Function at 0x404d20
Capabilities:
Copy file
Create directory
Get common file path
Persist via application shimming
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ca4
call fcn.0040c190
mov eax, dword [0x42b054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push 0x24
mov dword [ebp - 0x1c50], eax
push dword [eax + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x42c178]
cmp byte [eax + 0x68], 0
je 0x404d97
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x404d75
mov dword [eax + 0x40], 5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c175
mov esp, ebp
pop ebp
ret 0x10
push 0
push 5
push 0x465
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c175
mov esp, ebp
pop ebp
ret 0x10
push ebx
push esi
push 0x42c180
lea ecx, [ebp - 0x1c3c]
call fcn.00401e00
mov esi, dword [ebp - 0x1c3c]
cmp dword [esi - 8], 0
jle 0x404dd0
push 0x28
push esi
call fcn.0040d9da
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x404dcc
sub ecx, esi
sar ecx, 1
jns 0x404df4
cmp dword [esi - 8], 0
jge 0x404dd7
or ecx, 0xffffffff
jmp 0x404df4
push 0x4216e8
push esi
call fcn.0040db28
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x404df0
or ecx, 0xffffffff
jmp 0x404df4
sub ecx, esi
sar ecx, 1
or ebx, 0xffffffff
test ecx, ecx
jle 0x404e5e
cmp ecx, dword [esi - 8]
mov eax, dword [0x42b014]
cmovg ecx, dword [esi - 8]
push 0
push 0
mov dword [ebp - 0x1c24], eax
lea eax, [ebp - 0x1c24]
push ecx
push eax
lea ecx, [ebp - 0x1c3c]
call fcn.00402470
lea eax, [ebp - 0x1c24]
push eax
lea ecx, [ebp - 0x1c3c]
call fcn.00402160
mov eax, dword [ebp - 0x1c24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x404e5e
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x404e5e
push ecx
call fcn.0040be90
add esp, 4
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
push 0
push dword [0x42c188]
push 0
call esi
mov eax, dword [0x42b014]
push str.project_
mov dword [ebp - 0x1c6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.project_
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c6c]
push eax
push dword [eax - 8]
call fcn.00402700
mov edi, dword [ebp - 0x1c6c]
push 0
push edi
push 0
call esi
push dword [0x42c188]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [0x42b014]
push str.uninstall.dat
mov dword [ebp - 0x1c2c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.uninstall.dat
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c2c]
push eax
push dword [eax - 8]
call fcn.00402700
mov esi, dword [ebp - 0x1c2c]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x42c16c], eax
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x404f30
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x404f30
push esi
call fcn.0040be90
add esp, 4
lea ecx, [ebp - 0x19bc]
call fcn.00401b30
lea ecx, [ebp - 0x89c]
mov dword [ebp - method.Cabinet::CExtract.virtual_0], 0x4214e0
call fcn.00401fa0
lea ecx, [ebp - 0x19bc]
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x870], 0
call fcn.00402900
push dword [0x42c188]
mov dword [ebp - 0x1ca0], 0
lea ecx, [ebp - 0x1c30]
mov dword [ebp - 0x1c9c], 0
mov dword [ebp - 0x1c98], 0
mov dword [ebp - 0x1ca4], 0x4049a0
movups xmm0, xmmword [ebp - 0x1ca4]
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 0
movups xmmword [ebp - 0x1994], xmm0
mov dword [ebp - 0x1c8c], 0
mov dword [ebp - 0x1c88], 0xc8
movups xmm0, xmmword [ebp - 0x1c94]
movups xmmword [ebp - 0x1984], xmm0
call fcn.00401d50
push str.CABFILE
lea ecx, [ebp - 0x1c44]
call fcn.00401d50
push 0x421398
lea ecx, [ebp - 0x1c38]
call fcn.00401d50
push 0
lea eax, [ebp - 0x1c30]
push eax
lea eax, [ebp - 0x1c44]
push eax
push 0x10
lea eax, [ebp - 0x1c38]
push eax
lea ecx, [ebp - 0x19bc]
call fcn.00403850
push dword [ebp - 0x1c38]
call fcn.0040be90
push dword [ebp - 0x1c44]
call fcn.0040be90
push dword [ebp - 0x1c30]
call fcn.0040be90
mov eax, dword [0x42b014]
lea ecx, [ebp - 0x1c4c]
add esp, 0xc
mov dword [ebp - 0x1c5c], 0
mov dword [ebp - 0x1c58], 0
mov dword [ebp - 0x1c54], 0
mov dword [ebp - 0x1c68], 0
push 0x82
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x1c60], 0
mov dword [ebp - 0x1c4c], eax
call fcn.00404800
lea ecx, [ebp - 0x1c4c]
call fcn.004070b0
lea eax, [ebp - 0x1c10]
mov dword [ebp - 0x1c10], 0
push eax
push 0x42171c
lea eax, [ebp - 0x1c28]
push eax
lea ecx, [ebp - 0x1c4c]
call fcn.00407010
mov eax, dword [ebp - 0x1c28]
mov edx, dword [eax - 8]
test edx, edx
je 0x405372
mov ebx, 0x11
mov dword [ebp - 0x1c24], ebx
mov ecx, dword [0x42b014]
push eax
push edx
push edi
push dword [edi - 8]
mov dword [ebp - 0x1c48], ecx
lea ecx, [ebp - 0x1c48]
call fcn.00402700
mov esi, dword [ebp - 0x1c48]
lea ecx, [ebp - 0x1c18]
push esi
call fcn.00401d50
push str.CABFILE
lea ecx, [ebp - 0x1c44]
call fcn.00401d50
push 0x421398
lea ecx, [ebp - 0x1c38]
call fcn.00401d50
push 0
lea eax, [ebp - 0x1c18]
push eax
lea eax, [ebp - 0x1c44]
push eax
push ebx
lea eax, [ebp - 0x1c38]
push eax
lea ecx, [ebp - 0x19bc]
call fcn.00403850
push dword [ebp - 0x1c38]
test eax, eax
sete bl
call fcn.0040be90
push dword [ebp - 0x1c44]
call fcn.0040be90
push dword [ebp - 0x1c18]
call fcn.0040be90
add esp, 0xc
test bl, bl
jne 0x40534d
mov ebx, dword [ebp - 0x1c58]
mov edx, dword [ebp - 0x1c54]
mov eax, dword [ebp - 0x1c5c]
cmp ebx, edx
jne 0x405211
lea ecx, [ebp - 0x1c48]
cmp ecx, eax
jb 0x4051d8
lea eax, [eax + edx*4]
cmp ecx, eax
jb 0x4065bf
mov eax, dword [ebp - 0x1c5c]
test edx, edx
jne 0x4051e1
lea ebx, [edx + 1]
jmp 0x4051ed
add ebx, ebx
js 0x40522b
cmp ebx, 0x1fffffff
ja 0x40522b
push 4
push ebx
push eax
call fcn.004103e1
add esp, 0xc
test eax, eax
je 0x40522b
mov edx, ebx
mov dword [ebp - 0x1c5c], eax
mov ebx, dword [ebp - 0x1c58]
mov dword [ebp - 0x1c54], edx
lea ecx, [eax + ebx*4]
test ecx, ecx
je 0x405224
lea eax, [ebp - 0x1c48]
push eax
call fcn.00401e00
inc ebx
mov dword [ebp - 0x1c58], ebx
mov edx, dword [ebp - 0x1c60]
mov ebx, dword [ebp - 0x1c64]
mov eax, dword [ebp - 0x1c68]
cmp ebx, edx
jne 0x405295
lea ecx, [ebp - 0x1c28]
cmp ecx, eax
jb 0x40525c
lea eax, [eax + edx*4]
cmp ecx, eax
jb 0x4065bf
mov eax, dword [ebp - 0x1c68]
test edx, edx
jne 0x405265
lea ebx, [edx + 1]
jmp 0x405271
add ebx, ebx
js 0x4052af
cmp ebx, 0x1fffffff
ja 0x4052af
push 4
push ebx
push eax
call fcn.004103e1
add esp, 0xc
test eax, eax
je 0x4052af
mov edx, ebx
mov dword [ebp - 0x1c68], eax
mov ebx, dword [ebp - 0x1c64]
mov dword [ebp - 0x1c60], edx
lea ecx, [eax + ebx*4]
test ecx, ecx
je 0x4052a8
lea eax, [ebp - 0x1c28]
push eax
call fcn.00401e00
inc ebx
mov dword [ebp - 0x1c64], ebx
inc dword [ebp - 0x1c24]
lea eax, [ebp - 0x1c10]
push eax
push 0x42171c
lea eax, [ebp - 0x1c2c]
push eax
lea ecx, [ebp - 0x1c4c]
call fcn.00407010
push eax
lea ecx, [ebp - 0x1c28]
call fcn.00402160
mov eax, dword [ebp - 0x1c2c]
or ebx, 0xffffffff
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405313
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405313
mov eax, dword [ebp - 0x1c2c]
add eax, 0xfffffff4
push eax
call fcn.0040be90
add esp, 4
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x405335
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x405335
push esi
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c28]
mov edx, dword [eax - 8]
test edx, edx
je 0x405372
mov ebx, dword [ebp - 0x1c24]
jmp 0x405104
lea eax, [esi - 0xc]
or ebx, 0xffffffff
cmp eax, dword [0x42b010]
je 0x405372
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x405372
push esi
call fcn.0040be90
add esp, 4
mov eax, dword [0x42b014]
lea ecx, [ebp - 0x1c24]
push 0x83
mov dword [ebp - 0x1c24], eax
call fcn.00404800
lea eax, [ebp - 0x1c10]
mov dword [ebp - 0x1c10], 0
push eax
push 0x42171c
lea eax, [ebp - 0x1c2c]
push eax
lea ecx, [ebp - 0x1c24]
call fcn.00407010
push eax
lea ecx, [ebp - 0x1c28]
call fcn.00402160
mov eax, dword [ebp - 0x1c2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4053f2
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4053f2
mov eax, dword [ebp - 0x1c2c]
add eax, 0xfffffff4
push eax
call fcn.0040be90
add esp, 4
mov edi, dword [ebp - 0x1c28]
cmp dword [edi - 8], 0
je 0x40564a
mov dword [ebp - 0x1c20], 0x20
nop dword [eax]
mov esi, dword [0x42b014]
push 0x421720
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov eax, dword [0x42c188]
mov dword [ebp - 0x1c34], eax
mov dword [ebp - 0x1c40], ecx
mov eax, dword [eax - 8]
mov dword [ebp - 0x1c14], eax
lea ebx, [ecx + eax]
mov dword [ebp - 0x1c2c], ebx
cmp ebx, eax
jl 0x4054e6
cmp ebx, ecx
jl 0x4054e6
test ebx, ebx
je 0x4054e6
lea eax, [ebx*2 + 0xe]
push eax
call fcn.00403940
add esp, 4
test eax, eax
je 0x4054e6
mov dword [eax], 1
lea esi, [eax + 0xc]
xor ecx, ecx
mov word [eax + ebx*2 + 0xc], cx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov eax, dword [ebp - 0x1c14]
lea ebx, [eax + eax]
mov eax, dword [ebp - 0x1c2c]
push ebx
push dword [ebp - 0x1c34]
lea eax, [eax*2 + 2]
push eax
push esi
call fcn.00408cc0
push eax
call fcn.00401630
mov eax, dword [ebp - 0x1c40]
add eax, eax
push eax
mov eax, dword [ebp - 0x1c2c]
sub eax, dword [ebp - 0x1c14]
push 0x421720
lea eax, [eax*2 + 2]
push eax
lea eax, [ebx + esi]
push eax
call fcn.00408cc0
push eax
call fcn.00401630
add esp, 0x28
mov eax, dword [0x42b014]
lea ecx, [ebp - 0x1c2c]
push edi
push dword [edi - 8]
mov dword [ebp - 0x1c2c], eax
push esi
push dword [esi - 8]
call fcn.00402700
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x405527
add esi, 0xfffffff4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x405527
push esi
call fcn.0040be90
add esp, 4
mov esi, dword [ebp - 0x1c2c]
lea ecx, [ebp - 0x1c84]
push esi
call fcn.00401d50
push str.CABFILE
lea ecx, [ebp - 0x1c7c]
call fcn.00401d50
push 0x421398
lea ecx, [ebp - 0x1c74]
call fcn.00401d50
mov edi, dword [ebp - 0x1c20]
lea eax, [ebp - 0x1c84]
push 0
push eax
lea eax, [ebp - 0x1c7c]
push eax
push edi
lea eax, [ebp - 0x1c74]
push eax
lea ecx, [ebp - 0x19bc]
call fcn.00403850
push dword [ebp - 0x1c74]
test eax, eax
sete bl
call fcn.0040be90
push dword [ebp - 0x1c7c]
call fcn.0040be90
push dword [ebp - 0x1c84]
call fcn.0040be90
add esp, 0xc
test bl, bl
jne 0x4059f7
lea eax, [ebp - 0x1c10]
inc edi
push eax
push 0x42171c
lea eax, [ebp - 0x1c1c]
mov dword [ebp - 0x1c20], edi
push eax
lea ecx, [ebp - 0x1c24]
call fcn.00407010
push eax
lea ecx, [ebp - 0x1c28]
call fcn.00402160
mov eax, dword [ebp - 0x1c1c]
or ebx, 0xffffffff
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405618
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405618
mov eax, dword [ebp - 0x1c1c]
add eax, 0xfffffff4
push eax
call fcn.0040be90
add esp, 4
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x40563a
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x40563a
push esi
call fcn.0040be90
add esp, 4
mov edi, dword [ebp - 0x1c28]
cmp dword [edi - 8], 0
jne 0x405410
or ebx, 0xffffffff
mov eax, dword [0x42c168]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add eax, 0x157c0
push 0
push eax
mov dword [0x42c168], eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call esi
call fcn.004046f0
test al, al
jne 0x4056a2
push dword [0x42c188]
lea eax, [ebp - 0x20c]
push str.msiexec__quiet__i___sOPC_Core_Components_Redistributable.msi_
push eax
call fcn.00407150
lea eax, [ebp - 0x20c]
push eax
call fcn.00406bf0
add esp, 0x10
mov eax, dword [0x42c168]
add eax, 0x101d0
push 0
push eax
mov dword [0x42c168], eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call esi
mov edi, dword [ebp - 0x1c50]
push str.TsUpdate.dll
push dword [edi + 4]
call fcn.00406a00
mov eax, dword [0x42c168]
add esp, 8
add eax, 0x101d0
mov dword [0x42c168], eax
push 0
push eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call esi
push str.TsDBAccess.dll
push dword [edi + 4]
call fcn.00406a00
mov eax, dword [0x42c168]
add esp, 8
add eax, 0x101d0
mov dword [0x42c168], eax
push 0
push eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call esi
push str.TsFileLib.dll
push dword [edi + 4]
call fcn.00406a00
mov eax, dword [0x42c168]
add esp, 8
add eax, 0x101d0
mov dword [0x42c168], eax
push 0
push eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call esi
mov eax, dword [0x42b014]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.TsStudio.chm
mov dword [ebp - 0x1c2c], eax
call esi
push str.TsStudio.chm
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c2c]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c0c]
push eax
push dword [ebp - 0x1c2c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, 0xffffffff
je 0x405856
push eax
call edi
lea eax, [ebp - 0x1be0]
push eax
lea ecx, [ebp - 0x1c14]
call fcn.00401f30
mov eax, dword [0x42b014]
push str._u7bKb
mov dword [ebp - 0x1c20], eax
call esi
push str._u7bKb
push eax
mov eax, dword [ebp - 0x1c3c]
lea ecx, [ebp - 0x1c20]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c20]
push eax
lea eax, [ebp - 0x1c14]
push eax
push 0
call fcn.00402bc0
mov eax, dword [ebp - 0x1c20]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x40582e
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40582e
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405856
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405856
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [0x42b014]
push str.TsStudio.exe
mov dword [ebp - 0x1c20], eax
call esi
push str.TsStudio.exe
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c20]
push eax
push dword [eax - 8]
call fcn.00402700
mov esi, dword [ebp - 0x1c20]
lea eax, [ebp - 0x86c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x405b1e
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.__AddProject
call esi
push str.__AddProject
push eax
lea ecx, [ebp - 0x1c20]
call fcn.004027a0
mov eax, dword [ebp - 0x1c58]
xor edi, edi
test eax, eax
jle 0x405980
mov ecx, dword [ebp - 0x1c5c]
mov esi, dword [ebp - 0x1c68]
sub esi, ecx
mov dword [ebp - 0x1c14], ecx
mov dword [ebp - 0x1c50], esi
mov esi, dword [ebp - 0x1c20]
test edi, edi
js 0x405b95
cmp edi, dword [ebp - 0x1c64]
jge 0x405b95
cmp edi, eax
jge 0x405b95
mov eax, dword [ebp - 0x1c50]
push dword [eax + ecx]
lea eax, [ebp - 0x414]
push dword [ecx]
push esi
push str._s_s_s.tpj_
push eax
call fcn.00407150
lea eax, [ebp - 0x414]
push eax
call fcn.00406bf0
mov eax, dword [0x42c168]
add esp, 0x18
add eax, 0x101d0
mov dword [0x42c168], eax
push 0
push eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x1c14]
inc edi
mov eax, dword [ebp - 0x1c58]
add ecx, 4
mov dword [ebp - 0x1c14], ecx
cmp edi, eax
jl 0x4058f0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x42c188]
lea eax, [ebp - 0x414]
push str._sTsStudio.exe_RegShellFileTypes
push eax
call fcn.00407150
lea eax, [ebp - 0x414]
push eax
call fcn.00406bf0
mov eax, dword [0x42c168]
add esp, 0x10
add eax, 0x101d0
mov dword [0x42c168], eax
push 0
push eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x42b014]
mov ecx, str.TsStudio.exe
mov dword [ebp - 0x1c1c], eax
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x405a29
movzx eax, cx
lea ecx, [ebp - 0x1c1c]
push eax
call fcn.00404800
jmp 0x405a82
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x40564a
or ebx, 0xffffffff
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x40564d
push esi
call fcn.0040be90
add esp, 4
jmp 0x40564d
push str.TsStudio.exe
call esi
mov esi, eax
test esi, esi
je 0x405a82
lea ecx, [esi*2 + 0xe]
push ecx
call fcn.00403940
add esp, 4
test eax, eax
je 0x405a82
xor ecx, ecx
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], cx
lea ecx, [esi + esi]
push ecx
push str.TsStudio.exe
add ecx, 2
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
push ecx
push eax
mov dword [ebp - 0x1c1c], eax
call fcn.00408cc0
push eax
call fcn.00401630
add esp, 0x14
mov eax, dword [0x42b014]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x421854
mov dword [ebp - 0x1c10], eax
call edi
push 0x421854
push eax
mov eax, dword [0x42c180]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c10]
push eax
lea eax, [ebp - 0x1c1c]
push eax
push 1
call fcn.00402bc0
mov eax, dword [ebp - 0x1c10]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405af4
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405af4
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405b24
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405b24
push ecx
call fcn.0040be90
add esp, 4
jmp 0x405b24
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 0x1c58]
test esi, esi
jle 0x405d28
mov eax, dword [0x42b014]
push str.TsDefaultPrj.ini
mov dword [ebp - 0x1c14], eax
call edi
push str.TsDefaultPrj.ini
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c14]
push eax
push dword [eax - 8]
call fcn.00402700
mov edi, dword [ebp - 0x1c14]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c10], eax
cmp eax, 0xffffffff
je 0x405d06
cmp dword [ebp - 0x1c64], 0
jg 0x405ba6
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
test esi, esi
jg 0x405bbb
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [0x42b014]
lea ecx, [ebp - 0x1c50]
mov dword [ebp - 0x1c14], eax
mov eax, dword [ebp - 0x1c5c]
push ecx
push 1
lea ecx, [ebp - 0x1c14]
mov dword [ebp - 0x1c50], 0x5c
mov eax, dword [eax]
push eax
push dword [eax - 8]
call fcn.00402700
mov eax, dword [0x42b014]
lea ecx, [ebp - 0x1c1c]
mov esi, dword [ebp - 0x1c14]
mov dword [ebp - 0x1c1c], eax
mov eax, dword [ebp - 0x1c68]
mov eax, dword [eax]
push eax
push dword [eax - 8]
push esi
push dword [esi - 8]
call fcn.00402700
mov eax, dword [0x42b014]
push str..tpj
mov dword [ebp - 0x1c14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str..tpj
push eax
mov eax, dword [ebp - 0x1c1c]
lea ecx, [ebp - 0x1c14]
push eax
push dword [eax - 8]
call fcn.00402700
mov eax, dword [ebp - 0x1c1c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405c75
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405c75
push ecx
call fcn.0040be90
add esp, 4
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x405c97
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x405c97
push esi
call fcn.0040be90
add esp, 4
mov esi, dword [ebp - 0x1c14]
lea eax, [ebp - 0x20c]
push 0
push 0
push 0x207
push eax
push 0xffffffffffffffff
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebp - 0x1c34]
dec eax
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1c10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x1c10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x405d06
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x405d06
push esi
call fcn.0040be90
add esp, 4
lea eax, [edi - 0xc]
cmp eax, dword [0x42b010]
je 0x405d28
add edi, 0xfffffff4
mov eax, ebx
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x405d28
push edi
call fcn.0040be90
add esp, 4
mov eax, dword [0x42b014]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.TsRun.exe
mov dword [ebp - 0x1c1c], eax
call edi
push str.TsRun.exe
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c1c]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x1c1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
lea ecx, [ebp - 0x1c14]
cmp esi, 0xffffffff
je 0x405e2b
push str.TsRun.exe
call fcn.00401f30
mov ecx, dword [0x42b014]
push 0x4218ac
mov dword [ebp - 0x1c10], ecx
call edi
push 0x4218ac
push eax
mov eax, dword [0x42c180]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c10]
push eax
lea eax, [ebp - 0x1c14]
push eax
push 1
call fcn.00402bc0
mov eax, dword [ebp - 0x1c10]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405df5
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405df5
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405e1d
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405e1d
push ecx
call fcn.0040be90
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call edi
jmp 0x405f73
push str.TsDatabase.exe
call fcn.00401f30
mov eax, dword [0x42b014]
push str.penc
mov dword [ebp - 0x1c10], eax
call edi
push str.penc
push eax
mov eax, dword [0x42c180]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c10]
push eax
lea eax, [ebp - 0x1c14]
push eax
push 1
call fcn.00402bc0
mov eax, dword [ebp - 0x1c10]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405ea1
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405ea1
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405ec9
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405ec9
push ecx
call fcn.0040be90
add esp, 4
push str.TsBrowser.exe
lea ecx, [ebp - 0x1c14]
call fcn.00401f30
mov eax, dword [0x42b014]
push str.OmhV.
mov dword [ebp - 0x1c10], eax
call edi
push str.OmhV.
push eax
mov eax, dword [0x42c180]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c10]
push eax
lea eax, [ebp - 0x1c14]
push eax
push 1
call fcn.00402bc0
mov eax, dword [ebp - 0x1c10]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405f45
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405f45
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x405f6d
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x405f6d
push ecx
call fcn.0040be90
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x42c168]
add eax, 0x101d0
push 0
push eax
mov dword [0x42c168], eax
mov eax, dword [0x42c164]
push 0x402
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x42b014]
push str.TsDrvTest.exe
mov dword [ebp - 0x1c10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.TsDrvTest.exe
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c10]
push eax
lea ecx, [ebp - 0x1c1c]
call fcn.00402160
mov eax, dword [ebp - 0x1c10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x406001
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x406001
push ecx
call fcn.0040be90
add esp, 4
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x1c1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4060cc
push str.TsDrvTest.exe
lea ecx, [ebp - 0x1c14]
call fcn.00401f30
mov ecx, dword [0x42b014]
push 0x421938
mov dword [ebp - 0x1c10], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x421938
push eax
mov eax, dword [ebp - 0x1c3c]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
lea eax, [ebp - 0x1c10]
push eax
lea eax, [ebp - 0x1c14]
push eax
push 0
call fcn.00402bc0
mov eax, dword [ebp - 0x1c10]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4060a1
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4060a1
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4060c9
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4060c9
push ecx
call fcn.0040be90
add esp, 4
push esi
call edi
mov eax, dword [0x42b014]
push str.Uninstall.exe
mov dword [ebp - 0x1c10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.Uninstall.exe
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c10]
push eax
push dword [eax - 8]
call fcn.00402700
mov edi, dword [ebp - 0x1c10]
lea eax, [ebp - 0x86c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4061fd
push str.Uninstall.exe
lea ecx, [ebp - 0x1c34]
call fcn.00401f30
mov eax, dword [0x42b014]
mov esi, dword [0x42c180]
push 0x421978
mov dword [ebp - 0x1c40], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x42c180]
lea ecx, [ebp - 0x1c40]
push dword [esi - 8]
push 0x421978
push eax
call fcn.00402700
mov eax, dword [0x42b014]
push str..lnk
mov dword [ebp - 0x1c14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 0x1c40]
lea ecx, [ebp - 0x1c14]
push str..lnk
push eax
push esi
push dword [esi - 8]
call fcn.00402700
lea eax, [ebp - 0x1c14]
push eax
lea eax, [ebp - 0x1c34]
push eax
push 0
call fcn.00402bc0
mov eax, dword [ebp - 0x1c14]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4061d0
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4061d0
push ecx
call fcn.0040be90
add esp, 4
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x4061f2
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4061f2
push esi
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c34]
jmp 0x4062dc
push str.Unsetup.exe
lea ecx, [ebp - 0x1c40]
call fcn.00401f30
mov eax, dword [0x42b014]
mov esi, dword [0x42c180]
push 0x421978
mov dword [ebp - 0x1c34], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x42c180]
lea ecx, [ebp - 0x1c34]
push dword [esi - 8]
push 0x421978
push eax
call fcn.00402700
mov eax, dword [0x42b014]
push str..lnk
mov dword [ebp - 0x1c14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 0x1c34]
lea ecx, [ebp - 0x1c14]
push str..lnk
push eax
push esi
push dword [esi - 8]
call fcn.00402700
lea eax, [ebp - 0x1c14]
push eax
lea eax, [ebp - 0x1c40]
push eax
push 0
call fcn.00402bc0
mov eax, dword [ebp - 0x1c14]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4062b4
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4062b4
push ecx
call fcn.0040be90
add esp, 4
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x4062d6
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4062d6
push esi
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c40]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4062fe
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4062fe
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [0x42c16c]
cmp eax, 0xffffffff
je 0x40630f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4063b8
lea edi, [ebp - 0x61c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x406332
mov eax, dword [0x42b014]
mov ecx, 7
mov esi, 0x421998
mov dword [ebp - 0x1c34], eax
rep movsd dword es:[edi], dword [esi]
push str.D3DX9_37.dll
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.D3DX9_37.dll
push eax
mov eax, dword [0x42c188]
lea ecx, [ebp - 0x1c34]
push eax
push dword [eax - 8]
call fcn.00402700
mov esi, dword [ebp - 0x1c34]
lea eax, [ebp - 0x61c]
push 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esi - 0xc]
cmp eax, dword [0x42b010]
je 0x4063b2
add esi, 0xfffffff4
mov eax, ebx
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4063b2
push esi
call fcn.0040be90
add esp, 4
mov edi, dword [ebp - 0x1c10]
mov eax, dword [0x42c178]
mov byte [eax + 0x68], 1
mov eax, dword [0x42c178]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4063d6
mov dword [eax + 0x40], 4
jmp 0x4063e6
push 0
push 4
push 0x465
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [edi - 0xc]
cmp eax, dword [0x42b010]
je 0x406408
add edi, 0xfffffff4
mov eax, ebx
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x406408
push edi
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c1c]
pop edi
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x406431
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x406431
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c20]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x406459
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x406459
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x406481
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x406481
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c24]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4064a9
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4064a9
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c28]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4064d1
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4064d1
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c4c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4064f9
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4064f9
push ecx
call fcn.0040be90
add esp, 4
lea ecx, [ebp - 0x1c68]
call fcn.00406af0
lea ecx, [ebp - 0x1c5c]
call fcn.00406af0
push dword [ebp - 0x880]
mov dword [ebp - method.Cabinet::CExtract.virtual_0], 0x4214e0
call fcn.0040be90
push dword [ebp - 0x888]
call fcn.0040be90
push dword [ebp - 0x894]
call fcn.0040be90
push dword [ebp - 0x89c]
call fcn.0040be90
add esp, 0x10
mov dword [ebp - method.Cabinet::CExtract.virtual_0], 0x4214b4
lea ecx, [ebp - 0x19bc]
call fcn.00402020
mov eax, dword [ebp - 0x1c6c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x406585
lea ecx, [eax - 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x406585
push ecx
call fcn.0040be90
add esp, 4
mov eax, dword [ebp - 0x1c3c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x42b010]
je 0x4065ab
add eax, 0xfffffff4
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4065ab
push eax
call fcn.0040be90
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c175
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004016d0
int3