75
pop dword [0x40d6f0]
push dword [0x40d400]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401f90
push 0x40c08b
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401b3c
push 0x400
call fcn.00406a90
mov dword [0x40d390], eax
mov edx, dword [0x40d6f0]
push edx
push edx
call fcn.00406bfd
push 0x40d410
call fcn.00409670
push dword [0x40d390]
push 0
push 0x40c01e
push dword [0x40d410]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d390]
call fcn.004069a0
push 0x40d3fc
call fcn.00409670
push dword [0x40d390]
call fcn.00406ab0
push dword [0x40d3fc]
call fcn.00406c8c
push dword [0x40d3fc]
call fcn.00406c9a
push dword [0x40d3fc]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x40d3fc]
push dword [0x40d6f0]
call fcn.00409720
mov edx, str.extd.exe
call fcn.00409720
push 0x40d39c
call fcn.00409670
push dword [0x40d39c]
push 0
call fcn.00407040
push dword [0x40d350]
push dword [0x40d33c]
push 0
call fcn.00407240
push 0
call fcn.00406e20
mov edx, dword [0x40d39c]
push dword [0x40d6f0]
call fcn.00409720
push 0x40d398
call fcn.00409670
push dword [0x40d398]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x40d398]
push str.b2eextd
call fcn.00403da1
push str._call:extd
push str.extd
call fcn.00403da1
mov edx, dword [0x40d400]
push dword [0x40d6f0]
call fcn.00409720
mov edx, str.BDFI
call fcn.00409720
mov edx, dword [0x40d3ac]
call fcn.00409720
push 0x40d3ac
call fcn.00409670
push dword [0x40d3ac]
push 1
call fcn.00407040
and eax, eax
je 0x401c6e
push str._shift__0
push 1
call fcn.004072a0
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004069a0
inc dword [0x40d6f0]
mov edx, dword [0x40c33c]
add dword [esp], edx
call sub.SHLWAPI.DLL_PathGetArgsA
pop dword [0x40d6f0]
push eax
call fcn.004069a0
inc dword [0x40d6f0]
push str.b2eargs
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403da1
pop dword [0x40d6f0]
push dword [0x40d3a8]
push 1
call fcn.004072a0
push 0x40c08b
push dword [0x40d394]
call fcn.004028d4
and eax, eax
je 0x401c62
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
mov ebp, 0x40c339
mov ebx, ebp
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
sub ebx, ebp
push ebx
mov ebp, str.:extd_r_n_set_result_r_n__b2eextd____1____2____3____4____5____6____7____8____9______b2etempfile___r_n_set__p_result_____b2etempfile___r_n_del___b2etempfile___r_n_goto:eof_r_n
push ebp
call fcn.004069f0
inc dword [0x40d6f0]
push 1
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.004072a0
pop dword [0x40d6f0]
push 1
call fcn.00406e20
jmp 0x401ca9
push dword [0x40d3ac]
call fcn.00406c8c
call fcn.00402be8
push 0x10
push dword [0x40d3b0]
push dword [0x40d404]
call fcn.004038a4
push dword [0x40d400]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x401f90
mov edx, dword [0x40d364]
xor ecx, ecx
call fcn.004096f0
jne 0x401cc3
push dword [0x40d364]
call fcn.004024a8
push 0x400
call fcn.00406a90
mov dword [0x40d3f4], eax
mov edx, dword [0x40d6f0]
push edx
push edx
call fcn.00406bfd
push 0x40d358
call fcn.00409670
push dword [0x40d3f4]
push 0
push 0x40c01e
push dword [0x40d358]
call sub.KERNEL32.dll_GetTempFileNameA
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d3f4]
call fcn.004069a0
push 0x40d40c
call fcn.00409670
mov edx, dword [0x40d6f0]
push edx
push edx
push 0x800
call fcn.004030f0
push 0x40d3c4
call fcn.00409670
push dword [0x40d6f0]
push 0x800
push dword [0x40d3c4]
mov edx, dword [0x40d6f0]
push edx
push edx
call fcn.00403d46
inc dword [0x40d6f0]
mov edx, dword [0x40c33c]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x40d6f0]
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call fcn.00403d46
inc dword [0x40d6f0]
push str.b2eprogramname
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403da1
pop dword [0x40d6f0]
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call fcn.00403d46
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406db8
inc dword [0x40d6f0]
push str.b2eprogramfilename
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403da1
pop dword [0x40d6f0]
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call fcn.00403d46
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b87
inc dword [0x40d6f0]
push str.b2eprogrampathname
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403da1
pop dword [0x40d6f0]
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
push dword [0x40d3c4]
call fcn.004031f0
inc dword [0x40d6f0]
push str.b2eprogramshortname
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403da1
pop dword [0x40d6f0]
mov edx, dword [0x40d3a0]
push dword [0x40d6f0]
call fcn.00409720
push 0x40d414
call fcn.00409670
push dword [0x40d414]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [0x40d414]
push 0x40c074
call fcn.00403da1
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
mov eax, dword [0x40d354]
cdq
push edx
push eax
call fcn.00403380
inc dword [0x40d6f0]
push str.b2eincfilecount
mov edx, dword [0x40c33c]
add dword [esp + 4], edx
call fcn.00403da1
pop dword [0x40d6f0]
push dword [0x40d40c]
push str.b2etempfile
call fcn.00403da1
push dword [0x40d38c]
push dword [0x40d3a0]
push dword [0x40d3ac]
call fcn.00402297
call fcn.00402be8
push dword [0x40d3ac]
call fcn.00406c8c
push dword [0x40d40c]
call fcn.00406c8c
push dword [0x40d39c]
call fcn.00406c8c
mov edx, dword [0x40d6f0]
push edx
push edx
mov edx, dword [0x40d6f0]
push edx
push edx
push dword [0x40d6f0]
call fcn.00403d46
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b87
mov edx, dword [0x40c33c]
add dword [esp], edx
call fcn.00406b75
pop dword [0x40d6f0]
push dword [0x40d3fc]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [0x40d400]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401f90
push 0
call 0x401faa
call fcn.00409640
push dword [0x40d330]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00403f60
call fcn.004042e1
call fcn.00405049
call fcn.004060bf
call fcn.004068bd
call fcn.00406dca
call fcn.00406e90
call fcn.004078be
call fcn.00406990
ret