Function at 0x403fc5
Capabilities:
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push ebx
push esi
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
mov dword [ebp - 8], 0x44c56106
or dword [ebp - 0x138], 0xffffffff
xor eax, dword [ebp - 0x138]
mov dword [ebp - 0x14], eax
not dword [ebp - 0x14]
not eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x10], 0
push 0xd0
push 0xbe
push 0x91
push 0x62
push 0xcf
push 0x40
push 0x19
pop eax
call fcn.00403d5c
add esp, 0x18
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
push 0x2d
push 0xf0
push 0x37
push 0xf8
push 0x9c
push 0x75
push dword [ebp - 0x14]
push 0x22
pop eax
call fcn.00403d78
add esp, 0x1c
mov dword [ebp - 0x14], eax
push 0x58
call dword [sym.imp.USER32.dll_CharLowerW]
cmp eax, 0x78
jne 0x4047df
and dword [ebp - 0x2d0], 0
lea eax, [ebp - 0x2c8]
push eax
call fcn.00404a32
pop ecx
and dword [ebp - 0x1ac], 0
jmp 0x404264
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xa
jge 0x40427a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x404257
lea eax, [ebp - 0x2c0]
push eax
call fcn.00404a32
pop ecx
and dword [ebp - 0x1ac], 0
jmp 0x40429d
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xa
jge 0x4042b3
push str.kernelzdef
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x404290
lea eax, [ebp - 0x1b4]
push eax
call fcn.00404a32
pop ecx
mov eax, dword [ebp - 0x2c0]
sub eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1b4]
sub eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x10
jle 0x404303
and dword [ebp - 0x2d4], 0
jmp 0x404321
mov eax, dword [ebp - 0x1a8]
shl eax, 1
cmp eax, dword [ebp - 0x2cc]
ja 0x404241
mov dword [ebp - 0x2d4], 1
cmp dword [ebp - 0x2d4], 0
je 0x4047df
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x2e0]
add eax, 0x74f56eea
mov dword [ebp - 0x2e8], eax
mov eax, dword [0x428ee8]
or eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
mov dword [0x428ee8], eax
push dword [sym.imp.USER32.dll_SendMessageA]
pop dword [ebp - 0x3b4]
xor ecx, ecx
or ecx, 0x48a9de65
mov eax, dword [ebp - 0x3b4]
movzx eax, byte [eax]
shl eax, 0x15
xor edx, edx
div ecx
mov dword [ebp - 0x2f8], eax
mov eax, dword [0x428ee8]
imul eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
and eax, 0x485
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x2f4], eax
mov eax, dword [0x428ee8]
add eax, 0x64bd
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x3b4]
movzx eax, byte [eax]
shl eax, 2
imul eax, dword [ebp - 0x304]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x308]
or ecx, 0xe43eaea2
xor eax, eax
xor edx, edx
div ecx
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
and eax, 0x7c
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x2f4]
mov al, byte [eax]
mov byte [ebp - 0x2ed], al
mov eax, dword [ebp - 0x3b4]
movzx eax, byte [eax]
shl eax, 0x1c
push eax
push 0
call fcn.00403f54
pop ecx
pop ecx
mov dword [0x428ee8], eax
movzx eax, byte [ebp - 0x2ed]
cmp eax, 0xe9
je 0x404464
and dword [ebp - 0x3b8], 0
jmp 0x4047d6
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x2e0], eax
mov eax, dword [0x428ee8]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x2e0]
mov eax, dword [eax]
mov dword [ebp - 0x320], eax
push str._k_RjtrXnO3Ymzhe_._Pe
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x180
add eax, dword [ebp - 0x324]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x320]
xor eax, dword [ebp - 0x314]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
xor eax, 0x1e
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x2e0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3b4]
lea eax, [ecx + eax + 5]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x328], 0x4e99
mov eax, dword [0x428ee8]
xor eax, dword [ebp - 0x328]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x2e0]
mov eax, dword [eax]
xor eax, dword [ebp - 0x32c]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax + 0xf]
sub eax, dword [ebp - 0x330]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [0x428ee8], eax
xor ecx, ecx
or ecx, 0x48a9de65
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax]
shl eax, 0x15
xor edx, edx
div ecx
mov dword [ebp - 0x340], eax
mov eax, dword [0x428ee8]
imul eax, dword [ebp - 0x340]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
and eax, 0x485
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x33c], eax
mov eax, dword [0x428ee8]
add eax, 0x64bd
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax]
shl eax, 2
imul eax, dword [ebp - 0x34c]
mov dword [ebp - 0x350], eax
mov ecx, dword [ebp - 0x350]
or ecx, 0xe43eaea2
xor eax, eax
xor edx, edx
div ecx
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
and eax, 0x7c
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x33c]
mov al, byte [eax]
mov byte [ebp - 0x335], al
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax]
shl eax, 0x1c
push eax
push 0
call fcn.00403f54
pop ecx
pop ecx
mov dword [0x428ee8], eax
movzx eax, byte [ebp - 0x335]
cmp eax, 0xe9
je 0x404630
and dword [ebp - 0x3b8], 0
jmp 0x4047d6
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax + 1]
push eax
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax]
call fcn.00403d23
pop ecx
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [0x428ee8]
xor ecx, dword [eax]
mov dword [ebp - 0x370], ecx
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax + 9]
sub eax, dword [ebp - 0x370]
mov dword [ebp - 0x374], eax
push 0x46
pop eax
sub eax, dword [ebp - 0x374]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x2d8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2e4]
lea eax, [ecx + eax + 5]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax + 6]
mov ecx, dword [ebp - 0x2e0]
push dword [ecx]
call fcn.00403d48
pop ecx
mov dword [0x428ee8], eax
push 0xc
pop ecx
or ecx, 0x48a9de65
mov eax, dword [ebp - 0x2dc]
movzx eax, byte [eax]
shl eax, 0x15
xor edx, edx
div ecx
mov dword [ebp - 0x384], eax
mov eax, dword [0x428ee8]
imul eax, dword [ebp - 0x384]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
and eax, 0x485
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x2dc]
add eax, 0xc
mov dword [ebp - 0x380], eax
mov eax, dword [0x428ee8]
add eax, 0x64bd
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x2dc]
movzx eax, byte [eax]
shl eax, 2
imul eax, dword [ebp - 0x390]
mov dword [ebp - 0x394], eax
mov ecx, dword [ebp - 0x394]
or ecx, 0xe43eaea2
push 0xc
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
and eax, 0x7c
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [0x428ee8], eax
mov eax, dword [ebp - 0x380]
mov al, byte [eax]
mov byte [ebp - 0x379], al
mov eax, dword [ebp - 0x2dc]
movzx eax, byte [eax]
shl eax, 0x1c
push eax
push 0xc
call fcn.00403f54
pop ecx
pop ecx
mov dword [0x428ee8], eax
movzx eax, byte [ebp - 0x379]
cmp eax, 0xe8
je 0x4047cc
and dword [ebp - 0x3b8], 0
jmp 0x4047d6
mov dword [ebp - 0x3b8], 1
cmp dword [ebp - 0x3b8], 0
je 0x4047fe
push 0x50
pop eax
or eax, 0x65d7eefd
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x1c]
push eax
push 0x428d5c
push reloc.OLEAUT32.dll_SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 6
je 0x404847
push dword [ebp - 0x130]
mov ecx, 0xe2
push 3
pop eax
push 0x13
pop edx
call fcn.00403db0
pop ecx
mov dword [ebp - 0x14], eax
jmp fcn.00404a53
and dword [ebp - 0x504], 0
lea eax, [ebp - 0x4fc]
push eax
call fcn.00404a32
pop ecx
and dword [ebp - 0x3e0], 0
jmp 0x404871
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0xa
jge 0x404887
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x404864
lea eax, [ebp - 0x4f4]
push eax
jmp 0x432fd1