← Back to the case report · CORD Reports
Corrected by a later full static re-analysis. This is CORD's first automated pass, published as produced. The Electron app is a credential-relay shell, not a stealer: it reads no browser storage, cookies or files. Its window runs with Node integration off, not on. The September builds' JavaScript was decoded in full (string decoder reimplemented, never run); the payload tries three hosts, njrlmwtgpk[.]shop, fakefake[.]shop and pulse-keys[.]store.
report r20261028-1Summary
Static analysis · PE32 · 2026-10-29

Unattributed stealer

MaliciousRole: payloadCapability: stealerFamily: not attributed

A 64 MB NSIS 3 Unicode installer (PE32 x86, MSVC, ASLR and NX enabled) wraps a trojanized Electron application that impersonates Steam. The NSIS overlay at offset 0x1a600 (63 MB, entropy 8.0) holds a deflate-compressed 7z archive containing a renamed Chromium-based executable, supporting DLLs, and an Electron asar package. The asar's entry point loads compiled V8 bytecode through bytenode, hiding the payload's logic from static JavaScript analysis. That bytecode (unpacked file 2, 93 KB) is a credential stealer: it opens targeted URLs in a BrowserWindow with nodeIntegration enabled and contextIsolation disabled, injects CSS and JavaScript, and exfiltrates collected data to two HTTPS endpoints (I3, I4).

File
PE32 · 61.0 MB
2 further files unpacked: Unpacked 1, Unpacked 2
Behaviours
21
16 reachable from the entry point, 5 not proven
Code reached
78%
81 of 104 functions from the entry
Network
3 indicators
2 C2
Detection features
7
build, campaign scope
Open questions
5
reads the analysis attempted and stopped
sha256 c86286508d09cd68ff0a38b7db9b6f76fd353a9a009402c9c512a568e439b46b
Read the full technical report → Every behaviour and indicator in detail, with the evidence, decoded strings, code and call graph.

How it runs

The behaviours as a flow, from the entry point: the checks that can end the run, then what it collects, then what it sends and what follows. Boxes follow the order of the analyst's account; a dashed box is code whose path from the entry is not proven. Static analysis: not an observed run.

StartNSIS initializationentry pointMainthe collectors below run from hereThen, in an order the analysis did not establishprivilege escalation via token adjustmentB1privilege escalation viatoken adjustmentenvironment variable manipulationB2environment variablemanipulationdynamic API resolution via name tableB3dynamic API resolution vianame tablefile system operations via NSIS interpreterB5file system operations viaNSIS interpreterINI file read and writeB9INI file read and writeinstaller UI and path resolutionB12installer UI and pathresolutionregistry read and writeB6registry read and writeclipboard write and thread creationB13clipboard write and threadcreationFake Steam login with BrowserWindow, CSS/JS injection, and TARGET_URLS targetingB17Fake Steam login withBrowserWindow, CSS/JSinjection, and TARGET_URLS…Browser storage and service worker data accessB18Browser storage and serviceworker data accessV8 bytecode references file system and path operations for data collectionB21V8 bytecode references filesystem and path operationsfor data collectionsystem shutdown capabilityB4system shutdown capabilitylibrary loading and unloadingB7library loading andunloadingCOM object instantiationB8COM object instantiationuninstaller registrationB14uninstaller registrationSends, and what followsHTTPS exfiltration endpoints embedded in V8 bytecode near end of fileB20HTTPS exfiltrationendpoints embedded in V8bytecode near end of fileprocess creation and shell executionB11process creation and shellexecution

Throughout: NSIS archive parsing from overlay (B10); NSIS installer drops Electron app disguised as Steam (B15); Electron app uses compiled V8 bytecode (B16); Impersonates Valve Corporation in version info and package.json (B19).

What it does in the full report →

The NSIS stub (the original file) enters at 0x40338f, initializing OLE and the command line (B1, B2). A dynamic API resolver loads functions from a module/function name table (B3, E3). The bytecode interpreter at 0x401434 processes NSIS instructions through a state-driven dispatch table (B5 through B9). The self-reader validates the NSIS header magic and maps archive data (B10, E29). A string variable resolver expands bytecoded strings with installer paths, environment variables, registry values and shell folders (B12, E31). Registry helpers create keys and query values (B6, E32, E33). The installer page dialog manages threaded extraction with progress display (B13, E13). Once extraction finishes, CreateProcessW launches the dropped payload with CREATE_NO_WINDOW (0x4000000), hiding the Electron process (B11, E30). The NSIS stub has no custom malicious code; all 27 decompiled functions are standard NSIS 3 runtime internals (B15, E20).

The Electron asar (unpacked file 1, 202 KB) contains a 44-byte main.js that loads main.jsc through bytenode (B16, E21, E24). The package.json claims authorship by Valve Corporation with product name "steam-login-app" (B19, E17, E23). The V8 bytecode (unpacked file 2, 93 KB, magic 0xdf05dec0) contains 176 recoverable strings (E26). These reveal a BrowserWindow configuration with nodeIntegration enabled and contextIsolation disabled, a TARGET_URLS array, CSS injection using a dark theme (#212328), obfuscated _0x-prefixed variable names (27 occurrences), a custom-encoded string table (indices A0077 through A0170), and references to browser storage and service worker paths (B17, B18, E22). Two HTTPS URLs in the bytecode constant pool serve as exfiltration endpoints (B20, E27, E28), one for data upload (I3, I4). The bytecode also references file system and path operations consistent with local data collection before exfiltration (B21, E26).

The V8 bytecode cannot be fully disassembled without the matching V8 engine version (Chrome 122 User-Agent string present); string extraction and IOC scanning provide partial visibility into the payload's logic (U5, resolved by E25 through E28). The NSIS installer script bytecode was not decoded (U2), and no family-specific patterns matched (U4).

BehaviourFrom the entryATT&CKEvidence
privilege escalation via token adjustmentreachableT1134.002E1
environment variable manipulationreachableT1574.007E2
dynamic API resolution via name tablereachableT1106E3
system shutdown capabilityreachableT1529E4
file system operations via NSIS interpreterreachableT1083E5
registry read and writereachableT1112E6
library loading and unloadingreachableT1129E7
COM object instantiationreachableT1559.001E8
INI file read and writereachableT1005E9
NSIS archive parsing from overlayreachableT1140E10
process creation and shell executionreachableT1204.002E11
installer UI and path resolutionreachableE12
clipboard write and thread creationreachableT1115E13
uninstaller registrationreachableE14
NSIS installer drops Electron app disguised as SteamreachableT1036.005E20
Electron app uses compiled V8 bytecode (bytenode) for code hidingunknownT1027E21E22
Fake Steam login with BrowserWindow, CSS/JS injection, and TARGET_URLS targetingunknownT1056.004E22
Browser storage and service worker data accessunknownT1539E22
Impersonates Valve Corporation in version info and package.jsonreachableT1036.005E17E23
HTTPS exfiltration endpoints embedded in V8 bytecode near end of fileunknownT1041E27E28
V8 bytecode references file system and path operations for data collectionunknownT1005E26

How much of the code was read functions →

The the original file call graph has 105 internal functions with 87 reached from the single entry root, 27 decompiled in the main-path sweep. All 24 high-value reached functions are accounted for. Unpacked file 1 was extracted from the NSIS archive and its asar structure parsed (E24). Unpacked file 2 was extracted from the asar and triaged: FLOSS recovered 176 strings and 3 IOC candidates (2 URLs kept as I3 and I4, 1 version-like IPv4 declined).

What it talks to and touches in the full report →

Network values are defanged (hxxp, [.]); restore them before use. A dead drop sits on a public service: match the full URL, never block the domain. Host artefacts are files, paths and registry keys the sample targets or creates.

KindTypeRoleValueEvidence
networkurlotherhxxp://nsis[.]sf[.]net/NSIS_ErrorE15
networkurlc2hxxps://fakefake[.]shop/3253523E27
networkurlc2hxxps://pulse-keys[.]store/6887E28
host artefactregistry_keyotherSoftware\Microsoft\Windows\CurrentVersionE16

Verdict and detection opportunities all anchor details →

Unpacked file 2 is the malicious payload, capability class stealer, confidence 0.75. The original file is a malicious dropper. No family is attributed: the cluster label names no known family, and the V8 bytecode prevents code-level comparison to published stealer frameworks. Strongest anchors: A1 (NSIS interpreter dispatch structure, structural constant); A3 (rich header, structural constant); A5 (NSIS-over-7z-over-asar nesting with bytenode, structural constant); A6 (asar package.json metadata with forged Valve fields, config tier); A7 (V8 bytecode with TARGET_URLS and obfuscated variables, behavioural template).

Features a rule could match on, as proposed by the analysis. None is a rule until CORD Detection has measured it against clean software.

IDWhat to matchScopeScan typeHow stablePossible false matches
A1NSIS overlay with high entropy and large size at fixed offsetbuildrealtimestructural_constant; overlay offset and NSIS header are fixed by the buildother NSIS installers with large overlays; needs version info or icon to narrow
A2PE version info resource fields identifying this buildbuildrealtimeconfig; version info is set by the NSIS script and may change between buildslegitimate software using the same company or product name
A3PE timestamp 2018-12-15 and rich header pinning the NSIS stub versionbuildrealtimestructural_constant; NSIS stub compile time is fixed for the NSIS version usedany NSIS v3.x installer compiled with the same stub version
A4lure icon resource identifying the campaign themecampaignrealtimeconfig; icon is part of the lure and identifies the campaign themeother samples reusing the same stolen icon
A5NSIS overlay containing 7z with Electron app.asar using bytenode-compiled V8 bytecodebuildrealtimestructural_constant; The NSIS-over-7z-over-asar nesting with bytenode is the delivery shape, not tied to a single buildLegitimate Electron apps also use NSIS installers, but bytenode-compiled main.jsc is uncommon in benign software
A6package.json with name steam-login-app and author Valve Corporation in Electron asarcampaignrealtimeconfig; Attacker controls package.json fields and can change them per campaignNo legitimate Valve software names itself steam-login-app
A7main.jsc V8 bytecode loaded via bytenode with TARGET_URLS and BrowserWindow credential harvestingbuildrealtimebehavioural_template; V8 bytecode magic and embedded string constants change with V8 engine version and obfuscatorOther Electron malware using bytenode, but TARGET_URLS + Steam impersonation narrows the match

Open questions in the full report →

  1. Q2
    Why it stopped: cap
  2. Q2
    Why it stopped: L1-decode completed and produced a valid asar archive (201982 bytes, controls C2 structure and C5 reproduce both passed). The V8 bytecode in main.jsc remains undecoded because no V8 bytecode disassembler matching the Chromium 122 engine version is available.
  3. Q4
    Why it stopped: family-specific payload is inside the compressed NSIS archive (U2)
  4. Q3
    Why it stopped: overlay not extracted
  5. Q2
    Why it stopped: main.jsc is compiled V8 bytecode; full decompilation requires V8 bytecode disassembly with the matching engine version from Steam.exe (Electron/Chromium 122). String extraction gave partial visibility.
Summary generated from report.json by render/cover.py. The lead is the analyst's summary; the section prose is the analyst's narrative with its references linked. Static analysis only: the sample was never executed. Network values are defanged.
Full technical report
CORD Research report r20261028-1

stealer payload

sha256c86286508d09cd68ff0a38b7db9b6f76fd353a9a009402c9c512a568e439b46b
not blind depth full model claude-opus-4-6 · medium input 43.5M output ~231k time 127 min 26 s schema cord-research.report/1.5.0 source report.json
Unpacked 2stealer payload0.75
Originaldropper0.4
Unpacked 1stealer payload0.7

Summary

A 64 MB NSIS 3 Unicode installer (PE32 x86, MSVC, ASLR and NX enabled) wraps a trojanized Electron application that impersonates Steam. The NSIS overlay at offset 0x1a600 (63 MB, entropy 8.0) holds a deflate-compressed 7z archive containing a renamed Chromium-based executable, supporting DLLs, and an Electron asar package. The asar's entry point loads compiled V8 bytecode through bytenode, hiding the payload's logic from static JavaScript analysis. That bytecode (unpacked file 2, 93 KB) is a credential stealer: it opens targeted URLs in a BrowserWindow with nodeIntegration enabled and contextIsolation disabled, injects CSS and JavaScript, and exfiltrates collected data to two HTTPS endpoints (I3, I4).

Behaviour

The NSIS stub (the original file) enters at 0x40338f, initializing OLE and the command line (B1, B2). A dynamic API resolver loads functions from a module/function name table (B3, E3). The bytecode interpreter at 0x401434 processes NSIS instructions through a state-driven dispatch table (B5 through B9). The self-reader validates the NSIS header magic and maps archive data (B10, E29). A string variable resolver expands bytecoded strings with installer paths, environment variables, registry values and shell folders (B12, E31). Registry helpers create keys and query values (B6, E32, E33). The installer page dialog manages threaded extraction with progress display (B13, E13). Once extraction finishes, CreateProcessW launches the dropped payload with CREATE_NO_WINDOW (0x4000000), hiding the Electron process (B11, E30). The NSIS stub has no custom malicious code; all 27 decompiled functions are standard NSIS 3 runtime internals (B15, E20).

The Electron asar (unpacked file 1, 202 KB) contains a 44-byte main.js that loads main.jsc through bytenode (B16, E21, E24). The package.json claims authorship by Valve Corporation with product name "steam-login-app" (B19, E17, E23). The V8 bytecode (unpacked file 2, 93 KB, magic 0xdf05dec0) contains 176 recoverable strings (E26). These reveal a BrowserWindow configuration with nodeIntegration enabled and contextIsolation disabled, a TARGET_URLS array, CSS injection using a dark theme (#212328), obfuscated _0x-prefixed variable names (27 occurrences), a custom-encoded string table (indices A0077 through A0170), and references to browser storage and service worker paths (B17, B18, E22). Two HTTPS URLs in the bytecode constant pool serve as exfiltration endpoints (B20, E27, E28), one for data upload (I3, I4). The bytecode also references file system and path operations consistent with local data collection before exfiltration (B21, E26).

The V8 bytecode cannot be fully disassembled without the matching V8 engine version (Chrome 122 User-Agent string present); string extraction and IOC scanning provide partial visibility into the payload's logic (U5, resolved by E25 through E28). The NSIS installer script bytecode was not decoded (U2), and no family-specific patterns matched (U4).

Reach

The the original file call graph has 105 internal functions with 87 reached from the single entry root, 27 decompiled in the main-path sweep. All 24 high-value reached functions are accounted for. Unpacked file 1 was extracted from the NSIS archive and its asar structure parsed (E24). Unpacked file 2 was extracted from the asar and triaged: FLOSS recovered 176 strings and 3 IOC candidates (2 URLs kept as I3 and I4, 1 version-like IPv4 declined).

Verdict and anchors

Unpacked file 2 is the malicious payload, capability class stealer, confidence 0.75. The original file is a malicious dropper. No family is attributed: the cluster label names no known family, and the V8 bytecode prevents code-level comparison to published stealer frameworks. Strongest anchors: A1 (NSIS interpreter dispatch structure, structural constant); A3 (rich header, structural constant); A5 (NSIS-over-7z-over-asar nesting with bytenode, structural constant); A6 (asar package.json metadata with forged Valve fields, config tier); A7 (V8 bytecode with TARGET_URLS and obfuscated variables, behavioural template).

21behaviours4IOCs7anchors5unknowns17functions decompiled34evidence items
Terms used in this report
Original file, unpacked file
The original file is the sample as collected. An unpacked file is one the analysis extracted or decoded from it, numbered in order (in report.json: L0, L1, L2…).
Reachable from the entry point
The static call graph shows a path from where the program starts to this code. It does not mean the code was seen running.
Code present, path not proven
The code is in the file, but the analysis could not prove a route to it, usually because of indirect calls or jump tables.
B, E, A, U, D numbers
Behaviours, evidence items, detection anchors, open questions (unknowns) and derived files (such as decoded strings). Every claim cites the evidence items it rests on.
API hashing
Looking up Windows functions at run time by a hash of their name, so the names never appear in the file.
MBA
Mixed boolean-arithmetic: computing a simple constant through a tangle of AND, OR, XOR and arithmetic.
ATT&CK, MBC
Public catalogues of attacker techniques (MITRE ATT&CK) and malware behaviours (MBC).
IOC
Indicator of compromise: a value, such as a domain or file name, that shows up on an infected host or network.

Behaviours at a glance

Sample and layers

gated nosnapshot taken at 2026-10-28T00:00Z
idsizeverdictsha256formatparenthoppath
Original63935908c8628650…e439b46bPE32———
Unpacked 12019826942177c…38f417ccelectron_asarOriginalout/L1/sample.bin
Unpacked 2934163bf8b47b…8e6260f7v8_bytecodeUnpacked 1out/L2/sample.bin

Verdict

What the analysis concludes the sample is, how confident it is, and the evidence that conclusion rests on.

Unpacked 2

stealer payload

confidence 0.75
classification
malicious
role
payload
capability
stealer
evidence
E25, E26, E27, E28
Original

dropper

confidence 0.4
classification
malicious
role
dropper
evidence
E1, E10, E11
Unpacked 1

stealer payload

confidence 0.7
classification
malicious
role
payload
capability
stealer
evidence
E20, E21, E22, E23, E24

What it does 21

Each behaviour the analysis found, with the techniques it maps to and whether the code is reachable from where the program starts. Open "Show the evidence" to see what each claim rests on, with code previews; full functions are under Code.

B1

privilege escalation via token adjustment

T1134.002file Originalreachability reachable from the entry point
functions
0x40338f
MBC
none
Show the evidence · 1 item: E1
E1
read from the file·function
0x40338f

B1

entry · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void entry(void)

{
  bool bVar1;
  DWORD DVar2;
  FARPROC pFVar3;
  int iVar4;
  LPWSTR pWVar5;
  short *psVar6;
  LPCWSTR pWVar7;
  WCHAR *pWVar8;
  int *piVar9;
  undefined3 extraout_var;
  int iVar10;
  HANDLE pvVar11;
  BOOL BVar12;
  WCHAR *pWVar13;
  WCHAR WVar14;
  char *lpString;
  WCHAR WVar15;
  LPWSTR *TokenHandle;
  wchar_t *local_2d4;
  UINT local_2d0;
  LPWSTR pWStack_2cc;
  uint local_2c8;
  _TOKEN_PRIVILEGES _Stack_2c4;
  SHFILEINFOW SStack_2b4;
/* … 186 more lines */
Full function, callers and assembly →
B2

environment variable manipulation

T1574.007file Originalreachability reachable from the entry point
functions
0x40338f
MBC
none
Show the evidence · 1 item: E2
E2
read from the file·function
0x40338f

B2

entry · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void entry(void)

{
  bool bVar1;
  DWORD DVar2;
  FARPROC pFVar3;
  int iVar4;
  LPWSTR pWVar5;
  short *psVar6;
  LPCWSTR pWVar7;
  WCHAR *pWVar8;
  int *piVar9;
  undefined3 extraout_var;
  int iVar10;
  HANDLE pvVar11;
  BOOL BVar12;
  WCHAR *pWVar13;
  WCHAR WVar14;
  char *lpString;
  WCHAR WVar15;
  LPWSTR *TokenHandle;
  wchar_t *local_2d4;
  UINT local_2d0;
  LPWSTR pWStack_2cc;
  uint local_2c8;
  _TOKEN_PRIVILEGES _Stack_2c4;
  SHFILEINFOW SStack_2b4;
/* … 186 more lines */
Full function, callers and assembly →
B3

dynamic API resolution via name table

T1106file Originalreachability reachable from the entry point
functions
0x4066940x40338f
MBC
E1059
Show the evidence · 1 item: E3
E3
read from the file·function
0x406694

B3

dynamic API resolver · decompiled C, first 30 lines
FARPROC FUN_00406694(int param_1)

{
  LPCSTR lpModuleName;
  HMODULE hModule;
  FARPROC pFVar1;
  
  lpModuleName = (&PTR_s_KERNEL32_0040a3e0)[param_1 * 2];
  hModule = GetModuleHandleA(lpModuleName);
  if ((hModule == (HMODULE)0x0) &&
     (hModule = (HMODULE)FUN_00406624(lpModuleName), hModule == (HMODULE)0x0)) {
    return (FARPROC)0x0;
  }
  pFVar1 = GetProcAddress(hModule,(&PTR_s_SetDefaultDllDirectories_0040a3e4)[param_1 * 2]);
  return pFVar1;
}
Full function, callers and assembly →
B4

system shutdown capability

T1529file Originalreachability reachable from the entry point
functions
0x40338f
MBC
none
Show the evidence · 1 item: E4
E4
read from the file·function
0x40338f

B4

entry · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void entry(void)

{
  bool bVar1;
  DWORD DVar2;
  FARPROC pFVar3;
  int iVar4;
  LPWSTR pWVar5;
  short *psVar6;
  LPCWSTR pWVar7;
  WCHAR *pWVar8;
  int *piVar9;
  undefined3 extraout_var;
  int iVar10;
  HANDLE pvVar11;
  BOOL BVar12;
  WCHAR *pWVar13;
  WCHAR WVar14;
  char *lpString;
  WCHAR WVar15;
  LPWSTR *TokenHandle;
  wchar_t *local_2d4;
  UINT local_2d0;
  LPWSTR pWStack_2cc;
  uint local_2c8;
  _TOKEN_PRIVILEGES _Stack_2c4;
  SHFILEINFOW SStack_2b4;
/* … 186 more lines */
Full function, callers and assembly →
B5

file system operations via NSIS interpreter

T1083file Originalreachability reachable from the entry point
functions
0x401434
MBC
E1083
Show the evidence · 1 item: E5
E5
read from the file·function
0x401434

B5

NSIS bytecode interpreter · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HWND FUN_00401434(HWND param_1)

{
  short sVar1;
  undefined4 uVar2;
  short *psVar3;
  HWND pHVar4;
  uint uVar5;
  LRESULT LVar6;
  HGDIOBJ ho;
  HDC hdc;
  SIZE_T dwBytes;
  HRESULT HVar7;
  undefined *puVar8;
  LPCWSTR lpFileName;
  LPCWSTR pWVar9;
  DWORD DVar10;
  HKEY pHVar11;
  LSTATUS LVar12;
  HANDLE pvVar13;
  LPWSTR pWVar14;
  BOOL BVar15;
  int iVar16;
  FARPROC pFVar17;
  HGLOBAL hMem;
  int *piVar18;
  HWND pHVar19;
/* … 1202 more lines */
Full function, callers and assembly →
B6

registry read and write

T1112file Originalreachability reachable from the entry point
functions
0x4014340x402d44
MBC
E1082
Show the evidence · 1 item: E6
E6
read from the file·function
0x401434

B6

NSIS bytecode interpreter · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HWND FUN_00401434(HWND param_1)

{
  short sVar1;
  undefined4 uVar2;
  short *psVar3;
  HWND pHVar4;
  uint uVar5;
  LRESULT LVar6;
  HGDIOBJ ho;
  HDC hdc;
  SIZE_T dwBytes;
  HRESULT HVar7;
  undefined *puVar8;
  LPCWSTR lpFileName;
  LPCWSTR pWVar9;
  DWORD DVar10;
  HKEY pHVar11;
  LSTATUS LVar12;
  HANDLE pvVar13;
  LPWSTR pWVar14;
  BOOL BVar15;
  int iVar16;
  FARPROC pFVar17;
  HGLOBAL hMem;
  int *piVar18;
  HWND pHVar19;
/* … 1202 more lines */
Full function, callers and assembly →
B7

library loading and unloading

T1129file Originalreachability reachable from the entry point
functions
0x401434
MBC
none
Show the evidence · 1 item: E7
E7
read from the file·function
0x401434

B7

NSIS bytecode interpreter · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HWND FUN_00401434(HWND param_1)

{
  short sVar1;
  undefined4 uVar2;
  short *psVar3;
  HWND pHVar4;
  uint uVar5;
  LRESULT LVar6;
  HGDIOBJ ho;
  HDC hdc;
  SIZE_T dwBytes;
  HRESULT HVar7;
  undefined *puVar8;
  LPCWSTR lpFileName;
  LPCWSTR pWVar9;
  DWORD DVar10;
  HKEY pHVar11;
  LSTATUS LVar12;
  HANDLE pvVar13;
  LPWSTR pWVar14;
  BOOL BVar15;
  int iVar16;
  FARPROC pFVar17;
  HGLOBAL hMem;
  int *piVar18;
  HWND pHVar19;
/* … 1202 more lines */
Full function, callers and assembly →
B8

COM object instantiation

T1559.001file Originalreachability reachable from the entry point
functions
0x401434
MBC
none
Show the evidence · 1 item: E8
E8
read from the file·function
0x401434

B8

NSIS bytecode interpreter · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HWND FUN_00401434(HWND param_1)

{
  short sVar1;
  undefined4 uVar2;
  short *psVar3;
  HWND pHVar4;
  uint uVar5;
  LRESULT LVar6;
  HGDIOBJ ho;
  HDC hdc;
  SIZE_T dwBytes;
  HRESULT HVar7;
  undefined *puVar8;
  LPCWSTR lpFileName;
  LPCWSTR pWVar9;
  DWORD DVar10;
  HKEY pHVar11;
  LSTATUS LVar12;
  HANDLE pvVar13;
  LPWSTR pWVar14;
  BOOL BVar15;
  int iVar16;
  FARPROC pFVar17;
  HGLOBAL hMem;
  int *piVar18;
  HWND pHVar19;
/* … 1202 more lines */
Full function, callers and assembly →
B9

INI file read and write

T1005file Originalreachability reachable from the entry point
functions
0x401434
MBC
none
Show the evidence · 1 item: E9
E9
read from the file·function
0x401434

B9

NSIS bytecode interpreter · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HWND FUN_00401434(HWND param_1)

{
  short sVar1;
  undefined4 uVar2;
  short *psVar3;
  HWND pHVar4;
  uint uVar5;
  LRESULT LVar6;
  HGDIOBJ ho;
  HDC hdc;
  SIZE_T dwBytes;
  HRESULT HVar7;
  undefined *puVar8;
  LPCWSTR lpFileName;
  LPCWSTR pWVar9;
  DWORD DVar10;
  HKEY pHVar11;
  LSTATUS LVar12;
  HANDLE pvVar13;
  LPWSTR pWVar14;
  BOOL BVar15;
  int iVar16;
  FARPROC pFVar17;
  HGLOBAL hMem;
  int *piVar18;
  HWND pHVar19;
/* … 1202 more lines */
Full function, callers and assembly →
B10

NSIS archive parsing from overlay

T1140file Originalreachability reachable from the entry point
functions
0x402edd
MBC
none
Show the evidence · 1 item: E10
E10
read from the file·function
0x402edd

B10

NSIS self-reader · decompiled C, first 30 lines
wchar_t * FUN_00402edd(uint param_1)

{
  DWORD DVar1;
  HANDLE hFile;
  LPCWSTR pWVar2;
  uint uVar3;
  uint uVar4;
  int iVar5;
  undefined4 *puVar6;
  int *piVar7;
  uint uVar8;
  uint local_2c;
  int local_28;
  int local_24;
  int local_20;
  int local_1c;
  SIZE_T local_18;
  int local_14;
  HANDLE local_10;
  uint local_c;
  int local_8;
  
  local_c = 0;
  local_8 = 0;
  DVar1 = GetTickCount();
  DAT_0047aef0 = DVar1 + 1000;
  GetModuleFileNameW((HMODULE)0x0,(LPWSTR)&DAT_004e7000,0x2000);
  hFile = (HANDLE)FUN_00405db0((LPCWSTR)&DAT_004e7000,0x80000000,3);
/* … 79 more lines */
Full function, callers and assembly →
B11

process creation and shell execution

T1204.002file Originalreachability reachable from the entry point
functions
0x4058a30x4058e6
MBC
none
Show the evidence · 1 item: E11
E11
read from the file·function
0x4058a3

B11

createProcessW wrapper with… · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HANDLE FUN_004058a3(LPWSTR param_1)

{
  BOOL BVar1;
  HANDLE pvVar2;
  _PROCESS_INFORMATION local_14;
  
  _DAT_00468250 = 0x44;
  BVar1 = CreateProcessW((LPCWSTR)0x0,param_1,(LPSECURITY_ATTRIBUTES)0x0,(LPSECURITY_ATTRIBUTES)0x0,
                         0,0x4000000,(LPVOID)0x0,(LPCWSTR)0x0,(LPSTARTUPINFOW)&DAT_00468250,
                         &local_14);
  pvVar2 = (HANDLE)0x0;
  if (BVar1 != 0) {
    CloseHandle(local_14.hThread);
    pvVar2 = local_14.hProcess;
  }
  return pvVar2;
}
Full function, callers and assembly →
B12

installer UI and path resolution

file Originalreachability reachable from the entry point
functions
0x4039aa0x4062dc
MBC
none
Show the evidence · 1 item: E12
E12
read from the file·function
0x4039aa

B12

installer UI creation · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

INT_PTR FUN_004039aa(void)

{
  bool bVar1;
  ATOM AVar2;
  FARPROC pFVar3;
  uint uVar4;
  undefined3 extraout_var;
  undefined2 *puVar5;
  int iVar6;
  DWORD DVar7;
  LPCWSTR pWVar8;
  undefined3 extraout_var_00;
  int iVar9;
  BOOL BVar10;
  INT_PTR IVar11;
  short *lpString;
  int iStack_10;
  int iStack_c;
  int iStack_8;
  int iStack_4;
  
  iVar9 = DAT_0047aef4;
  pFVar3 = FUN_00406694(2);
  if (pFVar3 == (FARPROC)0x0) {
    _DAT_004db000 = 0x30;
    _DAT_004db002 = 0x78;
/* … 96 more lines */
Full function, callers and assembly →
B13

clipboard write and thread creation

T1115file Originalreachability reachable from the entry point
functions
0x405461
MBC
none
Show the evidence · 1 item: E13
E13
read from the file·function
0x405461

B13

NSIS installer page dialog · decompiled C, first 30 lines
COLORREF FUN_00405461(HWND param_1,int param_2,HDC param_3,HWND param_4)

{
  HWND pHVar1;
  HWND lpParameter;
  HANDLE hObject;
  HMENU hMenu;
  LPCWSTR lpNewItem;
  int iVar2;
  BOOL BVar3;
  LRESULT LVar4;
  HGLOBAL hMem;
  undefined2 *puVar5;
  COLORREF CVar6;
  int y;
  WPARAM wParam;
  int iVar7;
  DWORD dwCreationFlags;
  DWORD *lpThreadId;
  undefined1 local_44 [8];
  undefined4 local_3c;
  undefined4 local_38;
  int local_34;
  undefined2 *local_30;
  undefined4 local_2c;
  undefined4 local_28;
  undefined4 local_24;
  undefined4 uStack_20;
  tagRECT local_1c;
/* … 139 more lines */
Full function, callers and assembly →
B14

uninstaller registration

file Originalreachability reachable from the entry point
functions
0x405f06
MBC
none
Show the evidence · 1 item: E14
E14
read from the file·function
0x405f06

B14

writes uninstaller registration entry… · decompiled C, first 30 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void __cdecl FUN_00405f06(LPCWSTR param_1,LPCWSTR param_2)

{
  HANDLE pvVar1;
  DWORD DVar2;
  int iVar3;
  LPCSTR pCVar4;
  LPSTR hMem;
  int iVar5;
  LPCSTR pCVar6;
  LPCSTR pCVar7;
  CHAR *pCVar8;
  LPSTR pCVar9;
  
  _DAT_004688e8 = 0x55004e;
  _DAT_004688ec = 0x4c;
  if (param_2 != (LPCWSTR)0x0) {
    pvVar1 = (HANDLE)FUN_00405db0(param_2,0,1);
    CloseHandle(pvVar1);
    DVar2 = GetShortPathNameW(param_2,(LPWSTR)&DAT_004688e8,0x400);
    if (DVar2 == 0) {
      return;
    }
    if (0x400 < (int)DVar2) {
      return;
    }
  }
/* … 39 more lines */
Full function, callers and assembly →
B15

NSIS installer drops Electron app disguised as Steam

T1036.005file Originalreachability reachable from the entry point
functions
0x40338f0x401434
MBC
none
Show the evidence · 1 item: E20
E20
read from the file·section
overlay

B13

B16

Electron app uses compiled V8 bytecode (bytenode) for code hiding

T1027file Unpacked 1reachability unknown
functions
none
MBC
none
Show the evidence · 2 items: E21, E22
E21
read from the file·analysis output·Unpacked 1
out/L1_extract/resources/app.asar

B14

E22
read from the file·analysis output·Unpacked 1
out/L1_extract/jsc_strings.txt

B14

B17

Fake Steam login with BrowserWindow, CSS/JS injection, and TARGET_URLS targeting

T1056.004file Unpacked 1reachability unknown
functions
none
MBC
none
Show the evidence · 1 item: E22
E22
read from the file·analysis output·Unpacked 1
out/L1_extract/jsc_strings.txt

B14

B18

Browser storage and service worker data access

T1539file Unpacked 1reachability unknown
functions
none
MBC
none
Show the evidence · 1 item: E22
E22
read from the file·analysis output·Unpacked 1
out/L1_extract/jsc_strings.txt

B14

B19

Impersonates Valve Corporation in version info and package.json

T1036.005file Originalreachability reachable from the entry point
functions
none
MBC
none
Show the evidence · 2 items: E17, E23
E17
read from the file·analysis output
out/L0/version_info.json

A2

E23
read from the file·analysis output·Unpacked 1
out/L1_extract/resources/app.asar

B15

B20

HTTPS exfiltration endpoints embedded in V8 bytecode near end of file

T1041file Unpacked 2reachability unknown
functions
none
MBC
none
Show the evidence · 2 items: E27, E28
E27
read from the file·file range·Unpacked 2
0x168bc

HTTPS URL embedded in V8 bytecode at offset 92284, 29 bytes

Bytes · 29 at 0x168bc
000168bc  74 6f 72 65 2f 36 38 38 37 00 00 00 49 03 19 04  tore/6887...I...
000168cc  01 18 52 64 aa 63 c6 83 09 00 00 00 2d           ..Rd.c......-
E28
read from the file·file range·Unpacked 2
0x168e8

HTTPS URL with upload keyword embedded in V8 bytecode at offset 92328, 29 bytes

Bytes · 29 at 0x168e8
000168e8  36 e3 3e 43 04 00 00 00 61 72 67 76 01 10 52 62  6.>C....argv..Rb
000168f8  5e 80 aa 7e 03 00 00 00 65 6e 76 00 06           ^..~....env..
B21

V8 bytecode references file system and path operations for data collection

T1005file Unpacked 2reachability unknown
functions
none
MBC
none
Show the evidence · 1 item: E26
E26
read from the file·analysis output·Unpacked 2
out/L1_extract/jsc_strings.txt

V8 bytecode string analysis: 176 strings, 10 API/C2/exfil, 6 file/path, 3 HTTP/network, 2 browser, 2 sysinfo, 1 storage, 1 inject, 1 serviceworker

Indicators (IOCs) 4

Values that would show up on an infected host or in network traffic, such as domains, URLs and file names, with where each was found.

4 of 4 IOC value(s) resolved from the report and the files the analysis wrote. Network values are defanged (hxxp, [.]); restore them before use.

IDTypeRoleValuePortLayerMethodEvidenceNote
I1urlotherhxxp://nsis[.]sf[.]net/NSIS_ErrorL0plaintextE15URL found in NSIS stub at file offset 0x83ac
I2registry_keyotherSoftware\Microsoft\Windows\CurrentVersionL0plaintextE16Registry key at file offset 0x7028
I3urlc2hxxps://fakefake[.]shop/3253523L2plaintextE27HTTPS endpoint in V8 bytecode at offset 92284
I4urlc2hxxps://pulse-keys[.]store/6887L2plaintextE28HTTPS endpoint with upload keyword in V8 bytecode at offset 92328
IOC list · 4 value(s), defanged, one per line
hxxp://nsis[.]sf[.]net/NSIS_Error
hxxps://fakefake[.]shop/3253523
hxxps://pulse-keys[.]store/6887
Software\Microsoft\Windows\CurrentVersion

Decoded strings

Strings and config fields the analysis decoded, read from the files its decode steps wrote (derived artifacts), then the decoded, stack and tight strings FLOSS found in the prepass. At most 300 per layer are shown; long strings are cut at 300 characters with their length; control characters are escaped and URL schemes defanged.

Derived artifacts not shown as strings (2): files the analysis registered that hold no strings or config this section reads (a binary, an extracted archive, a layer's own bytes).

IDOfPathKindTransformSizeSHA-256Layer it becameEvidenceWhy not shown
D1L1out/L1/sample.binothernsis_extract_then_7z_extract201,982 bytes6942177c4eae47027e058bdadec8d82afb4826ea4e459ac0e5bc938038f417ccL1 (electron_asar)E24 · hop E20kind other: not read for strings
D2L2out/L2/sample.binotherasar_extract93,416 bytes3bf8b47b12d4630495baf611033c80ac6d31c27117b8a0409048d52b8e6260f7L2 (v8_bytecode)E25 · hop E24kind other: not read for strings

Process map (static) 4

Where the code can create, replace, detach or signal processes, read from the call graph without running the sample: each site with the call path from the entry point. Branch conditions are not evaluated, so this is what the code can start, not what one run did; sites the graph does not reach from the entry are listed, never hidden.

L0

PORTABLE EXECUTABLE (PE) x86: 4 sites (4 spawns a process), 3 reached from the entry.

0x40338f (NSIS initialization: parses command line, adjusts privileges, sets up temp directory and environment, calls archive parser and UI)   [CreateProcessW]
  └ 0x40140b
    └ 0x401389
      └ 0x401434 (NSIS bytecode interpreter: dispatches script opcodes for file, registry, library, COM, INI and UI operations via state table)   [CreateProcessW, ShellExecuteExW]
CallWhat it doesIn functionSitePath from the entryDaemon shape
CreateProcessWspawns a process0x40338f (NSIS initialization: parses command line, adjusts privileges, sets up temp directory and environment, calls archive parser and UI)0040380a0x40338f
ShellExecuteExWspawns a process0x401434 (NSIS bytecode interpreter: dispatches script opcodes for file, registry, library, COM, INI and UI operations via state table)00401ee20x40338f → 0x40140b → 0x401389 → 0x401434
CreateProcessWspawns a process0x401434 (NSIS bytecode interpreter: dispatches script opcodes for file, registry, library, COM, INI and UI operations via state table)00401f170x40338f → 0x40140b → 0x401389 → 0x401434
ShellExecuteExWspawns a process0x40469f004046d2not reached from the entry

Detection anchors 7

Features a detection rule could match on: what to match, where it sits in the file, how stable it is across builds, and what else might match it. They are proposals; CORD Detection measures them against clean software before any becomes a rule.

idstatusfeaturescan typescopefileevidenceon diskwherepatternhow stablepossible false matchessingle sample only
A1nominatedNSIS overlay with high entropy and large size at fixed offsetrealtimebuildOriginalE10yesother NSIS installers with large overlays; needs version info or icon to narrowyes
A2nominatedPE version info resource fields identifying this buildrealtimebuildOriginalE17yeslegitimate software using the same company or product nameyes
A3nominatedPE timestamp 2018-12-15 and rich header pinning the NSIS stub versionrealtimebuildOriginalE18yesany NSIS v3.x installer compiled with the same stub versionyes
A4nominatedlure icon resource identifying the campaign themerealtimecampaignOriginalE19yesother samples reusing the same stolen iconyes
A5nominatedNSIS overlay containing 7z with Electron app.asar using bytenode-compiled V8 bytecoderealtimebuildOriginalE20yesLegitimate Electron apps also use NSIS installers, but bytenode-compiled main.jsc is uncommon in benign softwareyes
A6nominatedpackage.json with name steam-login-app and author Valve Corporation in Electron asarrealtimecampaignUnpacked 1E23yesNo legitimate Valve software names itself steam-login-appyes
A7nominatedmain.jsc V8 bytecode loaded via bytenode with TARGET_URLS and BrowserWindow credential harvestingrealtimebuildUnpacked 1E21, E22yesOther Electron malware using bytenode, but TARGET_URLS + Steam impersonation narrows the matchyes

Open questions 5

Questions the analysis could not answer, what was tried, and why it stopped. Some may have been answered by a later step; check Decoded strings.

U1

Q2

what was tried
fn_profile on 5 UI functions (0x404722, 0x404c9e, 0x4043f0, 0x405296, 0x401000): standard NSIS dialog handlers with no sensitive APIs
why it stopped
cap
stop
depth_cap
U2

Q2

what was tried
identified NSIS archive overlay at offset 108032 (63.8MB, entropy 8.0), confirmed NullsoftInst header magic in FUN_00402edd, FLOSS refused: file size exceeds 16MB limit
why it stopped
L1-decode completed and produced a valid asar archive (201982 bytes, controls C2 structure and C5 reproduce both passed). The V8 bytecode in main.jsc remains undecoded because no V8 bytecode disassembler matching the Chromium 122 engine version is available.
stop
payload_not_in_file
U3

Q4

what was tried
read the original file code: all functions are stock NSIS framework, cluster label pe/unk.steamlure-28f2b618 names no known family
why it stopped
family-specific payload is inside the compressed NSIS archive (U2)
stop
payload_not_in_file
U4

Q3

what was tried
triaged IOC candidates from pe code sections: 1 URL, 1 registry key kept, 723 host candidates at overlay offsets cannot be resolved without extraction
why it stopped
overlay not extracted
stop
payload_not_in_file
U5

Q2

what was tried
Extracted 176 ASCII strings from main.jsc V8 bytecode (93416 bytes). Found obfuscated variable names, Electron API calls, TARGET_URLS reference, CSS/JS injection strings, browser storage access, and a 74KB embedded blob., V8 bytecode (magic 0xdf05dec0) cannot be decompiled statically without a matching V8 version.
why it stopped
main.jsc is compiled V8 bytecode; full decompilation requires V8 bytecode disassembly with the matching engine version from Steam.exe (Electron/Chromium 122). String extraction gave partial visibility.
stop
fixed_point
evidence
E25, E26, E27, E28

How the code connects

Shortest call paths from the entry points to every function the report cites. Dashed edges are address-taken or virtual references (callbacks, thread procs, delegates, tables), not direct calls. Select a cited function to jump to its code; zoom and drag to pan a large graph.

From CORD Research's native call graph: 22 functions, 22 edges.

100%drag to panentry pointcitedon the wayreference
direct direct direct direct direct direct direct data_ref direct direct direct direct direct direct direct direct direct direct direct direct direct direct calls MulDiv, SendMessageW0x401389calls MulDiv, SendMessageW 0x401389 0x40140bsub_0040140b 0x40140b NSIS bytecode interpreter0x401434NSIS bytecode interpreter 0x401434 0x402cd1sub_00402cd1 0x402cd1 0x402cffsub_00402cff 0x402cff recursive registry key deletion via…0x402d44recursive registry key deletion via… 0x402d44 progress dialog procedure0x402df3progress dialog procedure 0x402df3 progress dialog manager0x402e79progress dialog manager 0x402e79 NSIS self-reader0x402eddNSIS self-reader 0x402edd NSIS archive data extractor0x403116NSIS archive data extractor 0x403116 entry0x40338fentry 0x40338f installer UI creation0x4039aainstaller UI creation 0x4039aa createProcessW wrapper with…0x4058a3createProcessW wrapper with… 0x4058a3 shellExecuteExW wrapper for launching…0x4058e6shellExecuteExW wrapper for launching… 0x4058e6 calls GetFileAttributesW0x405c97calls GetFileAttributesW 0x405c97 writes uninstaller registration entry…0x405f06writes uninstaller registration entry… 0x405f06 calls MoveFileExW0x406080calls MoveFileExW 0x406080 registry key creation wrapper0x406155registry key creation wrapper 0x406155 registry value reader0x406188registry value reader 0x406188 NSIS string variable resolver0x4062dcNSIS string variable resolver 0x4062dc file existence check0x4065fdfile existence check 0x4065fd dynamic API resolver0x406694dynamic API resolver 0x406694
Paths as text · 16

How those functions call each other (6 functions, up to three calls apart):

100%drag to panentry pointcitedon the wayreference
direct direct data_ref direct direct calls MulDiv, SendMessageW0x401389calls MulDiv, SendMessageW 0x401389 NSIS bytecode interpreter0x401434NSIS bytecode interpreter 0x401434 calls OleInitialize, OleUninitialize0x4053f5calls OleInitialize, OleUninitialize 0x4053f5 NSIS installer page dialog0x405461NSIS installer page dialog 0x405461 registry value reader0x406188registry value reader 0x406188 NSIS string variable resolver0x4062dcNSIS string variable resolver 0x4062dc

Code 17

Decompiled from the sample and the layers unpacking recovered, by the render step (not the analyst): Ghidra for native code (C and annotated assembly), ILSpy for .NET (C# and IL). FUN_… names are replaced by the report's names where it gives one. In the assembly, highlighted rows are addresses the evidence cites.

Index · 17 functions
FunctionAddressLayerSizeCited asPurposeBehaviours
FUN_004014340x401434L05795E5, E6, E7, E8, E9NSIS bytecode interpreter: dispatches script opcodes for file, registry, library, COM, INI and UI operations via state table · behaviours: B5 file system operations via NSIS interpreter; B6 registry read and write; B7 library loading and unloading; B8 COM object instantiation; B9 INI file read and writeB5, B6, B7, B8, B9
FUN_00402d440x402d44L0175recursive registry key deletion via RegDeleteKeyW and RegEnumKeyW · behaviours: B6 registry read and writeB6
FUN_00402df30x402df3L0134Progress dialog procedure: displays extraction percentage via timer (WM_TIMER)
FUN_00402e790x402e79L0100Progress dialog manager: shows or destroys the extraction progress window based on tick count
FUN_00402edd0x402eddL0569E10, E29NSIS self-reader: opens own file, validates NSIS header magic, reads archive data into memory · behaviours: B10 NSIS archive parsing from overlayB10
FUN_004031160x403116L0539NSIS archive data extractor: reads blocks from the archive and writes to a file handle or buffer
entry0x40338fL01345E1, E2, E4NSIS initialization: parses command line, adjusts privileges, sets up temp directory and environment, calls archive parser and UI · behaviours: B1 privilege escalation via token adjustment; B2 environment variable manipulation; B4 system shutdown capabilityB1, B2, B4
FUN_004039aa0x4039aaL0726E12installer UI creation: registers window class, creates dialog, shows installer window, calls path resolver · behaviours: B12 installer UI and path resolutionB12
FUN_004054610x405461L0912E13NSIS installer page dialog: handles WM_INITDIALOG with list view setup, creates a thread to run installer sections, manages progress · behaviours: B13 clipboard write and thread creationB13
FUN_004058a30x4058a3L067E11, E30CreateProcessW wrapper with CREATE_NO_WINDOW (0x4000000) flag for launching dropped payloads silently · behaviours: B11 process creation and shell executionB11
FUN_004058e60x4058e6L024ShellExecuteExW wrapper for launching files via the shell · behaviours: B11 process creation and shell executionB11
FUN_00405f060x405f06L0378E14writes uninstaller registration entry to file · behaviours: B14 uninstaller registrationB14
FUN_004061550x406155L051E32Registry key creation wrapper: calls RegCreateKeyExW through the NSIS registry root resolver · behaviours: B6 registry read and writeB6
FUN_004061880x406188L0121E33Registry value reader: opens a key, queries a value with RegQueryValueExW, returns the data · behaviours: B6 registry read and writeB6
FUN_004062dc0x4062dcL0626E31NSIS string variable resolver: expands bytecoded strings with installer paths, environment variables, registry values, and shell folder paths · behaviours: B12 installer UI and path resolutionB12
FUN_004065fd0x4065fdL039File existence check: FindFirstFileW with immediate FindClose, returns find data pointer or null · behaviours: B5 file system operations via NSIS interpreterB5
FUN_004066940x406694L060E3, E34Dynamic API resolver: GetModuleHandleA then GetProcAddress from a module/function name table at a fixed address · behaviours: B3 dynamic API resolution via name tableB3

NSIS bytecode interpreter

0x4014345795 bytes
HWND FUN_00401434(HWND param_1)

NSIS bytecode interpreter: dispatches script opcodes for file, registry, library, COM, INI and UI operations via state table

Cited as
E5, E6, E7, E8, E9
Behaviours
B5, B6, B7, B8, B9
Called from
FUN_00401389
Calls
SetFileAttributesW Sleep SetCurrentDirectoryW GetFileAttributesW GetShortPathNameW lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar
Decompiled C · 1232 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HWND FUN_00401434(HWND param_1)

{
  short sVar1;
  undefined4 uVar2;
  short *psVar3;
  HWND pHVar4;
  uint uVar5;
  LRESULT LVar6;
  HGDIOBJ ho;
  HDC hdc;
  SIZE_T dwBytes;
  HRESULT HVar7;
  undefined *puVar8;
  LPCWSTR lpFileName;
  LPCWSTR pWVar9;
  DWORD DVar10;
  HKEY pHVar11;
  LSTATUS LVar12;
  HANDLE pvVar13;
  LPWSTR pWVar14;
  BOOL BVar15;
  int iVar16;
  FARPROC pFVar17;
  HGLOBAL hMem;
  int *piVar18;
  HWND pHVar19;
  byte bVar20;
  int iVar21;
  LPCWSTR extraout_EDX;
  LPCWSTR pWVar22;
  HWND pHVar23;
  WCHAR *pWVar24;
  LPCWSTR pWVar25;
  bool bVar26;
  undefined8 uVar27;
  undefined8 uVar28;
  UINT type;
  LONG lDistanceToMove;
  PLONG lpDistanceToMoveHigh;
  UINT fuLoad;
  LONG *pLVar29;
  uint uVar30;
  _WIN32_FIND_DATAW local_2d8;
  undefined1 local_88 [32];
  HINSTANCE local_68;
  LPCWSTR local_64;
  LPCWSTR local_60;
  tagRECT local_5c;
  FARPROC local_4c;
  uint local_48 [2];
  LPCWSTR local_40;
  FARPROC local_3c;
  undefined8 local_38;
  int local_30;
  HWND local_2c [2];
  HWND local_24;
  FILETIME local_20;
  HWND local_18;
  HWND local_14;
  HWND local_10;
  HWND local_c;
  HWND local_8;
  
  pHVar19 = DAT_0041e630;
  pHVar23 = param_1;
  piVar18 = &local_30;
  for (iVar21 = 7; iVar21 != 0; iVar21 = iVar21 + -1) {
    *piVar18 = pHVar23->unused;
    pHVar23 = pHVar23 + 1;
    piVar18 = piVar18 + 1;
  }
  local_c = DAT_0047aee8;
  pWVar22 = (LPCWSTR)0x0;
  local_10 = (HWND)(&DAT_0047b000 + (int)local_2c[1] * 0x4000);
  DAT_0041e62c = local_2c;
  iVar21 = (int)local_2c[0] * 0x4000;
  pHVar23 = (HWND)(&DAT_0047b000 + iVar21);
  local_8 = (HWND)0x0;
  switch(local_30) {
  case 2:
    goto switchD_0040148a_caseD_2;
  case 3:
    pWVar22 = (LPCWSTR)0x0;
LAB_00401493:
    FUN_00405322((int)local_2c[0],pWVar22);
    return (HWND)0x7fffffff;
  case 4:
    DAT_00472eac = DAT_00472eac + 1;
    if (DAT_0047aee8 == (HWND)0x0) {
      return (HWND)0x7fffffff;
    }
    PostQuitMessage(0);
    return (HWND)0x7fffffff;
  case 5:
    iVar21 = FUN_0040136d((int)local_2c[0]);
    pHVar19 = (HWND)FUN_00401389(iVar21 + -1,(HWND)0x0);
    return pHVar19;
  case 6:
    FUN_00405322((int)local_2c[0],(LPCWSTR)0x0);
    break;
  case 7:
    uVar28 = FUN_00402c1f(0);
    DVar10 = (DWORD)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    if ((int)DVar10 < 2) {
      DVar10 = 1;
    }
    Sleep(DVar10);
    break;
  case 8:
    SetForegroundWindow(DAT_0047aee8);
    break;
  case 9:
    if (DAT_00472eb0 != (HWND)0x0) {
      ShowWindow(DAT_00472eb0,(int)local_2c[1]);
    }
    if (DAT_00472ec4 != (HWND)0x0) {
      ShowWindow(DAT_00472ec4,(int)local_2c[0]);
    }
    break;
  case 10:
    pWVar22 = FUN_00402c41(0xfffffff0);
    pWVar14 = (LPWSTR)SetFileAttributesW(pWVar22,(DWORD)local_2c[1]);
    goto LAB_004015b4;
  case 0xb:
    param_1 = (HWND)FUN_00402c41(0xfffffff0);
    pWVar14 = FUN_00405c3a((LPCWSTR)param_1);
    if (pWVar14 != (LPWSTR)0x0) {
      do {
        psVar3 = (short *)FUN_00405bbc(pWVar14,L'\\');
        sVar1 = *psVar3;
        *psVar3 = 0;
        if (((sVar1 == 0) && (local_24 != (HWND)0x0)) && (iVar21 = FUN_0040588b(), iVar21 != 0)) {
          DVar10 = FUN_004057f1((LPCWSTR)param_1);
        }
        else {
          DVar10 = FUN_0040586e((LPCWSTR)param_1);
        }
        if ((DVar10 != 0) &&
           ((DVar10 != 0xb7 || (DVar10 = GetFileAttributesW((LPCWSTR)param_1), (DVar10 & 0x10) == 0)
            ))) {
          local_8 = (HWND)((int)&local_8->unused + 1);
        }
        *psVar3 = sVar1;
        pWVar14 = psVar3 + 1;
      } while (sVar1 != 0);
    }
    if (local_2c[1] == (HWND)0x0) {
      iVar21 = -0xb;
      goto LAB_0040224b;
    }
    FUN_00401423(-0x1a);
    FUN_004062ba((LPWSTR)&DAT_004d3000,(LPCWSTR)param_1);
    BVar15 = SetCurrentDirectoryW((LPCWSTR)param_1);
    if (BVar15 == 0) {
      local_8 = (HWND)((int)&local_8->unused + 1);
    }
    break;
  case 0xc:
    pWVar22 = FUN_00402c41(0);
    puVar8 = FUN_004065fd(pWVar22);
    local_20.dwLowDateTime = (DWORD)local_2c[1];
    goto joined_r0x00401a1e;
  case 0xd:
    if (local_24 == (HWND)0x0) {
      *(undefined4 *)(&DAT_0047afc0 + (int)local_2c[0] * 4) = (&DAT_0047af80)[(int)local_2c[0]];
      uVar2 = FUN_00402c1f(1);
      (&DAT_0047af80)[(int)local_2c[0]] = uVar2;
    }
    else {
      (&DAT_0047af80)[(int)local_2c[0]] = *(undefined4 *)(&DAT_0047afc0 + (int)local_2c[0] * 4);
    }
    break;
  case 0xe:
    uVar30 = (&DAT_0047af80)[(int)local_24];
    pHVar19 = local_2c[uVar30 == 0];
    (&DAT_0047af80)[(int)local_24] = uVar30 & local_20.dwLowDateTime;
    return pHVar19;
  case 0xf:
    pHVar19 = (HWND)(&DAT_0047af80)[(int)local_2c[1]];
    goto switchD_00401ad7_default;
  case 0x10:
    pWVar22 = FUN_00402c41(0xffffffd0);
    pWVar9 = FUN_00402c41(0xffffffdf);
    FUN_00402c41(0x13);
    BVar15 = MoveFileW(pWVar22,pWVar9);
    if (BVar15 == 0) {
      if ((local_24 == (HWND)0x0) || (puVar8 = FUN_004065fd(pWVar22), puVar8 == (undefined *)0x0))
      goto LAB_0040288b;
      FUN_00406080(pWVar22,pWVar9);
      iVar21 = -0x1c;
    }
    else {
      iVar21 = -0x1d;
    }
    goto LAB_0040224b;
  case 0x11:
    pHVar23 = (HWND)FUN_00402c41(0);
    pHVar19 = local_10;
    DVar10 = GetFullPathNameW((LPCWSTR)pHVar23,0x2000,(LPWSTR)local_10,(LPWSTR *)&param_1);
    if (DVar10 == 0) {
LAB_00401710:
      local_8 = (HWND)0x1;
      *(undefined2 *)&pHVar19->unused = 0;
    }
    else if ((pHVar23 < param_1) && ((short)param_1->unused != 0)) {
      puVar8 = FUN_004065fd((LPCWSTR)pHVar23);
      if (puVar8 == (undefined *)0x0) goto LAB_00401710;
      FUN_004062ba((LPWSTR)param_1,(LPCWSTR)(puVar8 + 0x2c));
    }
    if (local_24 == (HWND)0x0) {
      GetShortPathNameW((LPCWSTR)pHVar19,(LPWSTR)pHVar19,0x2000);
    }
    break;
  case 0x12:
    pWVar22 = FUN_00402c41(0xffffffff);
    DVar10 = SearchPathW((LPCWSTR)0x0,pWVar22,(LPCWSTR)0x0,0x2000,(LPWSTR)pHVar23,(LPWSTR *)&param_1
                        );
    bVar26 = DVar10 == 0;
    goto LAB_00401751;
  case 0x13:
    pWVar22 = FUN_00402c41(0xffffffef);
    pWVar14 = FUN_00405ddf((LPWSTR)pHVar23,pWVar22);
    goto LAB_004015b4;
  case 0x14:
    local_c = (HWND)FUN_00402c41(0x31);
    param_1 = (HWND)((uint)local_2c[0] & 7);
    iVar21 = FUN_00405c06((ushort *)local_c);
    if (iVar21 == 0) {
      pHVar19 = local_c;
      pWVar22 = (LPCWSTR)FUN_004062ba((LPWSTR)&DAT_0040a5d0,(LPCWSTR)&DAT_004d3000);
      pWVar22 = FUN_00405b8f(pWVar22);
      lstrcatW(pWVar22,(LPCWSTR)pHVar19);
    }
    else {
      FUN_004062ba((LPWSTR)&DAT_0040a5d0,(LPCWSTR)local_c);
    }
    FUN_0040654e((LPCWSTR)&DAT_0040a5d0);
    do {
      if (2 < (int)param_1) {
        puVar8 = FUN_004065fd((LPCWSTR)&DAT_0040a5d0);
        uVar30 = 0;
        if (puVar8 != (undefined *)0x0) {
          uVar30 = CompareFileTime((FILETIME *)(puVar8 + 0x14),&local_20);
        }
        param_1 = (HWND)(uint)((((uint)((int)&param_1[-1].unused + 1U) | 0x80000000) & uVar30) == 0)
        ;
      }
      if (param_1 == (HWND)0x0) {
        FUN_00405d8b((LPCWSTR)&DAT_0040a5d0);
      }
      local_38._4_4_ =
           (HWND)FUN_00405db0((LPCWSTR)&DAT_0040a5d0,0x40000000,(param_1 != (HWND)0x1) + 1);
      if (local_38._4_4_ != (HWND)0xffffffff) {
        FUN_00405322(-0x16,(LPCWSTR)local_c);
        DAT_0047afb4 = DAT_0047afb4 + 1;
        DVar10 = FUN_00403116((int)local_24,local_38._4_4_,(undefined *)0x0,0);
        DAT_0047afb4 = DAT_0047afb4 + -1;
        if (((HWND)local_20.dwLowDateTime != (HWND)0xffffffff) ||
           ((HWND)local_20.dwHighDateTime != (HWND)0xffffffff)) {
          SetFileTime(local_38._4_4_,&local_20,(FILETIME *)0x0,&local_20);
        }
        CloseHandle(local_38._4_4_);
        if (-1 < (int)DVar10) goto switchD_0040148a_caseD_41;
        if (DVar10 == 0xfffffffe) {
          FUN_004062dc((LPWSTR)&DAT_0040a5d0,-0x17);
          lstrcatW((LPWSTR)&DAT_0040a5d0,(LPCWSTR)local_c);
        }
        else {
          FUN_004062dc((LPWSTR)&DAT_0040a5d0,-0x12);
        }
        uVar30 = 0x200010;
        puVar8 = &DAT_0040a5d0;
        goto LAB_004022f2;
      }
      if (param_1 != (HWND)0x0) {
        FUN_00405322(-0x1e,(LPCWSTR)local_c);
        bVar26 = param_1 == (HWND)0x2;
        goto LAB_004015b6;
      }
      FUN_004062ba((LPWSTR)&DAT_004125d0,(LPCWSTR)&DAT_0047b000);
      FUN_004062ba((LPWSTR)&DAT_0047b000,(LPCWSTR)&DAT_0040a5d0);
      FUN_004062dc((LPWSTR)&DAT_0040e5d0,(int)local_18);
      FUN_004062ba((LPWSTR)&DAT_0047b000,(LPCWSTR)&DAT_004125d0);
      iVar21 = FUN_00405920(&DAT_0040e5d0,(int)local_2c[0] >> 3);
    } while (iVar21 == 4);
    if (iVar21 != 5) {
      pWVar22 = (LPCWSTR)&DAT_0040a5d0;
      local_2c[0] = (HWND)0xfffffffa;
      goto LAB_00401493;
    }
    _DAT_0047af88 = _DAT_0047af88 + 1;
    goto LAB_00402ace;
  case 0x15:
    uVar30 = 0;
    goto LAB_00401943;
  case 0x16:
    pWVar22 = FUN_00402c41(0x31);
    pHVar19 = (HWND)FUN_00405920(pWVar22,(uint)local_2c[0]);
    if (pHVar19 == (HWND)0x0) goto LAB_0040288b;
    if (pHVar19 == local_24) {
      return (HWND)local_20.dwLowDateTime;
    }
    if (pHVar19 == (HWND)local_20.dwHighDateTime) {
      return local_18;
    }
    break;
  case 0x17:
    uVar30 = 0xfffffff0;
LAB_00401943:
    pWVar22 = FUN_00402c41(uVar30);
    FUN_004059cc(pWVar22,(uint)local_2c[1]);
    break;
  case 0x18:
    pWVar22 = FUN_00402c41(1);
    pHVar19 = (HWND)lstrlenW(pWVar22);
    goto switchD_00401ad7_default;
  case 0x19:
    uVar28 = FUN_00402c1f(2);
    local_5c.right._0_2_ = (undefined2)uVar28;
    local_5c.right._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x10);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    local_38 = FUN_00402c1f(3);
    pHVar19 = (HWND)local_38;
    param_1 = (HWND)CONCAT22(local_5c.right._2_2_,(undefined2)local_5c.right);
    local_40 = FUN_00402c41(1);
    pHVar4 = (HWND)lstrlenW(local_40);
    *(undefined2 *)&pHVar23->unused = 0;
    if (CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom) == 0) {
      param_1 = pHVar4;
    }
    if ((param_1 != (HWND)0x0) &&
       ((-1 < (int)local_38 ||
        (pHVar19 = (HWND)((int)local_38 + (int)&pHVar4->unused), -1 < (int)pHVar19)))) {
      if ((int)pHVar4 < (int)pHVar19) {
        pHVar19 = pHVar4;
      }
      FUN_004062ba((LPWSTR)pHVar23,local_40 + (int)pHVar19);
      if ((int)param_1 < 0) {
        iVar21 = lstrlenW((LPCWSTR)pHVar23);
        param_1 = (HWND)((int)&param_1->unused + iVar21);
        if ((int)param_1 < 0) {
          param_1 = (HWND)0x0;
        }
      }
      if ((int)param_1 < 0x2000) {
        *(undefined2 *)((int)&pHVar23->unused + (int)param_1 * 2) = 0;
      }
    }
    break;
  case 0x1a:
    pWVar22 = FUN_00402c41(0x20);
    pWVar9 = FUN_00402c41(0x31);
    if ((HWND)local_20.dwHighDateTime == (HWND)0x0) {
      puVar8 = (undefined *)lstrcmpiW(pWVar22,pWVar9);
    }
    else {
      puVar8 = (undefined *)lstrcmpW(pWVar22,pWVar9);
    }
    goto joined_r0x00401a1e;
  case 0x1b:
    param_1 = (HWND)FUN_00402c41(1);
    DVar10 = ExpandEnvironmentStringsW((LPCWSTR)param_1,(LPWSTR)pHVar23,0x2000);
    if ((DVar10 == 0) ||
       ((local_24 != (HWND)0x0 &&
        (iVar16 = lstrcmpW((LPCWSTR)param_1,(LPCWSTR)pHVar23), iVar16 == 0)))) {
      local_8 = (HWND)0x1;
      *(undefined2 *)&pHVar23->unused = 0;
    }
    *(undefined2 *)(&DAT_0047effe + iVar21) = 0;
    break;
  case 0x1c:
    uVar28 = FUN_00402c1f(0);
    uVar30 = (uint)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    uVar5 = FUN_00402c1f(1);
    if (local_18 != (HWND)0x0) {
      if (uVar30 < uVar5) {
        return (HWND)local_20.dwLowDateTime;
      }
      if (uVar30 <= uVar5) {
        return local_24;
      }
      return (HWND)local_20.dwHighDateTime;
    }
    if ((int)uVar30 < (int)uVar5) {
      return (HWND)local_20.dwLowDateTime;
    }
    if ((int)uVar30 <= (int)uVar5) {
      return local_24;
    }
    return (HWND)local_20.dwHighDateTime;
  case 0x1d:
    uVar28 = FUN_00402c1f(1);
    pHVar4 = (HWND)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    param_1 = pHVar4;
    uVar28 = FUN_00402c1f(2);
    uVar30 = (uint)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    bVar20 = (byte)uVar28;
    pHVar19 = param_1;
    switch(local_20.dwLowDateTime) {
    case 0:
      pHVar19 = (HWND)((int)&pHVar4->unused + uVar30);
      break;
    case 1:
      pHVar19 = (HWND)((int)pHVar4 - uVar30);
      break;
    case 2:
      pHVar19 = (HWND)(uVar30 * (int)pHVar4);
      break;
    case 3:
      if (uVar30 == 0) {
LAB_00401b33:
        local_8 = (HWND)0x1;
        pHVar19 = (HWND)0x0;
      }
      else {
        pHVar19 = (HWND)((int)pHVar4 / (int)uVar30);
      }
      break;
    case 4:
      pHVar19 = (HWND)(uVar30 | (uint)pHVar4);
      break;
    case 5:
      pHVar19 = (HWND)(uVar30 & (uint)pHVar4);
      break;
    case 6:
      pHVar19 = (HWND)(uVar30 ^ (uint)pHVar4);
      break;
    case 7:
      pHVar19 = (HWND)(uint)(pHVar4 == (HWND)0x0);
      break;
    case 8:
      if (pHVar4 == (HWND)0x0) {
LAB_00401b1d:
        if (uVar30 == 0) goto LAB_00401b15;
      }
      pHVar19 = (HWND)0x1;
      break;
    case 9:
      if (pHVar4 != (HWND)0x0) goto LAB_00401b1d;
LAB_00401b15:
      pHVar19 = (HWND)0x0;
      break;
    case 10:
      if (uVar30 == 0) goto LAB_00401b33;
      pHVar19 = (HWND)((int)pHVar4 % (int)uVar30);
      break;
    case 0xb:
      pHVar19 = (HWND)((int)pHVar4 << (bVar20 & 0x1f));
      break;
    case 0xc:
      pHVar19 = (HWND)((int)pHVar4 >> (bVar20 & 0x1f));
      break;
    case 0xd:
      pHVar19 = (HWND)((uint)pHVar4 >> (bVar20 & 0x1f));
    }
    goto switchD_00401ad7_default;
  case 0x1e:
    pWVar22 = FUN_00402c41(1);
    uVar28 = FUN_00402c1f(2);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    wsprintfW((LPWSTR)pHVar23,pWVar22,(int)uVar28);
    break;
  case 0x1f:
    if (local_24 == (HWND)0x0) {
      if (local_2c[1] != (HWND)0x0) {
        if (DAT_0041e630 != (HWND)0x0) {
          FUN_004062ba((LPWSTR)pHVar23,(LPCWSTR)(DAT_0041e630 + 1));
          DAT_0041e630 = (HWND)pHVar19->unused;
          goto LAB_00401be7;
        }
        goto LAB_0040288b;
      }
      pHVar19 = GlobalAlloc(0x40,0x4004);
      FUN_004062dc((LPWSTR)(pHVar19 + 1),(int)local_2c[0]);
      pHVar19->unused = (int)DAT_0041e630;
      DAT_0041e630 = pHVar19;
    }
    else {
      do {
        local_24 = (HWND)((int)&local_24[-1].unused + 3);
        if (pHVar19 == (HWND)0x0) goto LAB_004022e4;
        pHVar19 = (HWND)pHVar19->unused;
      } while (local_24 != (HWND)0x0);
      if (pHVar19 == (HWND)0x0) goto LAB_004022e4;
      FUN_004062ba((LPWSTR)&DAT_0040a5d0,(LPCWSTR)(pHVar19 + 1));
      FUN_004062ba((LPWSTR)(pHVar19 + 1),(LPCWSTR)(DAT_0041e630 + 1));
      pWVar24 = (WCHAR *)&DAT_0040a5d0;
      pHVar23 = DAT_0041e630 + 1;
LAB_004029e1:
      FUN_004062ba((LPWSTR)pHVar23,pWVar24);
    }
    break;
  case 0x20:
  case 0x21:
    uVar28 = FUN_00402c1f(3);
    local_14 = (HWND)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    uVar28 = FUN_00402c1f(4);
    param_1 = (HWND)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    if (((uint)local_18 & 1) != 0) {
      local_14 = (HWND)FUN_00402c41(0x33);
    }
    if (((uint)local_18 & 2) != 0) {
      param_1 = (HWND)FUN_00402c41(0x44);
    }
    if (local_30 == 0x21) {
      uVar28 = FUN_00402c1f(1);
      local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
      local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
      uVar27 = FUN_00402c1f(2);
      local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar27 >> 0x20);
      local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar27 >> 0x30);
      if ((int)local_18 >> 2 == 0) {
        pHVar19 = (HWND)SendMessageW((HWND)uVar28,(UINT)uVar27,(WPARAM)local_14,(LPARAM)param_1);
        local_38._4_4_ = pHVar19;
        local_2c[1] = local_2c[0];
      }
      else {
        LVar6 = SendMessageTimeoutW((HWND)uVar28,(UINT)uVar27,(WPARAM)local_14,(LPARAM)param_1,0,
                                    (int)local_18 >> 2,(PDWORD_PTR)((int)&local_38 + 4));
        local_8 = (HWND)(uint)(LVar6 == 0);
        pHVar19 = local_38._4_4_;
        local_2c[1] = local_2c[0];
      }
    }
    else {
      pWVar22 = FUN_00402c41(1);
      pWVar9 = FUN_00402c41(0x12);
      pHVar19 = FindWindowExW(local_14,param_1,(LPCWSTR)(-(uint)(*pWVar22 != L'\0') & (uint)pWVar22)
                              ,(LPCWSTR)(-(uint)(*pWVar9 != L'\0') & (uint)pWVar9));
      local_38._4_4_ = pHVar19;
      local_2c[1] = local_2c[0];
    }
joined_r0x00402816:
    if (-1 < (int)local_2c[1]) goto switchD_00401ad7_default;
    break;
  case 0x22:
    uVar28 = FUN_00402c1f(0);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    puVar8 = (undefined *)IsWindow((HWND)uVar28);
    local_20.dwLowDateTime = (DWORD)local_2c[1];
joined_r0x00401a1e:
    if (puVar8 == (undefined *)0x0) {
      return local_24;
    }
    return (HWND)local_20.dwLowDateTime;
  case 0x23:
    uVar28 = FUN_00402c1f(2);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    uVar27 = FUN_00402c1f(1);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar27 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar27 >> 0x30);
    pHVar19 = GetDlgItem((HWND)uVar27,(int)uVar28);
    goto switchD_00401ad7_default;
  case 0x24:
    iVar21 = (int)&local_2c[1]->unused + DAT_0047af48;
    uVar28 = FUN_00402c1f(0);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    SetWindowLongW((HWND)uVar28,-0x15,iVar21);
    break;
  case 0x25:
    pHVar19 = GetDlgItem(DAT_0047aee8,(int)local_2c[1]);
    GetClientRect(pHVar19,&local_5c);
    fuLoad = 0x10;
    iVar21 = CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom) * (int)local_24;
    iVar16 = CONCAT22(local_5c.right._2_2_,(undefined2)local_5c.right) * (int)local_24;
    type = 0;
    pWVar22 = FUN_00402c41(0);
    pvVar13 = LoadImageW((HINSTANCE)0x0,pWVar22,type,iVar16,iVar21,fuLoad);
    ho = (HGDIOBJ)SendMessageW(pHVar19,0x172,0,(LPARAM)pvVar13);
    if (ho != (HGDIOBJ)0x0) {
      DeleteObject(ho);
    }
    break;
  case 0x26:
    hdc = GetDC(DAT_0047aee8);
    uVar28 = FUN_00402c1f(2);
    iVar16 = 0x48;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    iVar21 = GetDeviceCaps(hdc,0x5a);
    _DAT_0041e5d0 = MulDiv((int)uVar28,iVar21,iVar16);
    _DAT_0041e5d0 = -_DAT_0041e5d0;
    ReleaseDC(local_c,hdc);
    uVar28 = FUN_00402c1f(3);
    _DAT_0041e5e0 = (undefined4)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    DAT_0041e5e4 = (byte)local_20.dwHighDateTime & 1;
    DAT_0041e5e7 = 1;
    DAT_0041e5e5 = (byte)local_20.dwHighDateTime & 2;
    DAT_0041e5e6 = (byte)local_20.dwHighDateTime & 4;
    FUN_004062dc((LPWSTR)&DAT_0041e5ec,(int)local_2c[1]);
    pHVar19 = (HWND)CreateFontIndirectW((LOGFONTW *)&DAT_0041e5d0);
    goto switchD_00401ad7_default;
  case 0x27:
    uVar28 = FUN_00402c1f(0);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    uVar27 = FUN_00402c1f(1);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar27 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar27 >> 0x30);
    if ((HWND)local_20.dwLowDateTime == (HWND)0x0) {
      ShowWindow((HWND)uVar28,(int)uVar27);
    }
    else {
      EnableWindow((HWND)uVar28,(int)uVar27);
    }
    break;
  case 0x28:
    pWVar22 = FUN_00402c41(0);
    pWVar9 = FUN_00402c41(0x31);
    pWVar25 = FUN_00402c41(0x22);
    FUN_00402c41(0x15);
    FUN_00401423(-0x14);
    local_88._4_4_ = local_20.dwHighDateTime;
    local_88._8_4_ = local_c;
    local_88._28_4_ = local_20.dwLowDateTime;
    local_88._12_4_ = -(uint)(*pWVar22 != L'\0') & (uint)pWVar22;
    local_88._24_4_ = &DAT_004d3000;
    local_88._20_4_ = -(uint)(*pWVar25 != L'\0') & (uint)pWVar25;
    local_88._16_4_ = pWVar9;
    iVar21 = FUN_004058e6((SHELLEXECUTEINFOW *)local_88);
    if (iVar21 == 0) goto LAB_0040288b;
    if ((local_88._4_4_ & 0x40) != 0) {
      FUN_00406745((HANDLE)CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom));
      pvVar13 = (HANDLE)CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom);
      goto LAB_00401f4d;
    }
    break;
  case 0x29:
    pWVar22 = FUN_00402c41(0);
    FUN_00405322(-0x15,pWVar22);
    pvVar13 = FUN_004058a3(pWVar22);
    if (pvVar13 == (HANDLE)0x0) goto LAB_0040288b;
    if (local_24 != (HWND)0x0) {
      DVar10 = FUN_00406745(pvVar13);
      if ((int)local_2c[1] < 0) {
        if (DVar10 != 0) {
          local_8 = (HWND)0x1;
        }
      }
      else {
        FUN_00406201((LPWSTR)local_10,DVar10);
      }
    }
LAB_00401f4d:
    CloseHandle(pvVar13);
    break;
  case 0x2a:
    pWVar22 = FUN_00402c41(2);
    puVar8 = FUN_004065fd(pWVar22);
    if (puVar8 != (undefined *)0x0) {
      FUN_00406201((LPWSTR)local_10,*(undefined4 *)(puVar8 + 0x14));
      pHVar19 = *(HWND *)(puVar8 + 0x18);
      goto switchD_00401ad7_default;
    }
    *(undefined2 *)&pHVar23->unused = 0;
    *(undefined2 *)&local_10->unused = 0;
    goto LAB_0040288b;
  case 0x2b:
    pHVar19 = (HWND)FUN_00402c41(0xffffffee);
    pLVar29 = &local_5c.bottom;
    local_38._4_4_ = pHVar19;
    pFVar17 = FUN_00406694(9);
    dwBytes = (*pFVar17)(pHVar19,pLVar29);
    *(undefined2 *)&pHVar23->unused = 0;
    *(undefined2 *)&local_10->unused = 0;
    local_8 = (HWND)0x1;
    if ((dwBytes != 0) && (param_1 = GlobalAlloc(0x40,dwBytes), param_1 != (HWND)0x0)) {
      local_3c = FUN_00406694(10);
      local_14 = (HWND)FUN_00406694(0xb);
      iVar21 = (*local_3c)(local_38._4_4_,0,dwBytes,param_1);
      pHVar19 = param_1;
      if ((iVar21 != 0) &&
         (iVar21 = (*(code *)local_14)(param_1,&DAT_0040a014,&local_40,&local_4c), pHVar19 = param_1
         , iVar21 != 0)) {
        FUN_00406201((LPWSTR)pHVar23,*(undefined4 *)(local_40 + 4));
        FUN_00406201((LPWSTR)local_10,*(undefined4 *)(local_40 + 6));
        local_8 = (HWND)0x0;
        pHVar19 = param_1;
      }
LAB_00401be7:
      GlobalFree(pHVar19);
    }
    break;
  case 0x2c:
    local_8 = (HWND)0x1;
    if (DAT_0047afb8 < 0) {
      iVar21 = -0x19;
    }
    else {
      pWVar22 = FUN_00402c41(0xfffffff0);
      local_40 = FUN_00402c41(1);
      if ((((HWND)local_20.dwHighDateTime != (HWND)0x0) &&
          (param_1 = (HWND)GetModuleHandleW(pWVar22), param_1 != (HWND)0x0)) ||
         (param_1 = (HWND)LoadLibraryExW(pWVar22,(HANDLE)0x0,8), param_1 != (HWND)0x0)) {
        pFVar17 = FUN_00406703((HMODULE)param_1,local_40);
        if (pFVar17 == (FARPROC)0x0) {
          FUN_00405322(-9,local_40);
        }
        else {
          local_8 = (HWND)0x0;
          if (local_24 == (HWND)0x0) {
            (*pFVar17)(local_c,0x2000,&DAT_0047b000,&DAT_0041e630,&PTR_DAT_0040a000);
          }
          else {
            FUN_00401423((int)local_24);
            iVar21 = (*pFVar17)();
            if (iVar21 != 0) {
              local_8 = (HWND)0x1;
            }
          }
        }
        if (((HWND)local_20.dwLowDateTime == (HWND)0x0) &&
           (iVar21 = FUN_0040394a((int)param_1), iVar21 != 0)) {
          FreeLibrary((HMODULE)param_1);
        }
        break;
      }
      iVar21 = -10;
      param_1 = (HWND)0x0;
    }
    goto LAB_0040224b;
  case 0x2d:
    pWVar22 = FUN_00402c41(0xfffffff0);
    local_5c.bottom._0_2_ = SUB42(pWVar22,0);
    local_5c.bottom._2_2_ = (undefined2)((uint)pWVar22 >> 0x10);
    local_40 = FUN_00402c41(0xffffffdf);
    local_c = (HWND)FUN_00402c41(2);
    local_4c = (FARPROC)FUN_00402c41(0xffffffcd);
    local_10 = (HWND)FUN_00402c41(0x45);
    local_48[0] = local_20.dwHighDateTime & 0xfff;
    local_3c = (FARPROC)((int)local_20.dwHighDateTime >> 0x10 & 0xffff);
    uVar30 = (int)local_20.dwHighDateTime >> 0xc & 7;
    iVar21 = FUN_00405c06((ushort *)local_40);
    if (iVar21 == 0) {
      FUN_00402c41(0x21);
    }
    HVar7 = CoCreateInstance((IID *)&DAT_004085f0,(LPUNKNOWN)0x0,1,(IID *)&DAT_004085e0,&param_1);
    if (-1 < HVar7) {
      local_14 = (HWND)(**(code **)param_1->unused)(param_1,&DAT_00408600,(int)&local_38 + 4);
      if (-1 < (int)local_14) {
        local_14 = (HWND)(**(code **)(param_1->unused + 0x50))(param_1,local_40);
        if ((local_20.dwHighDateTime & 0x8000) == 0) {
          (**(code **)(param_1->unused + 0x24))(param_1,&DAT_004d3000);
        }
        if (uVar30 != 0) {
          (**(code **)(param_1->unused + 0x3c))(param_1,uVar30);
        }
        (**(code **)(param_1->unused + 0x34))(param_1,local_3c);
        if (*(WCHAR *)local_4c != L'\0') {
          (**(code **)(param_1->unused + 0x44))(param_1,local_4c,local_48[0]);
        }
        (**(code **)(param_1->unused + 0x2c))(param_1,local_c);
        (**(code **)(param_1->unused + 0x1c))(param_1,local_10);
        if (-1 < (int)local_14) {
          local_14 = (HWND)(**(code **)((local_38._4_4_)->unused + 0x18))
                                     (local_38._4_4_,
                                      CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom),1)
          ;
        }
        (**(code **)((local_38._4_4_)->unused + 8))(local_38._4_4_);
      }
      (**(code **)(param_1->unused + 8))(param_1);
      if (-1 < (int)local_14) {
        iVar21 = -0xc;
        goto LAB_0040224b;
      }
    }
    local_8 = (HWND)0x1;
    iVar21 = -0x10;
    goto LAB_0040224b;
  case 0x2e:
    pWVar22 = FUN_00402c41(0);
    pWVar9 = FUN_00402c41(0x11);
    param_1 = (HWND)FUN_00402c41(0x23);
    puVar8 = FUN_004065fd(pWVar22);
    if (puVar8 != (undefined *)0x0) {
      local_88._28_4_ = local_c;
      local_68 = (HINSTANCE)0x2;
      iVar21 = lstrlenW(pWVar22);
      pWVar22[iVar21 + 1] = L'\0';
      iVar21 = lstrlenW(pWVar9);
      pWVar9[iVar21 + 1] = L'\0';
      local_5c.right._2_2_ = SUB42(param_1,0);
      local_5c.bottom._0_2_ = (undefined2)((uint)param_1 >> 0x10);
      local_5c.left._0_2_ = local_24._0_2_;
      local_64 = pWVar22;
      local_60 = pWVar9;
      FUN_00405322(0,(LPCWSTR)param_1);
      iVar21 = SHFileOperationW((LPSHFILEOPSTRUCTW)(local_88 + 0x1c));
      if (iVar21 == 0) break;
    }
    FUN_00405322(-7,(LPCWSTR)0x0);
    goto LAB_0040288b;
  case 0x2f:
    if (local_2c[0] != (HWND)0xbadf00d) {
LAB_004022e4:
      uVar30 = 0x200010;
      puVar8 = (undefined *)FUN_004062dc((LPWSTR)0x0,-0x18);
LAB_004022f2:
      FUN_00405920(puVar8,uVar30);
      return (HWND)0x7fffffff;
    }
    DAT_0047af94 = DAT_0047af94 + 1;
    break;
  case 0x30:
    pWVar9 = (LPCWSTR)0x0;
    pWVar25 = (LPCWSTR)0x0;
    if (local_2c[0] != (HWND)0x0) {
      pWVar9 = FUN_00402c41(0);
    }
    if (local_2c[1] != (HWND)0x0) {
      pWVar25 = FUN_00402c41(0x11);
    }
    if ((HWND)local_20.dwHighDateTime != (HWND)0x0) {
      pWVar22 = FUN_00402c41(0x22);
    }
    lpFileName = FUN_00402c41(0xffffffcd);
    pWVar14 = (LPWSTR)WritePrivateProfileStringW(pWVar9,pWVar25,pWVar22,lpFileName);
LAB_004015b4:
    bVar26 = pWVar14 == (LPWSTR)0x0;
LAB_004015b6:
    if (bVar26) goto LAB_0040288b;
    break;
  case 0x31:
    param_1 = DAT_0040a010;
    pWVar22 = FUN_00402c41(1);
    pWVar9 = FUN_00402c41(0x12);
    local_5c.bottom._0_2_ = SUB42(pWVar9,0);
    local_5c.bottom._2_2_ = (undefined2)((uint)pWVar9 >> 0x10);
    pWVar9 = FUN_00402c41(0xffffffdd);
    GetPrivateProfileStringW
              (pWVar22,(LPCWSTR)CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom),
               (LPCWSTR)&param_1,(LPWSTR)pHVar23,0x1fff,pWVar9);
    bVar26 = (short)pHVar23->unused == 10;
LAB_00401751:
    if (bVar26) {
LAB_00402859:
      local_8 = (HWND)0x1;
      *(undefined2 *)&pHVar23->unused = 0;
    }
    break;
  case 0x32:
    if ((HWND)local_20.dwHighDateTime == (HWND)0x0) {
      pHVar11 = (HKEY)FUN_00402c81((HKEY)0x2);
      if (pHVar11 == (HKEY)0x0) goto LAB_0040288b;
      pWVar22 = FUN_00402c41(0x33);
      LVar12 = RegDeleteValueW(pHVar11,pWVar22);
      RegCloseKey(pHVar11);
    }
    else {
      pWVar22 = FUN_00402c41(0x22);
      LVar12 = FUN_00402cff((int)local_2c[1],pWVar22,(int)local_20.dwHighDateTime >> 1);
    }
    if (LVar12 != 0) goto LAB_0040288b;
    break;
  case 0x33:
    local_5c.bottom._0_2_ = SUB42(local_18,0);
    local_5c.bottom._2_2_ = (undefined2)((uint)local_18 >> 0x10);
    local_40 = FUN_00402c41(2);
    pWVar22 = FUN_00402c41(0x11);
    local_8 = (HWND)0x1;
    param_1 = (HWND)FUN_00402cd1((int)local_2c[0],pWVar22,(HKEY)0x2);
    if (param_1 != (HWND)0x0) {
      DVar10 = 0;
      if ((HWND)local_20.dwHighDateTime == (HWND)0x1) {
        FUN_00402c41(0x23);
        iVar21 = lstrlenW((LPCWSTR)&DAT_004125d0);
        DVar10 = iVar21 * 2 + 2;
      }
      uVar28 = CONCAT44(local_38._4_4_,_DAT_004125d0);
      if ((HWND)local_20.dwHighDateTime == (HWND)0x4) {
        uVar28 = FUN_00402c1f(3);
        DVar10 = 4;
      }
      local_38._4_4_ = (HWND)((ulonglong)uVar28 >> 0x20);
      _DAT_004125d0 = (undefined4)uVar28;
      if ((HWND)local_20.dwHighDateTime == (HWND)0x3) {
        DVar10 = FUN_00403116(local_20.dwLowDateTime,(HANDLE)0x0,&DAT_004125d0,0xc000);
        uVar28 = CONCAT44(local_38._4_4_,_DAT_004125d0);
      }
      local_38._4_4_ = (HWND)((ulonglong)uVar28 >> 0x20);
      _DAT_004125d0 = (undefined4)uVar28;
      LVar12 = RegSetValueExW((HKEY)param_1,local_40,0,
                              CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom),
                              &DAT_004125d0,DVar10);
      pHVar11 = (HKEY)param_1;
      if (LVar12 == 0) {
        local_8 = (HWND)0x0;
      }
LAB_00402557:
      RegCloseKey(pHVar11);
    }
    break;
  case 0x34:
    pHVar11 = (HKEY)FUN_00402c81((HKEY)0x20019);
    pWVar22 = FUN_00402c41(0x33);
    *(undefined2 *)&pHVar23->unused = 0;
    if (pHVar11 != (HKEY)0x0) {
      local_5c.bottom._0_2_ = 0x4000;
      local_5c.bottom._2_2_ = 0;
      LVar12 = RegQueryValueExW(pHVar11,pWVar22,(LPDWORD)0x0,(LPDWORD)&param_1,(LPBYTE)pHVar23,
                                (LPDWORD)&local_5c.bottom);
      if (LVar12 == 0) {
        if (param_1 == (HWND)0x4) {
          local_8 = (HWND)(uint)((HWND)local_20.dwHighDateTime == (HWND)0x0);
          FUN_00406201((LPWSTR)pHVar23,pHVar23->unused);
          goto LAB_00402557;
        }
        if ((param_1 == (HWND)0x1) || (param_1 == (HWND)0x2)) {
          local_8 = (HWND)local_20.dwHighDateTime;
          goto LAB_0040254f;
        }
      }
      *(undefined2 *)&pHVar23->unused = 0;
      local_8 = (HWND)0x1;
      goto LAB_00402557;
    }
    goto LAB_0040288b;
  case 0x35:
    pHVar11 = (HKEY)FUN_00402c81((HKEY)0x20019);
    uVar28 = FUN_00402c1f(3);
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    *(undefined2 *)&pHVar23->unused = 0;
    if (pHVar11 != (HKEY)0x0) {
      param_1 = (HWND)0x1fff;
      if ((HWND)local_20.dwHighDateTime == (HWND)0x0) {
        LVar12 = RegEnumValueW(pHVar11,(DWORD)uVar28,(LPWSTR)pHVar23,(LPDWORD)&param_1,(LPDWORD)0x0,
                               (LPDWORD)0x0,(LPBYTE)0x0,(LPDWORD)0x0);
        if (LVar12 != 0) {
          local_8 = (HWND)0x1;
        }
      }
      else {
        RegEnumKeyW(pHVar11,(DWORD)uVar28,(LPWSTR)pHVar23,0x1fff);
      }
LAB_0040254f:
      *(undefined2 *)(&DAT_0047effe + iVar21) = 0;
      goto LAB_00402557;
    }
    goto LAB_0040288b;
  case 0x36:
    pvVar13 = (HANDLE)FUN_0040621a((ushort *)pHVar23);
    if (pvVar13 != (HANDLE)0x0) goto LAB_00401f4d;
    break;
  case 0x37:
    pWVar22 = FUN_00402c41(0xffffffed);
    pHVar19 = (HWND)FUN_00405db0(pWVar22,(DWORD)local_2c[1],(DWORD)local_24);
    if (pHVar19 == (HWND)0xffffffff) goto LAB_00402888;
switchD_00401ad7_default:
    FUN_00406201((LPWSTR)pHVar23,pHVar19);
    break;
  case 0x38:
  case 0x44:
    local_5c.bottom._0_2_ = SUB42(local_24,0);
    local_5c.bottom._2_2_ = (undefined2)((uint)local_24 >> 0x10);
    if (local_24 == (HWND)0x0) {
      if (local_30 == 0x38) {
        FUN_00402c41(0x21);
        WideCharToMultiByte(0,0,(LPCWSTR)&DAT_004125d0,-1,&DAT_0040e5d0,0x2000,(LPCSTR)0x0,
                            (LPBOOL)0x0);
        param_1 = (HWND)lstrlenA(&DAT_0040e5d0);
      }
      else {
        pWVar22 = FUN_00402c41(0x11);
        iVar21 = lstrlenW(pWVar22);
        param_1 = (HWND)(iVar21 * 2);
      }
    }
    else {
      _DAT_0040e5d0 = FUN_00402c1f(1);
      param_1 = (HWND)((local_30 != 0x38) + 1);
      local_40 = extraout_EDX;
    }
    if (((short)pHVar23->unused != 0) &&
       (((pvVar13 = (HANDLE)FUN_0040621a((ushort *)pHVar23),
         local_30 == 0x38 || CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom) != 0 ||
         ((HWND)local_20.dwLowDateTime == (HWND)0x0)) ||
        (iVar21 = FUN_00405e91(pvVar13,(int)pvVar13), -1 < iVar21)))) {
      pWVar14 = (LPWSTR)FUN_00405e62(pvVar13,&DAT_0040e5d0,(DWORD)param_1);
      goto LAB_004015b4;
    }
    goto LAB_0040288b;
  case 0x39:
  case 0x45:
    local_c = (HWND)0x0;
    local_4c = (FARPROC)0x2;
    uVar28 = FUN_00402c1f(2);
    local_40 = (LPCWSTR)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    if ((int)local_40 < 1) break;
    if (0x1fff < (int)local_40) {
      local_40 = (LPCWSTR)0x1fff;
    }
    if ((short)pHVar23->unused != 0) {
      local_38._4_4_ = (HWND)0x0;
      local_14 = (HWND)FUN_0040621a((ushort *)pHVar23);
      if (0 < (int)local_40) {
        do {
          if (local_30 == 0x39) {
            BVar15 = ReadFile(local_14,(LPVOID)((int)&param_1 + 2),2 - local_20.dwLowDateTime,
                              (LPDWORD)&local_3c,(LPOVERLAPPED)0x0);
            if ((BVar15 != 0) && (local_3c != (FARPROC)0x0)) {
              local_48[0] = CONCAT22((short)((uint)BVar15 >> 0x10),(ushort)param_1._2_1_);
              local_4c = local_3c;
              if ((HWND)local_20.dwLowDateTime == (HWND)0x0) {
                iVar21 = MultiByteToWideChar(0,8,(LPCSTR)((int)&param_1 + 2),(int)local_3c,
                                             (LPWSTR)local_48,1);
                if (iVar21 == 0) {
                  iVar21 = -(int)local_4c;
                  do {
                    local_3c = local_3c + -1;
                    local_48[0] = 0xfffd;
                    if (local_3c == (FARPROC)0x0) break;
                    local_4c = local_4c + -1;
                    iVar21 = iVar21 + 1;
                    SetFilePointer(local_14,iVar21,(PLONG)0x0,1);
                    iVar16 = MultiByteToWideChar(0,8,(LPCSTR)((int)&param_1 + 2),(int)local_3c,
                                                 (LPWSTR)local_48,1);
                  } while (iVar16 == 0);
                }
                goto LAB_00402762;
              }
LAB_00402798:
              FUN_00406201((LPWSTR)local_10,local_48[0] & 0xffff);
              goto LAB_00402ace;
            }
            break;
          }
          if (((((HWND)local_20.dwLowDateTime == (HWND)0x0) && (local_c == (HWND)0x0)) &&
              (iVar21 = FUN_00405e91(local_14,0), iVar21 < 0)) ||
             (iVar21 = FUN_00405e33(local_14,local_48,2), iVar21 == 0)) break;
LAB_00402762:
          if ((HWND)local_20.dwLowDateTime != (HWND)0x0) goto LAB_00402798;
          sVar1 = (short)local_48[0];
          if ((local_38._4_2_ == 0xd) || (local_38._4_2_ == 10)) {
            if ((local_38._4_2_ == sVar1) || ((sVar1 != 0xd && (sVar1 != 10)))) {
              SetFilePointer(local_14,-(int)local_4c,(PLONG)0x0,1);
            }
            else {
              *(short *)((int)&local_10->unused + (int)local_c * 2) = sVar1;
              local_c = (HWND)((int)local_c + 1);
            }
            break;
          }
          iVar21 = (int)local_c + 1;
          *(short *)((int)&local_10->unused + (int)local_c * 2) = sVar1;
          local_c = (HWND)iVar21;
          if ((sVar1 == 0) || (local_38._4_4_ = (HWND)local_48[0], (int)local_40 <= iVar21)) break;
        } while( true );
      }
    }
    bVar26 = local_c == (HWND)0x0;
    *(undefined2 *)((int)&local_10->unused + (int)local_c * 2) = 0;
    goto LAB_004015b6;
  case 0x3a:
    if ((short)pHVar23->unused != 0) {
      uVar28 = FUN_00402c1f(2);
      lDistanceToMove = (LONG)uVar28;
      local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
      local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
      lpDistanceToMoveHigh = (PLONG)0x0;
      pvVar13 = (HANDLE)FUN_0040621a((ushort *)pHVar23);
      pHVar19 = (HWND)SetFilePointer(pvVar13,lDistanceToMove,lpDistanceToMoveHigh,
                                     local_20.dwLowDateTime);
      pHVar23 = local_10;
      goto joined_r0x00402816;
    }
    break;
  case 0x3b:
    pvVar13 = (HANDLE)FUN_0040621a((ushort *)pHVar23);
    if (pvVar13 != (HANDLE)0x0) {
      FindClose(pvVar13);
    }
    break;
  case 0x3c:
    pvVar13 = (HANDLE)FUN_0040621a((ushort *)local_10);
    if ((pvVar13 != (HANDLE)0x0) && (BVar15 = FindNextFileW(pvVar13,&local_2d8), BVar15 != 0)) {
LAB_004028a0:
      pWVar24 = local_2d8.cFileName;
      goto LAB_004029e1;
    }
    goto LAB_00402859;
  case 0x3d:
    pWVar22 = FUN_00402c41(2);
    pvVar13 = FindFirstFileW(pWVar22,&local_2d8);
    if (pvVar13 != (HANDLE)0xffffffff) {
      FUN_00406201((LPWSTR)local_10,pvVar13);
      goto LAB_004028a0;
    }
    *(undefined2 *)&local_10->unused = 0;
LAB_00402888:
    *(undefined2 *)&pHVar23->unused = 0;
LAB_0040288b:
    local_8 = (HWND)0x1;
    break;
  case 0x3e:
    local_38._4_4_ = (HWND)0xfffffd66;
    pFVar17 = (FARPROC)FUN_00402c41(0xfffffff0);
    local_3c = pFVar17;
    iVar21 = FUN_00405c06((ushort *)pFVar17);
    if (iVar21 == 0) {
      FUN_00402c41(0xffffffed);
    }
    FUN_00405d8b((LPCWSTR)pFVar17);
    param_1 = (HWND)FUN_00405db0((LPCWSTR)pFVar17,0x40000000,2);
    if (param_1 != (HWND)0xffffffff) {
      local_40 = DAT_0047aef8;
      hMem = GlobalAlloc(0x40,(SIZE_T)DAT_0047aef8);
      if (hMem != (HGLOBAL)0x0) {
        FUN_00403347(0);
        FUN_00403331(hMem,(DWORD)local_40);
        piVar18 = GlobalAlloc(0x40,(SIZE_T)local_24);
        local_5c.bottom._0_2_ = SUB42(piVar18,0);
        local_5c.bottom._2_2_ = (undefined2)((uint)piVar18 >> 0x10);
        if (piVar18 != (int *)0x0) {
          FUN_00403116((int)local_2c[1],(HANDLE)0x0,(undefined *)piVar18,(uint)local_24);
          for (; (char)*piVar18 != '\0'; piVar18 = (int *)((int)(piVar18 + 2) + (int)local_38)) {
            local_38._0_4_ = *piVar18;
            FUN_00405d6b((undefined1 *)(piVar18[1] + (int)hMem),(int)(piVar18 + 2),(int)local_38);
          }
          GlobalFree((HGLOBAL)CONCAT22(local_5c.bottom._2_2_,(undefined2)local_5c.bottom));
        }
        FUN_00405e62(param_1,hMem,(DWORD)local_40);
        GlobalFree(hMem);
        local_38._4_4_ = (HWND)FUN_00403116(-1,param_1,(undefined *)0x0,0);
      }
      CloseHandle(param_1);
    }
    iVar21 = -0xd;
    if ((int)local_38._4_4_ < 0) {
      iVar21 = -0x11;
      DeleteFileW((LPCWSTR)local_3c);
      local_8 = (HWND)0x1;
    }
LAB_0040224b:
    FUN_00401423(iVar21);
    break;
  case 0x3f:
    uVar28 = FUN_00402c1f(0);
    uVar30 = (uint)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    if (DAT_0047af2c <= uVar30) goto LAB_0040288b;
    iVar21 = uVar30 * 0x4018 + DAT_0047af28;
    if (-1 < (int)local_24) {
      pHVar23 = local_10;
      pHVar19 = *(HWND *)(iVar21 + (int)local_24 * 4);
      if (local_24 == (HWND)0x0) {
        pWVar24 = (WCHAR *)(iVar21 + 0x18);
        goto LAB_004029e1;
      }
      goto switchD_00401ad7_default;
    }
    local_24 = (HWND)(-1 - (int)local_24);
    if (local_24 == (HWND)0x0) {
      FUN_004062dc((LPWSTR)(iVar21 + 0x18),local_20.dwHighDateTime);
      *(byte *)(iVar21 + 9) = *(byte *)(iVar21 + 9) | 1;
    }
    else {
      uVar28 = FUN_00402c1f(1);
      local_2c[1] = (HWND)uVar28;
      local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
      local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    }
    *(HWND *)(iVar21 + (int)local_24 * 4) = local_2c[1];
    if ((HWND)local_20.dwLowDateTime != (HWND)0x0) {
      FUN_0040117d(uVar30);
    }
    break;
  case 0x40:
    uVar28 = FUN_00402c1f(0);
    uVar30 = (uint)uVar28;
    local_5c.bottom._0_2_ = (undefined2)((ulonglong)uVar28 >> 0x20);
    local_5c.bottom._2_2_ = (undefined2)((ulonglong)uVar28 >> 0x30);
    if (0x1f < uVar30) goto LAB_0040288b;
    if ((HWND)local_20.dwLowDateTime == (HWND)0x0) {
      if (local_24 == (HWND)0x0) {
        FUN_004062dc((LPWSTR)local_10,*(int *)(DAT_0047aef4 + 0x94 + uVar30 * 4));
      }
      else {
        *(HWND *)(DAT_0047aef4 + 0x94 + uVar30 * 4) = local_2c[1];
      }
    }
    else {
      if (local_24 == (HWND)0x0) {
        pHVar19 = (HWND)FUN_004012e2(0);
        pHVar23 = local_10;
        goto switchD_00401ad7_default;
      }
      FUN_00401299(uVar30);
      FUN_004011ef(0,0);
    }
    break;
  case 0x43:
    SendMessageW(DAT_0047aee8,0xb,DAT_00460248 & (uint)local_2c[0],0);
    if (local_2c[0] != (HWND)0x0) {
      InvalidateRect(local_c,(RECT *)0x0,0);
    }
  }
switchD_0040148a_caseD_41:
  _DAT_0047af88 = (int)&local_8->unused + _DAT_0047af88;
LAB_00402ace:
  local_2c[0] = (HWND)0x0;
switchD_0040148a_caseD_2:
  return local_2c[0];
}
Assembly · 1908 instructions, 178 annotated
AddressBytesInstructionComment
0040143455PUSH EBP
004014358b ecMOV EBP,ESP
0040143781 ec d4 02 00 00SUB ESP,0x2d4
0040143d53PUSH EBX
0040143e56PUSH ESI
0040143f8b 75 08MOV ESI,dword ptr [EBP + param_1]
0040144257PUSH EDI
00401443a1 e8 ae 47 00MOV EAX,[DAT_0047aee8]
004014486a 07PUSH 0x7
0040144a59POP ECX
0040144b8d 7d d4LEA EDI,[EBP + -0x2c]
0040144ef3 a5MOVSD.REP ES:EDI,ESI
004014508b 4d dcMOV ECX,dword ptr [EBP + local_28]
004014538b 55 d4MOV EDX,dword ptr [EBP + local_30]
00401456bf 00 b0 47 00MOV EDI,DAT_0047b000
0040145b89 45 f8MOV dword ptr [EBP + local_c],EAX
0040145e8b 45 d8MOV EAX,dword ptr [EBP + local_2c]
0040146133 dbXOR EBX,EBX
00401463c1 e1 0eSHL ECX,0xe
0040146603 cfADD ECX,EDI
004014688b f0MOV ESI,EAX
0040146a89 4d f4MOV dword ptr [EBP + local_10],ECX
0040146d8d 4d d8LEA ECX,[EBP + -0x28]
00401470c1 e6 0eSHL ESI,0xe
0040147389 0d 2c e6 41 00MOV dword ptr [DAT_0041e62c],ECX
004014798d 4a feLEA ECX,[EDX + -0x2]
0040147c03 f7ADD ESI,EDI
0040147e83 f9 43CMP ECX,0x43
0040148189 5d fcMOV dword ptr [EBP + local_8],EBX
004014840f 87 3b 16 00 00JA caseD_41
0040148aff 24 8d d7 2a 40 00JMP dword ptr [ECX*0x4 + switchdataD_00402ad7]
caseD_3:
0040149153PUSH EBX
0040149250PUSH EAX
LAB_00401493:
00401493e8 8a 3e 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
00401498e9 5a 0e 00 00JMP LAB_004022f7
caseD_4:
0040149dff 05 ac 2e 47 00INC dword ptr [DAT_00472eac]
004014a339 5d f8CMP dword ptr [EBP + local_c],EBX
004014a60f 84 4b 0e 00 00JZ LAB_004022f7
004014ac53PUSH EBX
004014adff 15 94 82 40 00CALL dword ptr [PTR_PostQuitMessage_00408294]
004014b3e9 3f 0e 00 00JMP LAB_004022f7
caseD_5:
004014b850PUSH EAX
004014b9e8 af fe ff ffCALL FUN_0040136d
004014be48DEC EAX
004014bf53PUSH EBX
004014c050PUSH EAX
004014c1e8 c3 fe ff ffCALL FUN_00401389; FUN_00401389: MulDiv, SendMessageW
004014c6e9 05 16 00 00JMP caseD_2
caseD_6:
004014cb53PUSH EBX
004014cc50PUSH EAX
004014cde8 50 3e 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
004014d2e9 ee 15 00 00JMP caseD_41
caseD_7:
004014d753PUSH EBX
004014d8e8 42 17 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004014dd83 f8 01CMP EAX,0x1
004014e059POP ECX
004014e189 55 b4MOV dword ptr [EBP + local_50],EDX
004014e47f 03JG LAB_004014e9
004014e633 c0XOR EAX,EAX
004014e840INC EAX
LAB_004014e9:
004014e950PUSH EAX
004014eaff 15 78 80 40 00CALL dword ptr [PTR_Sleep_00408078]
004014f0e9 d0 15 00 00JMP caseD_41
caseD_8:
004014f5ff 75 f8PUSH dword ptr [EBP + local_c]
004014f8ff 15 64 82 40 00CALL dword ptr [PTR_SetForegroundWindow_00408264]
004014fee9 c2 15 00 00JMP caseD_41
caseD_d:
00401503c1 e0 02SHL EAX,0x2
0040150639 5d e0CMP dword ptr [EBP + local_24],EBX
0040150975 26JNZ LAB_00401531
0040150b8b 88 80 af 47 00MOV ECX,dword ptr [EAX + DAT_0047af80]
004015116a 01PUSH 0x1
0040151389 88 c0 af 47 00MOV dword ptr [EAX + DAT_0047afc0],ECX
00401519e8 01 17 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040151e59POP ECX
0040151f89 55 b4MOV dword ptr [EBP + local_50],EDX
004015228b 4d d8MOV ECX,dword ptr [EBP + local_2c]
0040152589 04 8d 80 af 47 00MOV dword ptr [ECX*0x4 + DAT_0047af80],EAX
0040152ce9 94 15 00 00JMP caseD_41
LAB_00401531:
004015318b 88 c0 af 47 00MOV ECX,dword ptr [EAX + DAT_0047afc0]
0040153789 88 80 af 47 00MOV dword ptr [EAX + DAT_0047af80],ECX
0040153de9 83 15 00 00JMP caseD_41
caseD_e:
004015428b 45 e0MOV EAX,dword ptr [EBP + local_24]
004015458d 34 85 80 af 47 00LEA ESI,[EAX*0x4 + DAT_0047af80]
0040154c33 c0XOR EAX,EAX
0040154e8b 0eMOV ECX,dword ptr [ESI]
004015503b cbCMP ECX,EBX
004015520f 94 c0SETZ AL
0040155523 4d e4AND ECX,dword ptr [EBP + local_20]
004015588b 44 85 d8MOV EAX,dword ptr [EBP + EAX*0x4 + -0x28]
0040155c89 0eMOV dword ptr [ESI],ECX
0040155ee9 6d 15 00 00JMP caseD_2
caseD_f:
004015638b 45 dcMOV EAX,dword ptr [EBP + local_28]
00401566ff 34 85 80 af 47 00PUSH dword ptr [EAX*0x4 + DAT_0047af80]
LAB_0040156d:
0040156d56PUSH ESI
0040156ee9 f8 14 00 00JMP default
caseD_9:
004015738b 0d b0 2e 47 00MOV ECX,dword ptr [DAT_00472eb0]
004015798b 35 68 82 40 00MOV ESI,dword ptr [PTR_ShowWindow_00408268]
0040157f3b cbCMP ECX,EBX
0040158174 09JZ LAB_0040158c
00401583ff 75 dcPUSH dword ptr [EBP + local_28]
0040158651PUSH ECX
00401587ff d6CALL ESI
004015898b 45 d8MOV EAX,dword ptr [EBP + local_2c]
LAB_0040158c:
0040158c8b 0d c4 2e 47 00MOV ECX,dword ptr [DAT_00472ec4]
004015923b cbCMP ECX,EBX
004015940f 84 2b 15 00 00JZ caseD_41
0040159a50PUSH EAX
0040159b51PUSH ECX
0040159cff d6CALL ESI
0040159ee9 22 15 00 00JMP caseD_41
caseD_a:
004015a36a f0PUSH -0x10
004015a5e8 97 16 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004015aaff 75 dcPUSH dword ptr [EBP + local_28]
004015ad50PUSH EAX
004015aeff 15 74 80 40 00CALL dword ptr [PTR_SetFileAttributesW_00408074]
LAB_004015b4:
004015b485 c0TEST EAX,EAX
LAB_004015b6:
004015b60f 85 09 15 00 00JNZ caseD_41
004015bce9 ca 12 00 00JMP LAB_0040288b
caseD_b:
004015c16a f0PUSH -0x10
004015c3e8 79 16 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004015c850PUSH EAX
004015c989 45 08MOV dword ptr [EBP + param_1],EAX
004015cce8 69 46 00 00CALL FUN_00405c3a; FUN_00405c3a: CharNextW
004015d18b f0MOV ESI,EAX
004015d33b f3CMP ESI,EBX
004015d574 5aJZ LAB_00401631
LAB_004015d7:
004015d76a 5cPUSH 0x5c
004015d956PUSH ESI
004015dae8 dd 45 00 00CALL FUN_00405bbc; FUN_00405bbc: CharNextW
004015df8b f0MOV ESI,EAX
004015e166 8b 3eMOV DI,word ptr [ESI]
004015e466 89 1eMOV word ptr [ESI],BX
004015e766 3b fbCMP DI,BX
004015ea75 18JNZ LAB_00401604
004015ec39 5d e0CMP dword ptr [EBP + local_24],EBX
004015ef74 13JZ LAB_00401604
004015f1e8 95 42 00 00CALL FUN_0040588b; FUN_0040588b: GetModuleHandleA, GetProcAddress
004015f685 c0TEST EAX,EAX
004015f874 0aJZ LAB_00401604
004015faff 75 08PUSH dword ptr [EBP + param_1]
004015fde8 ef 41 00 00CALL FUN_004057f1; FUN_004057f1: CreateDirectoryW, GetLastError, SetFileSecurityW
00401602eb 08JMP LAB_0040160c
LAB_00401604:
00401604ff 75 08PUSH dword ptr [EBP + param_1]
00401607e8 62 42 00 00CALL FUN_0040586e; FUN_0040586e: CreateDirectoryW, GetLastError
LAB_0040160c:
0040160c3b c3CMP EAX,EBX
0040160e74 17JZ LAB_00401627
004016103d b7 00 00 00CMP EAX,0xb7
0040161575 0dJNZ LAB_00401624
00401617ff 75 08PUSH dword ptr [EBP + param_1]
0040161aff 15 94 80 40 00CALL dword ptr [PTR_GetFileAttributesW_00408094]
00401620a8 10TEST AL,0x10
0040162275 03JNZ LAB_00401627
LAB_00401624:
00401624ff 45 fcINC dword ptr [EBP + local_8]
LAB_00401627:
0040162766 89 3eMOV word ptr [ESI],DI
0040162a46INC ESI
0040162b46INC ESI
0040162c66 3b fbCMP DI,BX
0040162f75 a6JNZ LAB_004015d7
LAB_00401631:
0040163139 5d dcCMP dword ptr [EBP + local_28],EBX
0040163474 2dJZ LAB_00401663
004016366a e6PUSH -0x1a
00401638e8 e6 fd ff ffCALL FUN_00401423; FUN_00401423: SetWindowTextW, SendMessageW
0040163dff 75 08PUSH dword ptr [EBP + param_1]
0040164068 00 30 4d 00PUSH DAT_004d3000
00401645e8 70 4c 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
0040164aff 75 08PUSH dword ptr [EBP + param_1]
0040164dff 15 90 80 40 00CALL dword ptr [PTR_SetCurrentDirectoryW_00408090]
0040165385 c0TEST EAX,EAX
004016550f 85 6a 14 00 00JNZ caseD_41
0040165bff 45 fcINC dword ptr [EBP + local_8]
0040165ee9 62 14 00 00JMP caseD_41
LAB_00401663:
004016636a f5PUSH -0xb
00401665e9 e1 0b 00 00JMP LAB_0040224b
caseD_c:
0040166a53PUSH EBX
0040166be8 d1 15 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040167050PUSH EAX
00401671e8 87 4f 00 00CALL FUN_004065fd; FUN_004065fd: FindFirstFileW, FindClose
00401676e9 89 06 00 00JMP LAB_00401d04
caseD_10:
0040167b6a d0PUSH -0x30
0040167de8 bf 15 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004016826a dfPUSH -0x21
004016848b f0MOV ESI,EAX
00401686e8 b6 15 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040168b6a 13PUSH 0x13
0040168d8b f8MOV EDI,EAX
0040168fe8 ad 15 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040169457PUSH EDI
0040169556PUSH ESI
00401696ff 15 08 81 40 00CALL dword ptr [PTR_MoveFileW_00408108]
0040169c85 c0TEST EAX,EAX
0040169e74 07JZ LAB_004016a7
004016a06a e3PUSH -0x1d
004016a2e9 a4 0b 00 00JMP LAB_0040224b
LAB_004016a7:
004016a739 5d e0CMP dword ptr [EBP + local_24],EBX
004016aa0f 84 db 11 00 00JZ LAB_0040288b
004016b056PUSH ESI
004016b1e8 47 4f 00 00CALL FUN_004065fd; FUN_004065fd: FindFirstFileW, FindClose
004016b685 c0TEST EAX,EAX
004016b80f 84 cd 11 00 00JZ LAB_0040288b
004016be57PUSH EDI
004016bf56PUSH ESI
004016c0e8 bb 49 00 00CALL FUN_00406080; FUN_00406080: MoveFileExW
004016c56a e4PUSH -0x1c
004016c7e9 7f 0b 00 00JMP LAB_0040224b
caseD_11:
004016cc53PUSH EBX
004016cde8 6f 15 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004016d28b 7d f4MOV EDI,dword ptr [EBP + local_10]
004016d58b f0MOV ESI,EAX
004016d78d 45 08LEA EAX,[EBP + 0x8]
004016da50PUSH EAX
004016db57PUSH EDI
004016dc68 00 20 00 00PUSH 0x2000
004016e156PUSH ESI
004016e2ff 15 0c 81 40 00CALL dword ptr [PTR_GetFullPathNameW_0040810c]
004016e885 c0TEST EAX,EAX
004016ea74 24JZ LAB_00401710
004016ec8b 45 08MOV EAX,dword ptr [EBP + param_1]
004016ef3b c6CMP EAX,ESI
004016f176 27JBE LAB_0040171a
004016f366 39 18CMP word ptr [EAX],BX
004016f674 22JZ LAB_0040171a
004016f856PUSH ESI
004016f9e8 ff 4e 00 00CALL FUN_004065fd; FUN_004065fd: FindFirstFileW, FindClose
004016fe3b c3CMP EAX,EBX
0040170074 0eJZ LAB_00401710
0040170283 c0 2cADD EAX,0x2c
0040170550PUSH EAX
00401706ff 75 08PUSH dword ptr [EBP + param_1]
00401709e8 ac 4b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
0040170eeb 0aJMP LAB_0040171a
LAB_00401710:
00401710c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
0040171766 89 1fMOV word ptr [EDI],BX
LAB_0040171a:
0040171a39 5d e0CMP dword ptr [EBP + local_24],EBX
0040171d0f 85 a2 13 00 00JNZ caseD_41
0040172368 00 20 00 00PUSH 0x2000
0040172857PUSH EDI
0040172957PUSH EDI
0040172aff 15 bc 80 40 00CALL dword ptr [PTR_GetShortPathNameW_004080bc]
00401730e9 90 13 00 00JMP caseD_41
caseD_12:
004017356a ffPUSH -0x1
00401737e8 05 15 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040173c8d 4d 08LEA ECX,[EBP + 0x8]
0040173f51PUSH ECX
0040174056PUSH ESI
0040174168 00 20 00 00PUSH 0x2000
0040174653PUSH EBX
0040174750PUSH EAX
0040174853PUSH EBX
00401749ff 15 14 81 40 00CALL dword ptr [PTR_SearchPathW_00408114]
0040174f85 c0TEST EAX,EAX
LAB_00401751:
004017510f 85 6e 13 00 00JNZ caseD_41
00401757e9 fd 10 00 00JMP LAB_00402859
caseD_13:
0040175c6a efPUSH -0x11
0040175ee8 de 14 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040176350PUSH EAX
0040176456PUSH ESI
00401765e8 75 46 00 00CALL FUN_00405ddf; FUN_00405ddf: GetTickCount, GetTempFileNameW
0040176ae9 45 fe ff ffJMP LAB_004015b4
caseD_14:
0040176f6a 31PUSH 0x31
00401771e8 cb 14 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040177689 45 f8MOV dword ptr [EBP + local_c],EAX
004017798b 45 d8MOV EAX,dword ptr [EBP + local_2c]
0040177cff 75 f8PUSH dword ptr [EBP + local_c]
0040177f83 e0 07AND EAX,0x7
0040178289 45 08MOV dword ptr [EBP + param_1],EAX
00401785e8 7c 44 00 00CALL FUN_00405c06
0040178aff 75 f8PUSH dword ptr [EBP + local_c]
0040178dbe d0 a5 40 00MOV ESI,DAT_0040a5d0
0040179285 c0TEST EAX,EAX
0040179474 08JZ LAB_0040179e
0040179656PUSH ESI
00401797e8 1e 4b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
0040179ceb 17JMP LAB_004017b5
LAB_0040179e:
0040179e68 00 30 4d 00PUSH DAT_004d3000
004017a356PUSH ESI
004017a4e8 11 4b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
004017a950PUSH EAX
004017aae8 e0 43 00 00CALL FUN_00405b8f; FUN_00405b8f: CharPrevW
004017af50PUSH EAX
004017b0e8 21 4b 00 00CALL lstrcatW
LAB_004017b5:
004017b556PUSH ESI
004017b6e8 93 4d 00 00CALL FUN_0040654e; FUN_0040654e: CharNextW, CharPrevW
LAB_004017bb:
004017bb83 7d 08 03CMP dword ptr [EBP + param_1],0x3
004017bf7c 31JL LAB_004017f2
004017c156PUSH ESI
004017c2e8 36 4e 00 00CALL FUN_004065fd; FUN_004065fd: FindFirstFileW, FindClose
004017c733 c9XOR ECX,ECX
004017c93b c3CMP EAX,EBX
004017cb74 10JZ LAB_004017dd
004017cd8d 4d e4LEA ECX,[EBP + -0x1c]
004017d083 c0 14ADD EAX,0x14
004017d351PUSH ECX
004017d450PUSH EAX
004017d5ff 15 18 81 40 00CALL dword ptr [PTR_CompareFileTime_00408118]
004017db8b c8MOV ECX,EAX
LAB_004017dd:
004017dd8b 45 08MOV EAX,dword ptr [EBP + param_1]
004017e083 c0 fdADD EAX,-0x3
004017e30d 00 00 00 80OR EAX,0x80000000
004017e823 c1AND EAX,ECX
004017eaf7 d8NEG EAX
004017ec1b c0SBB EAX,EAX
004017ee40INC EAX
004017ef89 45 08MOV dword ptr [EBP + param_1],EAX
LAB_004017f2:
004017f239 5d 08CMP dword ptr [EBP + param_1],EBX
004017f575 06JNZ LAB_004017fd
004017f756PUSH ESI
004017f8e8 8e 45 00 00CALL FUN_00405d8b; FUN_00405d8b: GetFileAttributesW, SetFileAttributesW
LAB_004017fd:
004017fd33 c0XOR EAX,EAX
004017ff83 7d 08 01CMP dword ptr [EBP + param_1],0x1
004018030f 95 c0SETNZ AL
0040180640INC EAX
0040180750PUSH EAX
0040180868 00 00 00 40PUSH 0x40000000
0040180d56PUSH ESI
0040180ee8 9d 45 00 00CALL FUN_00405db0; FUN_00405db0: GetFileAttributesW, CreateFileW
0040181383 f8 ffCMP EAX,-0x1
0040181689 45 d0MOV dword ptr [EBP + local_34],EAX
0040181975 72JNZ LAB_0040188d
0040181b39 5d 08CMP dword ptr [EBP + param_1],EBX
0040181e75 4fJNZ LAB_0040186f
0040182057PUSH EDI
0040182168 d0 25 41 00PUSH DAT_004125d0
00401826e8 8f 4a 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
0040182b56PUSH ESI
0040182c57PUSH EDI
0040182de8 88 4a 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00401832ff 75 ecPUSH dword ptr [EBP + local_18]
0040183568 d0 e5 40 00PUSH DAT_0040e5d0
0040183ae8 9d 4a 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040183f68 d0 25 41 00PUSH DAT_004125d0
0040184457PUSH EDI
00401845e8 70 4a 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
0040184a8b 45 d8MOV EAX,dword ptr [EBP + local_2c]
0040184dc1 f8 03SAR EAX,0x3
0040185050PUSH EAX
0040185168 d0 e5 40 00PUSH DAT_0040e5d0
00401856e8 c5 40 00 00CALL FUN_00405920; FUN_00405920: MessageBoxIndirectW
0040185b83 e8 04SUB EAX,0x4
0040185e0f 84 57 ff ff ffJZ LAB_004017bb
0040186448DEC EAX
0040186574 1bJZ LAB_00401882
0040186756PUSH ESI
004018686a faPUSH -0x6
0040186ae9 24 fc ff ffJMP LAB_00401493
LAB_0040186f:
0040186fff 75 f8PUSH dword ptr [EBP + local_c]
004018726a e2PUSH -0x1e
00401874e8 a9 3a 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
0040187983 7d 08 02CMP dword ptr [EBP + param_1],0x2
0040187de9 34 fd ff ffJMP LAB_004015b6
LAB_00401882:
00401882ff 05 88 af 47 00INC dword ptr [DAT_0047af88]
00401888e9 41 12 00 00JMP LAB_00402ace
LAB_0040188d:
0040188dff 75 f8PUSH dword ptr [EBP + local_c]
004018906a eaPUSH -0x16
00401892e8 8b 3a 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
00401897ff 05 b4 af 47 00INC dword ptr [DAT_0047afb4]
0040189d53PUSH EBX
0040189e53PUSH EBX
0040189fff 75 d0PUSH dword ptr [EBP + local_34]
004018a2ff 75 e0PUSH dword ptr [EBP + local_24]
004018a5e8 6c 18 00 00CALL FUN_00403116; FUN_00403116: GetTickCount, MulDiv, wsprintfW
004018aaff 0d b4 af 47 00DEC dword ptr [DAT_0047afb4]
004018b083 7d e4 ffCMP dword ptr [EBP + local_20],-0x1
004018b48b f8MOV EDI,EAX
004018b675 06JNZ LAB_004018be
004018b883 7d e8 ffCMP dword ptr [EBP + local_1c],-0x1
004018bc74 12JZ LAB_004018d0
LAB_004018be:
004018be8d 45 e4LEA EAX,[EBP + -0x1c]
004018c150PUSH EAX
004018c28d 45 e4LEA EAX,[EBP + -0x1c]
004018c553PUSH EBX
004018c650PUSH EAX
004018c7ff 75 d0PUSH dword ptr [EBP + local_34]
004018caff 15 10 81 40 00CALL dword ptr [PTR_SetFileTime_00408110]
LAB_004018d0:
004018d0ff 75 d0PUSH dword ptr [EBP + local_34]
004018d3ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
004018d93b fbCMP EDI,EBX
004018db0f 8d e4 11 00 00JGE caseD_41
004018e183 ff feCMP EDI,-0x2
004018e475 13JNZ LAB_004018f9
004018e66a e9PUSH -0x17
004018e856PUSH ESI
004018e9e8 ee 49 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004018eeff 75 f8PUSH dword ptr [EBP + local_c]
004018f156PUSH ESI
004018f2e8 df 49 00 00CALL lstrcatW
004018f7eb 08JMP LAB_00401901
LAB_004018f9:
004018f96a eePUSH -0x12
004018fb56PUSH ESI
004018fce8 db 49 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
LAB_00401901:
0040190168 10 00 20 00PUSH 0x200010
0040190656PUSH ESI
00401907e9 e6 09 00 00JMP LAB_004022f2
caseD_15:
0040190c53PUSH EBX
0040190deb 34JMP LAB_00401943
caseD_16:
0040190f6a 31PUSH 0x31
00401911e8 2b 13 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401916ff 75 d8PUSH dword ptr [EBP + local_2c]
0040191950PUSH EAX
0040191ae8 01 40 00 00CALL FUN_00405920; FUN_00405920: MessageBoxIndirectW
0040191f3b c3CMP EAX,EBX
004019210f 84 64 0f 00 00JZ LAB_0040288b
004019273b 45 e0CMP EAX,dword ptr [EBP + local_24]
0040192a0f 84 6c 01 00 00JZ LAB_00401a9c
004019303b 45 e8CMP EAX,dword ptr [EBP + local_1c]
004019330f 85 8c 11 00 00JNZ caseD_41
004019398b 45 ecMOV EAX,dword ptr [EBP + local_18]
0040193ce9 8f 11 00 00JMP caseD_2
caseD_17:
004019416a f0PUSH -0x10
LAB_00401943:
00401943e8 f9 12 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401948ff 75 dcPUSH dword ptr [EBP + local_28]
0040194b50PUSH EAX
0040194ce8 7b 40 00 00CALL FUN_004059cc; FUN_004059cc: DeleteFileW, FindFirstFileW, FindNextFileW, FindClose
00401951e9 6f 11 00 00JMP caseD_41
caseD_18:
004019566a 01PUSH 0x1
00401958e8 e4 12 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040195d50PUSH EAX
0040195ee8 6d 49 00 00CALL lstrlenW
00401963e9 2a 0c 00 00JMP LAB_00402592
caseD_19:
004019686a 02PUSH 0x2
0040196ae8 b0 12 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040196f6a 03PUSH 0x3
0040197189 45 b0MOV dword ptr [EBP + local_54],EAX
0040197489 55 b4MOV dword ptr [EBP + local_50],EDX
00401977e8 a3 12 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040197c59POP ECX
0040197d8b f8MOV EDI,EAX
0040197f8b 45 b0MOV EAX,dword ptr [EBP + local_54]
0040198259POP ECX
004019836a 01PUSH 0x1
0040198589 7d ccMOV dword ptr [EBP + local_38],EDI
0040198889 55 d0MOV dword ptr [EBP + local_34],EDX
0040198b89 45 08MOV dword ptr [EBP + param_1],EAX
0040198ee8 ae 12 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040199350PUSH EAX
0040199489 45 c4MOV dword ptr [EBP + local_40],EAX
00401997e8 34 49 00 00CALL lstrlenW
0040199c39 5d b4CMP dword ptr [EBP + local_50],EBX
0040199f66 89 1eMOV word ptr [ESI],BX
004019a275 03JNZ LAB_004019a7
004019a489 45 08MOV dword ptr [EBP + param_1],EAX
LAB_004019a7:
004019a739 5d 08CMP dword ptr [EBP + param_1],EBX
004019aa0f 84 15 11 00 00JZ caseD_41
004019b08b 4d ccMOV ECX,dword ptr [EBP + local_38]
004019b33b cbCMP ECX,EBX
004019b57d 0bJGE LAB_004019c2
004019b78d 3c 08LEA EDI,[EAX + ECX*0x1]
004019ba3b fbCMP EDI,EBX
004019bc0f 8c 03 11 00 00JL caseD_41
LAB_004019c2:
004019c23b f8CMP EDI,EAX
004019c47e 02JLE LAB_004019c8
004019c68b f8MOV EDI,EAX
LAB_004019c8:
004019c88b 45 c4MOV EAX,dword ptr [EBP + local_40]
004019cb8d 04 78LEA EAX,[EAX + EDI*0x2]
004019ce50PUSH EAX
004019cf56PUSH ESI
004019d0e8 e5 48 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
004019d539 5d 08CMP dword ptr [EBP + param_1],EBX
004019d87d 0eJGE LAB_004019e8
004019da56PUSH ESI
004019dbe8 f0 48 00 00CALL lstrlenW
004019e001 45 08ADD dword ptr [EBP + param_1],EAX
004019e379 03JNS LAB_004019e8
004019e589 5d 08MOV dword ptr [EBP + param_1],EBX
LAB_004019e8:
004019e88b 45 08MOV EAX,dword ptr [EBP + param_1]
004019eb3d 00 20 00 00CMP EAX,0x2000
004019f00f 8d cf 10 00 00JGE caseD_41
004019f666 89 1c 46MOV word ptr [ESI + EAX*0x2],BX
004019fae9 c6 10 00 00JMP caseD_41
caseD_1a:
004019ff6a 20PUSH 0x20
00401a01e8 3b 12 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401a066a 31PUSH 0x31
00401a088b f0MOV ESI,EAX
00401a0ae8 32 12 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401a0f39 5d e8CMP dword ptr [EBP + local_1c],EBX
00401a1250PUSH EAX
00401a1356PUSH ESI
00401a1475 12JNZ LAB_00401a28
00401a16ff 15 04 81 40 00CALL dword ptr [PTR_lstrcmpiW_00408104]
LAB_00401a1c:
00401a1c85 c0TEST EAX,EAX
00401a1e75 7cJNZ LAB_00401a9c
LAB_00401a20:
00401a208b 45 e0MOV EAX,dword ptr [EBP + local_24]
00401a23e9 a8 10 00 00JMP caseD_2
LAB_00401a28:
00401a28ff 15 1c 81 40 00CALL dword ptr [PTR_lstrcmpW_0040811c]
00401a2eeb ecJMP LAB_00401a1c
caseD_1b:
00401a3033 ffXOR EDI,EDI
00401a3247INC EDI
00401a3357PUSH EDI
00401a34e8 08 12 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401a3968 00 20 00 00PUSH 0x2000
00401a3e56PUSH ESI
00401a3f50PUSH EAX
00401a4089 45 08MOV dword ptr [EBP + param_1],EAX
00401a43ff 15 24 81 40 00CALL dword ptr [PTR_ExpandEnvironmentStringsW_00408124]
00401a4985 c0TEST EAX,EAX
00401a4b74 13JZ LAB_00401a60
00401a4d39 5d e0CMP dword ptr [EBP + local_24],EBX
00401a5074 14JZ LAB_00401a66
00401a5256PUSH ESI
00401a53ff 75 08PUSH dword ptr [EBP + param_1]
00401a56ff 15 1c 81 40 00CALL dword ptr [PTR_lstrcmpW_0040811c]
00401a5c85 c0TEST EAX,EAX
00401a5e75 06JNZ LAB_00401a66
LAB_00401a60:
00401a6089 7d fcMOV dword ptr [EBP + local_8],EDI
00401a6366 89 1eMOV word ptr [ESI],BX
LAB_00401a66:
00401a6666 89 9e fe 3f 00 00MOV word ptr [ESI + 0x3ffe],BX
00401a6de9 53 10 00 00JMP caseD_41
caseD_1c:
00401a728b 75 ecMOV ESI,dword ptr [EBP + local_18]
00401a7553PUSH EBX
00401a76e8 a4 11 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401a7b6a 01PUSH 0x1
00401a7d8b f8MOV EDI,EAX
00401a7f89 55 b4MOV dword ptr [EBP + local_50],EDX
00401a82e8 98 11 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401a8759POP ECX
00401a883b f3CMP ESI,EBX
00401a8a59POP ECX
00401a8b89 55 b4MOV dword ptr [EBP + local_50],EDX
00401a8e75 08JNZ LAB_00401a98
00401a903b f8CMP EDI,EAX
00401a927c 08JL LAB_00401a9c
00401a947e 8aJLE LAB_00401a20
00401a96eb 12JMP LAB_00401aaa
LAB_00401a98:
00401a983b f8CMP EDI,EAX
00401a9a73 08JNC LAB_00401aa4
LAB_00401a9c:
00401a9c8b 45 e4MOV EAX,dword ptr [EBP + local_20]
00401a9fe9 2c 10 00 00JMP caseD_2
LAB_00401aa4:
00401aa40f 86 76 ff ff ffJBE LAB_00401a20
LAB_00401aaa:
00401aaa8b 45 e8MOV EAX,dword ptr [EBP + local_1c]
00401aade9 1e 10 00 00JMP caseD_2
caseD_1d:
00401ab26a 01PUSH 0x1
00401ab4e8 66 11 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401ab98b f8MOV EDI,EAX
00401abb6a 02PUSH 0x2
00401abd89 55 b4MOV dword ptr [EBP + local_50],EDX
00401ac089 7d 08MOV dword ptr [EBP + param_1],EDI
00401ac3e8 57 11 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401ac859POP ECX
00401ac989 55 b4MOV dword ptr [EBP + local_50],EDX
00401acc59POP ECX
00401acd8b c8MOV ECX,EAX
00401acf8b 45 e4MOV EAX,dword ptr [EBP + local_20]
00401ad283 f8 0dCMP EAX,0xd
00401ad577 73JA LAB_00401b4a
00401ad7ff 24 85 e7 2b 40 00JMP dword ptr [EAX*0x4 + switchdataD_00402be7]
caseD_0:
00401ade03 f9ADD EDI,ECX
00401ae0eb 6bJMP LAB_00401b4d
caseD_1:
00401ae22b f9SUB EDI,ECX
00401ae4eb 67JMP LAB_00401b4d
caseD_2:
00401ae60f af cfIMUL ECX,EDI
00401ae9eb 17JMP LAB_00401b02
caseD_3:
00401aeb3b cbCMP ECX,EBX
00401aed74 44JZ LAB_00401b33
00401aef8b c7MOV EAX,EDI
00401af199CDQ
00401af2f7 f9IDIV ECX
LAB_00401af4:
00401af48b f8MOV EDI,EAX
00401af6eb 55JMP LAB_00401b4d
caseD_4:
00401af80b cfOR ECX,EDI
00401afaeb 06JMP LAB_00401b02
caseD_5:
00401afc23 cfAND ECX,EDI
00401afeeb 02JMP LAB_00401b02
caseD_6:
00401b0033 cfXOR ECX,EDI
LAB_00401b02:
00401b028b f9MOV EDI,ECX
00401b04eb 47JMP LAB_00401b4d
caseD_7:
00401b0633 c0XOR EAX,EAX
00401b083b fbCMP EDI,EBX
00401b0a0f 94 c0SETZ AL
00401b0deb e5JMP LAB_00401af4
caseD_8:
00401b0f3b fbCMP EDI,EBX
00401b1175 0eJNZ LAB_00401b21
00401b13eb 08JMP LAB_00401b1d
LAB_00401b15:
00401b1533 ffXOR EDI,EDI
00401b17eb 34JMP LAB_00401b4d
caseD_9:
00401b193b fbCMP EDI,EBX
00401b1b74 f8JZ LAB_00401b15
LAB_00401b1d:
00401b1d3b cbCMP ECX,EBX
00401b1f74 f4JZ LAB_00401b15
LAB_00401b21:
00401b2133 ffXOR EDI,EDI
00401b2347INC EDI
00401b24eb 27JMP LAB_00401b4d
caseD_a:
00401b263b cbCMP ECX,EBX
00401b2874 09JZ LAB_00401b33
00401b2a8b c7MOV EAX,EDI
00401b2c99CDQ
00401b2df7 f9IDIV ECX
00401b2f8b faMOV EDI,EDX
00401b31eb 1aJMP LAB_00401b4d
LAB_00401b33:
00401b3333 ffXOR EDI,EDI
00401b35c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
00401b3ceb 0fJMP LAB_00401b4d
caseD_b:
00401b3ed3 e7SHL EDI,CL
00401b40eb 0bJMP LAB_00401b4d
caseD_c:
00401b42d3 ffSAR EDI,CL
00401b44eb 07JMP LAB_00401b4d
caseD_d:
00401b46d3 efSHR EDI,CL
00401b48eb 03JMP LAB_00401b4d
LAB_00401b4a:
00401b4a8b 7d 08MOV EDI,dword ptr [EBP + param_1]
LAB_00401b4d:
00401b4d57PUSH EDI
00401b4ee9 1a fa ff ffJMP LAB_0040156d
caseD_1e:
00401b536a 01PUSH 0x1
00401b55e8 e7 10 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401b5a6a 02PUSH 0x2
00401b5c8b f8MOV EDI,EAX
00401b5ee8 bc 10 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401b6350PUSH EAX
00401b6457PUSH EDI
00401b6556PUSH ESI
00401b6689 55 b4MOV dword ptr [EBP + local_50],EDX
00401b69ff 15 90 82 40 00CALL dword ptr [PTR_wsprintfW_00408290]
00401b6f83 c4 10ADD ESP,0x10
00401b72e9 4e 0f 00 00JMP caseD_41
caseD_1f:
00401b778b 45 e0MOV EAX,dword ptr [EBP + local_24]
00401b7a8b 3d 30 e6 41 00MOV EDI,dword ptr [DAT_0041e630]
00401b803b c3CMP EAX,EBX
00401b8274 44JZ LAB_00401bc8
LAB_00401b84:
00401b8448DEC EAX
00401b853b fbCMP EDI,EBX
00401b870f 84 57 07 00 00JZ LAB_004022e4
00401b8d8b 3fMOV EDI,dword ptr [EDI]
00401b8f3b c3CMP EAX,EBX
00401b9175 f1JNZ LAB_00401b84
00401b933b fbCMP EDI,EBX
00401b950f 84 49 07 00 00JZ LAB_004022e4
00401b9b83 c7 04ADD EDI,0x4
00401b9ebe d0 a5 40 00MOV ESI,DAT_0040a5d0
00401ba357PUSH EDI
00401ba456PUSH ESI
00401ba5e8 10 47 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00401baaa1 30 e6 41 00MOV EAX,[DAT_0041e630]
00401baf83 c0 04ADD EAX,0x4
00401bb250PUSH EAX
00401bb357PUSH EDI
00401bb4e8 01 47 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00401bb9a1 30 e6 41 00MOV EAX,[DAT_0041e630]
00401bbe56PUSH ESI
00401bbf83 c0 04ADD EAX,0x4
00401bc250PUSH EAX
00401bc3e9 19 0e 00 00JMP LAB_004029e1
LAB_00401bc8:
00401bc839 5d dcCMP dword ptr [EBP + local_28],EBX
00401bcb74 25JZ LAB_00401bf2
00401bcd3b fbCMP EDI,EBX
00401bcf0f 84 b6 0c 00 00JZ LAB_0040288b
00401bd58d 47 04LEA EAX,[EDI + 0x4]
00401bd850PUSH EAX
00401bd956PUSH ESI
00401bdae8 db 46 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00401bdf8b 07MOV EAX,dword ptr [EDI]
00401be157PUSH EDI
00401be2a3 30 e6 41 00MOV [DAT_0041e630],EAX
LAB_00401be7:
00401be7ff 15 28 81 40 00CALL dword ptr [PTR_GlobalFree_00408128]
00401bede9 d3 0e 00 00JMP caseD_41
LAB_00401bf2:
00401bf268 04 40 00 00PUSH 0x4004
00401bf76a 40PUSH 0x40
00401bf9ff 15 34 81 40 00CALL dword ptr [PTR_GlobalAlloc_00408134]
00401bffff 75 d8PUSH dword ptr [EBP + local_2c]
00401c028b f0MOV ESI,EAX
00401c048d 46 04LEA EAX,[ESI + 0x4]
00401c0750PUSH EAX
00401c08e8 cf 46 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401c0da1 30 e6 41 00MOV EAX,[DAT_0041e630]
00401c1289 06MOV dword ptr [ESI],EAX
00401c1489 35 30 e6 41 00MOV dword ptr [DAT_0041e630],ESI
00401c1ae9 a6 0e 00 00JMP caseD_41
caseD_20:
00401c1f6a 03PUSH 0x3
00401c21e8 f9 0f 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401c266a 04PUSH 0x4
00401c2889 55 b4MOV dword ptr [EBP + local_50],EDX
00401c2b89 45 f0MOV dword ptr [EBP + local_14],EAX
00401c2ee8 ec 0f 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401c33f6 45 ec 01TEST byte ptr [EBP + local_18],0x1
00401c3759POP ECX
00401c3889 55 b4MOV dword ptr [EBP + local_50],EDX
00401c3b59POP ECX
00401c3c89 45 08MOV dword ptr [EBP + param_1],EAX
00401c3f74 0aJZ LAB_00401c4b
00401c416a 33PUSH 0x33
00401c43e8 f9 0f 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401c4889 45 f0MOV dword ptr [EBP + local_14],EAX
LAB_00401c4b:
00401c4bf6 45 ec 02TEST byte ptr [EBP + local_18],0x2
00401c4f74 0aJZ LAB_00401c5b
00401c516a 44PUSH 0x44
00401c53e8 e9 0f 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401c5889 45 08MOV dword ptr [EBP + param_1],EAX
LAB_00401c5b:
00401c5b83 7d d4 21CMP dword ptr [EBP + local_30],0x21
00401c5f6a 01PUSH 0x1
00401c6175 4cJNZ LAB_00401caf
00401c63e8 b7 0f 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401c686a 02PUSH 0x2
00401c6a8b f8MOV EDI,EAX
00401c6c89 55 b4MOV dword ptr [EBP + local_50],EDX
00401c6fe8 ab 0f 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401c7459POP ECX
00401c7589 55 b4MOV dword ptr [EBP + local_50],EDX
00401c7859POP ECX
00401c798b 4d ecMOV ECX,dword ptr [EBP + local_18]
00401c7cc1 f9 02SAR ECX,0x2
00401c7f74 1eJZ LAB_00401c9f
00401c818d 55 d0LEA EDX,[EBP + -0x30]
00401c8452PUSH EDX
00401c8551PUSH ECX
00401c8653PUSH EBX
00401c87ff 75 08PUSH dword ptr [EBP + param_1]
00401c8aff 75 f0PUSH dword ptr [EBP + local_14]
00401c8d50PUSH EAX
00401c8e57PUSH EDI
00401c8fff 15 8c 82 40 00CALL dword ptr [PTR_SendMessageTimeoutW_0040828c]
00401c95f7 d8NEG EAX
00401c971b c0SBB EAX,EAX
00401c9940INC EAX
00401c9a89 45 fcMOV dword ptr [EBP + local_8],EAX
00401c9deb 43JMP LAB_00401ce2
LAB_00401c9f:
00401c9fff 75 08PUSH dword ptr [EBP + param_1]
00401ca2ff 75 f0PUSH dword ptr [EBP + local_14]
00401ca550PUSH EAX
00401ca657PUSH EDI
00401ca7ff 15 18 82 40 00CALL dword ptr [PTR_SendMessageW_00408218]
00401cadeb 30JMP LAB_00401cdf
LAB_00401caf:
00401cafe8 8d 0f 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401cb46a 12PUSH 0x12
00401cb68b f8MOV EDI,EAX
00401cb8e8 84 0f 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401cbd66 8b 08MOV CX,word ptr [EAX]
00401cc066 f7 d9NEG CX
00401cc31b c9SBB ECX,ECX
00401cc523 c8AND ECX,EAX
00401cc766 8b 07MOV AX,word ptr [EDI]
00401cca66 f7 d8NEG AX
00401ccd1b c0SBB EAX,EAX
00401ccf51PUSH ECX
00401cd023 c7AND EAX,EDI
00401cd250PUSH EAX
00401cd3ff 75 08PUSH dword ptr [EBP + param_1]
00401cd6ff 75 f0PUSH dword ptr [EBP + local_14]
00401cd9ff 15 74 82 40 00CALL dword ptr [PTR_FindWindowExW_00408274]
LAB_00401cdf:
00401cdf89 45 d0MOV dword ptr [EBP + local_34],EAX
LAB_00401ce2:
00401ce239 5d d8CMP dword ptr [EBP + local_2c],EBX
00401ce50f 8c da 0d 00 00JL caseD_41
00401cebff 75 d0PUSH dword ptr [EBP + local_34]
00401ceee9 7a f8 ff ffJMP LAB_0040156d
caseD_22:
00401cf353PUSH EBX
00401cf4e8 26 0f 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401cf959POP ECX
00401cfa89 55 b4MOV dword ptr [EBP + local_50],EDX
00401cfd50PUSH EAX
00401cfeff 15 6c 82 40 00CALL dword ptr [PTR_IsWindow_0040826c]
LAB_00401d04:
00401d0485 c0TEST EAX,EAX
00401d060f 84 14 fd ff ffJZ LAB_00401a20
00401d0c8b 45 dcMOV EAX,dword ptr [EBP + local_28]
00401d0fe9 bc 0d 00 00JMP caseD_2
caseD_23:
00401d146a 02PUSH 0x2
00401d16e8 04 0f 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401d1b6a 01PUSH 0x1
00401d1d8b f8MOV EDI,EAX
00401d1f89 55 b4MOV dword ptr [EBP + local_50],EDX
00401d22e8 f8 0e 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401d2759POP ECX
00401d2889 55 b4MOV dword ptr [EBP + local_50],EDX
00401d2b59POP ECX
00401d2c57PUSH EDI
00401d2d50PUSH EAX
00401d2eff 15 e4 81 40 00CALL dword ptr [PTR_GetDlgItem_004081e4]
00401d34e9 59 08 00 00JMP LAB_00402592
caseD_24:
00401d39a1 48 af 47 00MOV EAX,[DAT_0047af48]
00401d3e8b 4d dcMOV ECX,dword ptr [EBP + local_28]
00401d4153PUSH EBX
00401d428d 34 08LEA ESI,[EAX + ECX*0x1]
00401d45e8 d5 0e 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401d4a59POP ECX
00401d4b89 55 b4MOV dword ptr [EBP + local_50],EDX
00401d4e56PUSH ESI
00401d4f6a ebPUSH -0x15
00401d5150PUSH EAX
00401d52ff 15 70 82 40 00CALL dword ptr [PTR_SetWindowLongW_00408270]
00401d58e9 68 0d 00 00JMP caseD_41
caseD_25:
00401d5dff 75 dcPUSH dword ptr [EBP + local_28]
00401d60ff 75 f8PUSH dword ptr [EBP + local_c]
00401d63ff 15 e4 81 40 00CALL dword ptr [PTR_GetDlgItem_004081e4]
00401d698b f0MOV ESI,EAX
00401d6b8d 45 a8LEA EAX,[EBP + -0x58]
00401d6e50PUSH EAX
00401d6f56PUSH ESI
00401d70ff 15 24 82 40 00CALL dword ptr [PTR_GetClientRect_00408224]
00401d768b 45 b4MOV EAX,dword ptr [EBP + local_50]
00401d796a 10PUSH 0x10
00401d7b0f af 45 e0IMUL EAX,dword ptr [EBP + local_24]
00401d7f50PUSH EAX
00401d808b 45 b0MOV EAX,dword ptr [EBP + local_54]
00401d830f af 45 e0IMUL EAX,dword ptr [EBP + local_24]
00401d8750PUSH EAX
00401d8853PUSH EBX
00401d8953PUSH EBX
00401d8ae8 b2 0e 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401d8f50PUSH EAX
00401d9053PUSH EBX
00401d91ff 15 60 82 40 00CALL dword ptr [PTR_LoadImageW_00408260]
00401d9750PUSH EAX
00401d9853PUSH EBX
00401d9968 72 01 00 00PUSH 0x172
00401d9e56PUSH ESI
00401d9fff 15 18 82 40 00CALL dword ptr [PTR_SendMessageW_00408218]
00401da53b c3CMP EAX,EBX
00401da70f 84 18 0d 00 00JZ caseD_41
00401dad50PUSH EAX
00401daeff 15 5c 80 40 00CALL dword ptr [PTR_DeleteObject_0040805c]
00401db4e9 0c 0d 00 00JMP caseD_41
caseD_26:
00401db9ff 75 f8PUSH dword ptr [EBP + local_c]
00401dbcff 15 54 82 40 00CALL dword ptr [PTR_GetDC_00408254]
00401dc26a 02PUSH 0x2
00401dc48b f8MOV EDI,EAX
00401dc6e8 54 0e 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401dcb59POP ECX
00401dcc8b d8MOV EBX,EAX
00401dce6a 48PUSH 0x48
00401dd06a 5aPUSH 0x5a
00401dd257PUSH EDI
00401dd389 55 b4MOV dword ptr [EBP + local_50],EDX
00401dd6ff 15 60 80 40 00CALL dword ptr [PTR_GetDeviceCaps_00408060]
00401ddc50PUSH EAX
00401ddd53PUSH EBX
00401ddeff 15 54 81 40 00CALL dword ptr [PTR_MulDiv_00408154]
00401de457PUSH EDI
00401de5ff 75 f8PUSH dword ptr [EBP + local_c]
00401de8f7 d8NEG EAX
00401deaa3 d0 e5 41 00MOV [DAT_0041e5d0],EAX
00401defff 15 0c 82 40 00CALL dword ptr [PTR_ReleaseDC_0040820c]
00401df56a 03PUSH 0x3
00401df7e8 23 0e 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401dfca3 e0 e5 41 00MOV [DAT_0041e5e0],EAX
00401e018a 45 e8MOV AL,byte ptr [EBP + local_1c]
00401e0459POP ECX
00401e0589 55 b4MOV dword ptr [EBP + local_50],EDX
00401e08ff 75 dcPUSH dword ptr [EBP + local_28]
00401e0b8a c8MOV CL,AL
00401e0d80 e1 01AND CL,0x1
00401e10c6 05 e7 e5 41 00 01MOV byte ptr [DAT_0041e5e7],0x1
00401e1788 0d e4 e5 41 00MOV byte ptr [DAT_0041e5e4],CL
00401e1d8a c8MOV CL,AL
00401e1f80 e1 02AND CL,0x2
00401e2224 04AND AL,0x4
00401e2468 ec e5 41 00PUSH DAT_0041e5ec
00401e2988 0d e5 e5 41 00MOV byte ptr [DAT_0041e5e5],CL
00401e2fa2 e6 e5 41 00MOV [DAT_0041e5e6],AL
00401e34e8 a3 44 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401e3968 d0 e5 41 00PUSH DAT_0041e5d0
00401e3eff 15 54 80 40 00CALL dword ptr [PTR_CreateFontIndirectW_00408054]
00401e44e9 49 07 00 00JMP LAB_00402592
caseD_27:
00401e4953PUSH EBX
00401e4ae8 d0 0d 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401e4f6a 01PUSH 0x1
00401e518b f0MOV ESI,EAX
00401e5389 55 b4MOV dword ptr [EBP + local_50],EDX
00401e56e8 c4 0d 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00401e5b39 5d e4CMP dword ptr [EBP + local_20],EBX
00401e5e59POP ECX
00401e5f59POP ECX
00401e6089 55 b4MOV dword ptr [EBP + local_50],EDX
00401e6350PUSH EAX
00401e6456PUSH ESI
00401e6575 0bJNZ LAB_00401e72
00401e67ff 15 68 82 40 00CALL dword ptr [PTR_ShowWindow_00408268]
00401e6de9 53 0c 00 00JMP caseD_41
LAB_00401e72:
00401e72ff 15 10 82 40 00CALL dword ptr [PTR_EnableWindow_00408210]
00401e78e9 48 0c 00 00JMP caseD_41
caseD_28:
00401e7d53PUSH EBX
00401e7ee8 be 0d 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401e836a 31PUSH 0x31
00401e858b f0MOV ESI,EAX
00401e87e8 b5 0d 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401e8c6a 22PUSH 0x22
00401e8e8b d8MOV EBX,EAX
00401e90e8 ac 0d 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401e956a 15PUSH 0x15
00401e978b f8MOV EDI,EAX
00401e99e8 a3 0d 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401e9e6a ecPUSH -0x14
00401ea0e8 7e f5 ff ffCALL FUN_00401423; FUN_00401423: SetWindowTextW, SendMessageW
00401ea58b 45 e8MOV EAX,dword ptr [EBP + local_1c]
00401ea889 45 80MOV dword ptr [EBP + local_84],EAX
00401eab8b 45 f8MOV EAX,dword ptr [EBP + local_c]
00401eae89 45 84MOV dword ptr [EBP + local_80],EAX
00401eb18b 45 e4MOV EAX,dword ptr [EBP + local_20]
00401eb489 45 98MOV dword ptr [EBP + local_6c],EAX
00401eb766 8b 06MOV AX,word ptr [ESI]
00401eba66 f7 d8NEG AX
00401ebd1b c0SBB EAX,EAX
00401ebf89 5d 8cMOV dword ptr [EBP + local_78],EBX
00401ec223 c6AND EAX,ESI
00401ec489 45 88MOV dword ptr [EBP + local_7c],EAX
00401ec766 8b 07MOV AX,word ptr [EDI]
00401eca66 f7 d8NEG AX
00401ecd1b c0SBB EAX,EAX
00401ecfc7 45 94 00 30 4d 00MOV dword ptr [EBP + local_70],DAT_004d3000
00401ed623 c7AND EAX,EDI
00401ed889 45 90MOV dword ptr [EBP + local_74],EAX
00401edb8d 85 7c ff ff ffLEA EAX,[EBP + 0xffffff7c]
00401ee150PUSH EAX
00401ee2e8 ff 39 00 00CALL FUN_004058e6; FUN_004058e6: ShellExecuteExW
00401ee785 c0TEST EAX,EAX
00401ee90f 84 9c 09 00 00JZ LAB_0040288b
00401eeff6 45 80 40TEST byte ptr [EBP + local_84],0x40
00401ef30f 84 cc 0b 00 00JZ caseD_41
00401ef9ff 75 b4PUSH dword ptr [EBP + local_50]
00401efce8 44 48 00 00CALL FUN_00406745; FUN_00406745: WaitForSingleObject, GetExitCodeProcess
00401f01ff 75 b4PUSH dword ptr [EBP + local_50]
00401f04eb 47JMP LAB_00401f4d
caseD_29:
00401f0653PUSH EBX
00401f07e8 35 0d 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401f0c8b f0MOV ESI,EAX
00401f0e56PUSH ESI
00401f0f6a ebPUSH -0x15
00401f11e8 0c 34 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
00401f1656PUSH ESI
00401f17e8 87 39 00 00CALL FUN_004058a3; FUN_004058a3: CreateProcessW, CloseHandle
00401f1c8b f0MOV ESI,EAX
00401f1e3b f3CMP ESI,EBX
00401f200f 84 65 09 00 00JZ LAB_0040288b
00401f2639 5d e0CMP dword ptr [EBP + local_24],EBX
00401f2974 21JZ LAB_00401f4c
00401f2b56PUSH ESI
00401f2ce8 14 48 00 00CALL FUN_00406745; FUN_00406745: WaitForSingleObject, GetExitCodeProcess
00401f3139 5d dcCMP dword ptr [EBP + local_28],EBX
00401f347c 0bJL LAB_00401f41
00401f3650PUSH EAX
00401f37ff 75 f4PUSH dword ptr [EBP + local_10]
00401f3ae8 c2 42 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
00401f3feb 0bJMP LAB_00401f4c
LAB_00401f41:
00401f413b c3CMP EAX,EBX
00401f4374 07JZ LAB_00401f4c
00401f45c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
LAB_00401f4c:
00401f4c56PUSH ESI
LAB_00401f4d:
00401f4dff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
00401f53e9 6d 0b 00 00JMP caseD_41
caseD_2a:
00401f586a 02PUSH 0x2
00401f5ae8 e2 0c 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401f5f50PUSH EAX
00401f60e8 98 46 00 00CALL FUN_004065fd; FUN_004065fd: FindFirstFileW, FindClose
00401f658b f8MOV EDI,EAX
00401f673b fbCMP EDI,EBX
00401f6974 13JZ LAB_00401f7e
00401f6bff 77 14PUSH dword ptr [EDI + 0x14]
00401f6eff 75 f4PUSH dword ptr [EBP + local_10]
00401f71e8 8b 42 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
00401f76ff 77 18PUSH dword ptr [EDI + 0x18]
00401f79e9 ef f5 ff ffJMP LAB_0040156d
LAB_00401f7e:
00401f7e8b 45 f4MOV EAX,dword ptr [EBP + local_10]
00401f8166 89 1eMOV word ptr [ESI],BX
00401f8466 89 18MOV word ptr [EAX],BX
00401f87e9 ff 08 00 00JMP LAB_0040288b
caseD_2b:
00401f8c6a eePUSH -0x12
00401f8ee8 ae 0c 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00401f938d 4d b4LEA ECX,[EBP + -0x4c]
00401f9689 45 d0MOV dword ptr [EBP + local_34],EAX
00401f9951PUSH ECX
00401f9a50PUSH EAX
00401f9b6a 09PUSH 0x9
00401f9de8 f2 46 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
00401fa2ff d0CALL EAX
00401fa48b f8MOV EDI,EAX
00401fa68b 45 f4MOV EAX,dword ptr [EBP + local_10]
00401fa966 89 1eMOV word ptr [ESI],BX
00401fac3b fbCMP EDI,EBX
00401fae66 89 18MOV word ptr [EAX],BX
00401fb1c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
00401fb80f 84 07 0b 00 00JZ caseD_41
00401fbe57PUSH EDI
00401fbf6a 40PUSH 0x40
00401fc1ff 15 34 81 40 00CALL dword ptr [PTR_GlobalAlloc_00408134]
00401fc73b c3CMP EAX,EBX
00401fc989 45 08MOV dword ptr [EBP + param_1],EAX
00401fcc0f 84 f3 0a 00 00JZ caseD_41
00401fd26a 0aPUSH 0xa
00401fd4e8 bb 46 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
00401fd96a 0bPUSH 0xb
00401fdb89 45 c8MOV dword ptr [EBP + local_3c],EAX
00401fdee8 b1 46 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
00401fe3ff 75 08PUSH dword ptr [EBP + param_1]
00401fe689 45 f0MOV dword ptr [EBP + local_14],EAX
00401fe957PUSH EDI
00401fea53PUSH EBX
00401febff 75 d0PUSH dword ptr [EBP + local_34]
00401feeff 55 c8CALL dword ptr [EBP + local_3c]
00401ff185 c0TEST EAX,EAX
00401ff374 34JZ LAB_00402029
00401ff58d 45 b8LEA EAX,[EBP + -0x48]
00401ff850PUSH EAX
00401ff98d 45 c4LEA EAX,[EBP + -0x3c]
00401ffc50PUSH EAX
00401ffd68 14 a0 40 00PUSH DAT_0040a014
00402002ff 75 08PUSH dword ptr [EBP + param_1]
00402005ff 55 f0CALL dword ptr [EBP + local_14]
0040200885 c0TEST EAX,EAX
0040200a74 1dJZ LAB_00402029
0040200c8b 45 c4MOV EAX,dword ptr [EBP + local_40]
0040200fff 70 08PUSH dword ptr [EAX + 0x8]
0040201256PUSH ESI
00402013e8 e9 41 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
004020188b 45 c4MOV EAX,dword ptr [EBP + local_40]
0040201bff 70 0cPUSH dword ptr [EAX + 0xc]
0040201eff 75 f4PUSH dword ptr [EBP + local_10]
00402021e8 db 41 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
0040202689 5d fcMOV dword ptr [EBP + local_8],EBX
LAB_00402029:
00402029ff 75 08PUSH dword ptr [EBP + param_1]
0040202ce9 b6 fb ff ffJMP LAB_00401be7
caseD_2c:
0040203139 1d b8 af 47 00CMP dword ptr [DAT_0047afb8],EBX
00402037c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
0040203e0f 8c b9 00 00 00JL LAB_004020fd
004020446a f0PUSH -0x10
00402046e8 f6 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040204b6a 01PUSH 0x1
0040204d8b f0MOV ESI,EAX
0040204fe8 ed 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040205439 5d e8CMP dword ptr [EBP + local_1c],EBX
0040205789 45 c4MOV dword ptr [EBP + local_40],EAX
0040205a74 0eJZ LAB_0040206a
0040205c56PUSH ESI
0040205dff 15 70 81 40 00CALL dword ptr [PTR_GetModuleHandleW_00408170]
004020633b c3CMP EAX,EBX
0040206589 45 08MOV dword ptr [EBP + param_1],EAX
0040206875 11JNZ LAB_0040207b
LAB_0040206a:
0040206a6a 08PUSH 0x8
0040206c53PUSH EBX
0040206d56PUSH ESI
0040206eff 15 6c 81 40 00CALL dword ptr [PTR_LoadLibraryExW_0040816c]
004020743b c3CMP EAX,EBX
0040207689 45 08MOV dword ptr [EBP + param_1],EAX
0040207974 7bJZ LAB_004020f6
LAB_0040207b:
0040207bff 75 c4PUSH dword ptr [EBP + local_40]
0040207eff 75 08PUSH dword ptr [EBP + param_1]
00402081e8 7d 46 00 00CALL FUN_00406703; FUN_00406703: WideCharToMultiByte, GetProcAddress
004020868b f0MOV ESI,EAX
004020883b f3CMP ESI,EBX
0040208a74 39JZ LAB_004020c5
0040208c39 5d e0CMP dword ptr [EBP + local_24],EBX
0040208f89 5d fcMOV dword ptr [EBP + local_8],EBX
0040209274 17JZ LAB_004020ab
00402094ff 75 e0PUSH dword ptr [EBP + local_24]
00402097e8 87 f3 ff ffCALL FUN_00401423; FUN_00401423: SetWindowTextW, SendMessageW
0040209cff d6CALL ESI
0040209e85 c0TEST EAX,EAX
004020a074 2dJZ LAB_004020cf
004020a2c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
004020a9eb 24JMP LAB_004020cf
LAB_004020ab:
004020ab68 00 a0 40 00PUSH PTR_DAT_0040a000
004020b068 30 e6 41 00PUSH DAT_0041e630
004020b557PUSH EDI
004020b668 00 20 00 00PUSH 0x2000
004020bbff 75 f8PUSH dword ptr [EBP + local_c]
004020beff d6CALL ESI
004020c083 c4 14ADD ESP,0x14
004020c3eb 0aJMP LAB_004020cf
LAB_004020c5:
004020c5ff 75 c4PUSH dword ptr [EBP + local_40]
004020c86a f7PUSH -0x9
004020cae8 53 32 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
LAB_004020cf:
004020cf39 5d e4CMP dword ptr [EBP + local_20],EBX
004020d20f 85 ed 09 00 00JNZ caseD_41
004020d8ff 75 08PUSH dword ptr [EBP + param_1]
004020dbe8 6a 18 00 00CALL FUN_0040394a
004020e085 c0TEST EAX,EAX
004020e20f 84 dd 09 00 00JZ caseD_41
004020e8ff 75 08PUSH dword ptr [EBP + param_1]
004020ebff 15 68 81 40 00CALL dword ptr [PTR_FreeLibrary_00408168]
004020f1e9 cf 09 00 00JMP caseD_41
LAB_004020f6:
004020f66a f6PUSH -0xa
004020f8e9 4e 01 00 00JMP LAB_0040224b
LAB_004020fd:
004020fd6a e7PUSH -0x19
004020ffe9 47 01 00 00JMP LAB_0040224b
caseD_2d:
004021046a f0PUSH -0x10
00402106e8 36 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040210b6a dfPUSH -0x21
0040210d89 45 b4MOV dword ptr [EBP + local_50],EAX
00402110e8 2c 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004021156a 02PUSH 0x2
0040211789 45 c4MOV dword ptr [EBP + local_40],EAX
0040211ae8 22 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040211f6a cdPUSH -0x33
0040212189 45 f8MOV dword ptr [EBP + local_c],EAX
00402124e8 18 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004021296a 45PUSH 0x45
0040212b89 45 b8MOV dword ptr [EBP + local_4c],EAX
0040212ee8 0e 0b 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
00402133ff 75 c4PUSH dword ptr [EBP + local_40]
0040213689 45 f4MOV dword ptr [EBP + local_10],EAX
004021398b 45 e8MOV EAX,dword ptr [EBP + local_1c]
0040213c8b c8MOV ECX,EAX
0040213e8b f8MOV EDI,EAX
004021408b f0MOV ESI,EAX
0040214281 e1 ff 0f 00 00AND ECX,0xfff
00402148c1 f8 10SAR EAX,0x10
0040214bc1 fe 0cSAR ESI,0xc
0040214e25 ff ff 00 00AND EAX,0xffff
0040215389 4d bcMOV dword ptr [EBP + local_48],ECX
0040215681 e7 00 80 00 00AND EDI,0x8000
0040215c83 e6 07AND ESI,0x7
0040215f89 45 c8MOV dword ptr [EBP + local_3c],EAX
00402162e8 9f 3a 00 00CALL FUN_00405c06
0040216785 c0TEST EAX,EAX
0040216975 07JNZ LAB_00402172
0040216b6a 21PUSH 0x21
0040216de8 cf 0a 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
LAB_00402172:
004021728d 45 08LEA EAX,[EBP + 0x8]
0040217550PUSH EAX
0040217668 e0 85 40 00PUSH DAT_004085e0
0040217b6a 01PUSH 0x1
0040217d53PUSH EBX
0040217e68 f0 85 40 00PUSH DAT_004085f0
00402183ff 15 a8 82 40 00CALL dword ptr [PTR_CoCreateInstance_004082a8]
004021893b c3CMP EAX,EBX
0040218b0f 8c b1 00 00 00JL LAB_00402242
004021918b 45 08MOV EAX,dword ptr [EBP + param_1]
004021948d 55 d0LEA EDX,[EBP + -0x30]
0040219752PUSH EDX
0040219868 00 86 40 00PUSH DAT_00408600
0040219d8b 08MOV ECX,dword ptr [EAX]
0040219f50PUSH EAX
004021a0ff 11CALL dword ptr [ECX]
004021a23b c3CMP EAX,EBX
004021a489 45 f0MOV dword ptr [EBP + local_14],EAX
004021a70f 8c 87 00 00 00JL LAB_00402234
004021ad8b 45 08MOV EAX,dword ptr [EBP + param_1]
004021b0ff 75 c4PUSH dword ptr [EBP + local_40]
004021b38b 08MOV ECX,dword ptr [EAX]
004021b550PUSH EAX
004021b6ff 51 50CALL dword ptr [ECX + 0x50]
004021b93b fbCMP EDI,EBX
004021bb89 45 f0MOV dword ptr [EBP + local_14],EAX
004021be75 0eJNZ LAB_004021ce
004021c08b 45 08MOV EAX,dword ptr [EBP + param_1]
004021c368 00 30 4d 00PUSH DAT_004d3000
004021c850PUSH EAX
004021c98b 08MOV ECX,dword ptr [EAX]
004021cbff 51 24CALL dword ptr [ECX + 0x24]
LAB_004021ce:
004021ce3b f3CMP ESI,EBX
004021d074 0aJZ LAB_004021dc
004021d28b 45 08MOV EAX,dword ptr [EBP + param_1]
004021d556PUSH ESI
004021d650PUSH EAX
004021d78b 08MOV ECX,dword ptr [EAX]
004021d9ff 51 3cCALL dword ptr [ECX + 0x3c]
LAB_004021dc:
004021dc8b 45 08MOV EAX,dword ptr [EBP + param_1]
004021dfff 75 c8PUSH dword ptr [EBP + local_3c]
004021e28b 08MOV ECX,dword ptr [EAX]
004021e450PUSH EAX
004021e5ff 51 34CALL dword ptr [ECX + 0x34]
004021e88b 4d b8MOV ECX,dword ptr [EBP + local_4c]
004021eb66 39 19CMP word ptr [ECX],BX
004021ee74 0dJZ LAB_004021fd
004021f08b 45 08MOV EAX,dword ptr [EBP + param_1]
004021f3ff 75 bcPUSH dword ptr [EBP + local_48]
004021f68b 10MOV EDX,dword ptr [EAX]
004021f851PUSH ECX
004021f950PUSH EAX
004021faff 52 44CALL dword ptr [EDX + 0x44]
LAB_004021fd:
004021fd8b 45 08MOV EAX,dword ptr [EBP + param_1]
00402200ff 75 f8PUSH dword ptr [EBP + local_c]
004022038b 08MOV ECX,dword ptr [EAX]
0040220550PUSH EAX
00402206ff 51 2cCALL dword ptr [ECX + 0x2c]
004022098b 45 08MOV EAX,dword ptr [EBP + param_1]
0040220cff 75 f4PUSH dword ptr [EBP + local_10]
0040220f8b 08MOV ECX,dword ptr [EAX]
0040221150PUSH EAX
00402212ff 51 1cCALL dword ptr [ECX + 0x1c]
0040221539 5d f0CMP dword ptr [EBP + local_14],EBX
004022187c 11JL LAB_0040222b
0040221a8b 45 d0MOV EAX,dword ptr [EBP + local_34]
0040221d6a 01PUSH 0x1
0040221fff 75 b4PUSH dword ptr [EBP + local_50]
004022228b 08MOV ECX,dword ptr [EAX]
0040222450PUSH EAX
00402225ff 51 18CALL dword ptr [ECX + 0x18]
0040222889 45 f0MOV dword ptr [EBP + local_14],EAX
LAB_0040222b:
0040222b8b 45 d0MOV EAX,dword ptr [EBP + local_34]
0040222e50PUSH EAX
0040222f8b 08MOV ECX,dword ptr [EAX]
00402231ff 51 08CALL dword ptr [ECX + 0x8]
LAB_00402234:
004022348b 45 08MOV EAX,dword ptr [EBP + param_1]
0040223750PUSH EAX
004022388b 08MOV ECX,dword ptr [EAX]
0040223aff 51 08CALL dword ptr [ECX + 0x8]
0040223d39 5d f0CMP dword ptr [EBP + local_14],EBX
004022407d 13JGE LAB_00402255
LAB_00402242:
00402242c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
004022496a f0PUSH -0x10
LAB_0040224b:
0040224be8 d3 f1 ff ffCALL FUN_00401423; FUN_00401423: SetWindowTextW, SendMessageW
00402250e9 70 08 00 00JMP caseD_41
LAB_00402255:
004022556a f4PUSH -0xc
00402257eb f2JMP LAB_0040224b
caseD_2e:
0040225953PUSH EBX
0040225ae8 e2 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040225f6a 11PUSH 0x11
004022618b f0MOV ESI,EAX
00402263e8 d9 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004022686a 23PUSH 0x23
0040226a8b f8MOV EDI,EAX
0040226ce8 d0 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040227156PUSH ESI
0040227289 45 08MOV dword ptr [EBP + param_1],EAX
00402275e8 83 43 00 00CALL FUN_004065fd; FUN_004065fd: FindFirstFileW, FindClose
0040227a85 c0TEST EAX,EAX
0040227c75 0dJNZ LAB_0040228b
LAB_0040227e:
0040227e53PUSH EBX
0040227f6a f9PUSH -0x7
00402281e8 9c 30 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
00402286e9 00 06 00 00JMP LAB_0040288b
LAB_0040228b:
0040228b8b 45 f8MOV EAX,dword ptr [EBP + local_c]
0040228e56PUSH ESI
0040228f89 45 98MOV dword ptr [EBP + local_6c],EAX
00402292c7 45 9c 02 00 00 00MOV dword ptr [EBP + local_68],0x2
00402299e8 32 40 00 00CALL lstrlenW
0040229e57PUSH EDI
0040229f66 89 5c 46 02MOV word ptr [ESI + EAX*0x2 + 0x2],BX
004022a4e8 27 40 00 00CALL lstrlenW
004022a966 89 5c 47 02MOV word ptr [EDI + EAX*0x2 + 0x2],BX
004022ae8b 45 08MOV EAX,dword ptr [EBP + param_1]
004022b166 8b 4d e0MOV CX,word ptr [EBP + local_24]
004022b550PUSH EAX
004022b653PUSH EBX
004022b789 75 a0MOV dword ptr [EBP + local_64],ESI
004022ba89 7d a4MOV dword ptr [EBP + local_60],EDI
004022bd89 45 b2MOV dword ptr [EBP + local_54+0x2],EAX
004022c066 89 4d a8MOV word ptr [EBP + local_5c],CX
004022c4e8 59 30 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
004022c98d 45 98LEA EAX,[EBP + -0x68]
004022cc50PUSH EAX
004022cdff 15 8c 81 40 00CALL dword ptr [PTR_SHFileOperationW_0040818c]
004022d385 c0TEST EAX,EAX
004022d50f 84 ea 07 00 00JZ caseD_41
004022dbeb a1JMP LAB_0040227e
caseD_2f:
004022dd3d 0d f0 ad 0bCMP EAX,0xbadf00d
004022e274 1dJZ LAB_00402301
LAB_004022e4:
004022e468 10 00 20 00PUSH 0x200010
004022e96a e8PUSH -0x18
004022eb53PUSH EBX
004022ece8 eb 3f 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004022f150PUSH EAX
LAB_004022f2:
004022f2e8 29 36 00 00CALL FUN_00405920; FUN_00405920: MessageBoxIndirectW
LAB_004022f7:
004022f7b8 ff ff ff 7fMOV EAX,0x7fffffff
004022fce9 cf 07 00 00JMP caseD_2
LAB_00402301:
00402301ff 05 94 af 47 00INC dword ptr [DAT_0047af94]
00402307e9 b9 07 00 00JMP caseD_41
caseD_30:
0040230c33 f6XOR ESI,ESI
0040230e33 ffXOR EDI,EDI
004023103b c3CMP EAX,EBX
0040231274 08JZ LAB_0040231c
0040231453PUSH EBX
00402315e8 27 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040231a8b f0MOV ESI,EAX
LAB_0040231c:
0040231c39 5d dcCMP dword ptr [EBP + local_28],EBX
0040231f74 09JZ LAB_0040232a
004023216a 11PUSH 0x11
00402323e8 19 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004023288b f8MOV EDI,EAX
LAB_0040232a:
0040232a39 5d e8CMP dword ptr [EBP + local_1c],EBX
0040232d74 09JZ LAB_00402338
0040232f6a 22PUSH 0x22
00402331e8 0b 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004023368b d8MOV EBX,EAX
LAB_00402338:
004023386a cdPUSH -0x33
0040233ae8 02 09 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040233f50PUSH EAX
0040234053PUSH EBX
0040234157PUSH EDI
0040234256PUSH ESI
00402343ff 15 64 81 40 00CALL dword ptr [PTR_WritePrivateProfileStringW_00408164]
00402349e9 66 f2 ff ffJMP LAB_004015b4
caseD_31:
0040234ea1 10 a0 40 00MOV EAX,[DAT_0040a010]
004023536a 01PUSH 0x1
0040235589 45 08MOV dword ptr [EBP + param_1],EAX
00402358e8 e4 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040235d6a 12PUSH 0x12
0040235f8b f8MOV EDI,EAX
00402361e8 db 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004023666a ddPUSH -0x23
0040236889 45 b4MOV dword ptr [EBP + local_50],EAX
0040236be8 d1 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040237050PUSH EAX
0040237168 ff 1f 00 00PUSH 0x1fff
004023768d 45 08LEA EAX,[EBP + 0x8]
0040237956PUSH ESI
0040237a50PUSH EAX
0040237bff 75 b4PUSH dword ptr [EBP + local_50]
0040237e57PUSH EDI
0040237fff 15 60 81 40 00CALL dword ptr [PTR_GetPrivateProfileStringW_00408160]
0040238566 83 3e 0aCMP word ptr [ESI],offset DAT_0047b000
00402389e9 c3 f3 ff ffJMP LAB_00401751
caseD_32:
0040238e39 5d e8CMP dword ptr [EBP + local_1c],EBX
004023918b 75 dcMOV ESI,dword ptr [EBP + local_28]
0040239475 2bJNZ LAB_004023c1
004023966a 02PUSH 0x2
00402398e8 e4 08 00 00CALL FUN_00402c81; FUN_00402c81: RegOpenKeyExW
0040239d8b f0MOV ESI,EAX
0040239f3b f3CMP ESI,EBX
004023a10f 84 e4 04 00 00JZ LAB_0040288b
004023a76a 33PUSH 0x33
004023a9e8 93 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004023ae50PUSH EAX
004023af56PUSH ESI
004023b0ff 15 20 80 40 00CALL dword ptr [PTR_RegDeleteValueW_00408020]
004023b656PUSH ESI
004023b78b f8MOV EDI,EAX
004023b9ff 15 24 80 40 00CALL dword ptr [PTR_RegCloseKey_00408024]
004023bfeb 16JMP LAB_004023d7
LAB_004023c1:
004023c16a 22PUSH 0x22
004023c3e8 79 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004023c88b 4d e8MOV ECX,dword ptr [EBP + local_1c]
004023cbd1 f9SAR ECX,0x1
004023cd51PUSH ECX
004023ce50PUSH EAX
004023cf56PUSH ESI
004023d0e8 2a 09 00 00CALL FUN_00402cff; FUN_00402cff: RegCloseKey, RegDeleteKeyW
004023d58b f8MOV EDI,EAX
LAB_004023d7:
004023d73b fbCMP EDI,EBX
004023d90f 84 e6 06 00 00JZ caseD_41
004023dfe9 a7 04 00 00JMP LAB_0040288b
caseD_33:
004023e48b 75 e8MOV ESI,dword ptr [EBP + local_1c]
004023e78b f8MOV EDI,EAX
004023e98b 45 ecMOV EAX,dword ptr [EBP + local_18]
004023ec6a 02PUSH 0x2
004023ee89 45 b4MOV dword ptr [EBP + local_50],EAX
004023f1e8 4b 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004023f66a 11PUSH 0x11
004023f889 45 c4MOV dword ptr [EBP + local_40],EAX
004023fbe8 41 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004024006a 02PUSH 0x2
0040240250PUSH EAX
0040240357PUSH EDI
00402404c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
0040240be8 c1 08 00 00CALL FUN_00402cd1; FUN_00402cd1: RegCreateKeyExW
004024103b c3CMP EAX,EBX
0040241289 45 08MOV dword ptr [EBP + param_1],EAX
004024150f 84 aa 06 00 00JZ caseD_41
0040241b33 c0XOR EAX,EAX
0040241d83 fe 01CMP ESI,0x1
00402420bf d0 25 41 00MOV EDI,DAT_004125d0
0040242575 11JNZ LAB_00402438
004024276a 23PUSH 0x23
00402429e8 13 08 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040242e57PUSH EDI
0040242fe8 9c 3e 00 00CALL lstrlenW
004024348d 44 00 02LEA EAX,[EAX + EAX*0x1 + 0x2]
LAB_00402438:
0040243883 fe 04CMP ESI,0x4
0040243b75 12JNZ LAB_0040244f
0040243d6a 03PUSH 0x3
0040243fe8 db 07 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040244459POP ECX
00402445a3 d0 25 41 00MOV [DAT_004125d0],EAX
0040244a56PUSH ESI
0040244b89 55 d0MOV dword ptr [EBP + local_34],EDX
0040244e58POP EAX
LAB_0040244f:
0040244f83 fe 03CMP ESI,0x3
0040245275 0fJNZ LAB_00402463
0040245468 00 c0 00 00PUSH 0xc000
0040245957PUSH EDI
0040245a53PUSH EBX
0040245bff 75 e4PUSH dword ptr [EBP + local_20]
0040245ee8 b3 0c 00 00CALL FUN_00403116; FUN_00403116: GetTickCount, MulDiv, wsprintfW
LAB_00402463:
0040246350PUSH EAX
0040246457PUSH EDI
00402465ff 75 b4PUSH dword ptr [EBP + local_50]
0040246853PUSH EBX
00402469ff 75 c4PUSH dword ptr [EBP + local_40]
0040246cff 75 08PUSH dword ptr [EBP + param_1]
0040246fff 15 28 80 40 00CALL dword ptr [PTR_RegSetValueExW_00408028]
0040247585 c0TEST EAX,EAX
0040247775 03JNZ LAB_0040247c
0040247989 5d fcMOV dword ptr [EBP + local_8],EBX
LAB_0040247c:
0040247cff 75 08PUSH dword ptr [EBP + param_1]
0040247fe9 d3 00 00 00JMP LAB_00402557
caseD_34:
0040248468 19 00 02 00PUSH 0x20019
00402489e8 f3 07 00 00CALL FUN_00402c81; FUN_00402c81: RegOpenKeyExW
0040248e6a 33PUSH 0x33
004024908b f8MOV EDI,EAX
00402492e8 aa 07 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004024973b fbCMP EDI,EBX
0040249966 89 1eMOV word ptr [ESI],BX
0040249c0f 84 e9 03 00 00JZ LAB_0040288b
004024a28d 4d b4LEA ECX,[EBP + -0x4c]
004024a5c7 45 b4 00 40 00 00MOV dword ptr [EBP + local_50],0x4000
004024ac51PUSH ECX
004024ad8d 4d 08LEA ECX,[EBP + 0x8]
004024b056PUSH ESI
004024b151PUSH ECX
004024b253PUSH EBX
004024b350PUSH EAX
004024b457PUSH EDI
004024b5ff 15 2c 80 40 00CALL dword ptr [PTR_RegQueryValueExW_0040802c]
004024bb33 c9XOR ECX,ECX
004024bd41INC ECX
004024be85 c0TEST EAX,EAX
004024c075 2eJNZ LAB_004024f0
004024c283 7d 08 04CMP dword ptr [EBP + param_1],0x4
004024c674 13JZ LAB_004024db
004024c839 4d 08CMP dword ptr [EBP + param_1],ECX
004024cb74 06JZ LAB_004024d3
004024cd83 7d 08 02CMP dword ptr [EBP + param_1],0x2
004024d175 1dJNZ LAB_004024f0
LAB_004024d3:
004024d38b 45 e8MOV EAX,dword ptr [EBP + local_1c]
004024d689 45 fcMOV dword ptr [EBP + local_8],EAX
004024d9eb 74JMP LAB_0040254f
LAB_004024db:
004024dbff 36PUSH dword ptr [ESI]
004024dd33 c0XOR EAX,EAX
004024df39 5d e8CMP dword ptr [EBP + local_1c],EBX
004024e256PUSH ESI
004024e30f 94 c0SETZ AL
004024e689 45 fcMOV dword ptr [EBP + local_8],EAX
004024e9e8 13 3d 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
004024eeeb 66JMP LAB_00402556
LAB_004024f0:
004024f066 89 1eMOV word ptr [ESI],BX
004024f389 4d fcMOV dword ptr [EBP + local_8],ECX
004024f6eb 5eJMP LAB_00402556
caseD_35:
004024f868 19 00 02 00PUSH 0x20019
004024fde8 7f 07 00 00CALL FUN_00402c81; FUN_00402c81: RegOpenKeyExW
004025026a 03PUSH 0x3
004025048b f8MOV EDI,EAX
00402506e8 14 07 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040250b3b fbCMP EDI,EBX
0040250d59POP ECX
0040250e89 55 b4MOV dword ptr [EBP + local_50],EDX
0040251166 89 1eMOV word ptr [ESI],BX
004025140f 84 71 03 00 00JZ LAB_0040288b
0040251a39 5d e8CMP dword ptr [EBP + local_1c],EBX
0040251db9 ff 1f 00 00MOV ECX,0x1fff
0040252289 4d 08MOV dword ptr [EBP + param_1],ECX
0040252574 0cJZ LAB_00402533
0040252751PUSH ECX
0040252856PUSH ESI
0040252950PUSH EAX
0040252a57PUSH EDI
0040252bff 15 30 80 40 00CALL dword ptr [PTR_RegEnumKeyW_00408030]
00402531eb 1cJMP LAB_0040254f
LAB_00402533:
0040253353PUSH EBX
0040253453PUSH EBX
0040253553PUSH EBX
004025368d 4d 08LEA ECX,[EBP + 0x8]
0040253953PUSH EBX
0040253a51PUSH ECX
0040253b56PUSH ESI
0040253c50PUSH EAX
0040253d57PUSH EDI
0040253eff 15 18 80 40 00CALL dword ptr [PTR_RegEnumValueW_00408018]
0040254485 c0TEST EAX,EAX
0040254674 07JZ LAB_0040254f
00402548c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
LAB_0040254f:
0040254f66 89 9e fe 3f 00 00MOV word ptr [ESI + 0x3ffe],BX
LAB_00402556:
0040255657PUSH EDI
LAB_00402557:
00402557ff 15 24 80 40 00CALL dword ptr [PTR_RegCloseKey_00408024]
0040255de9 63 05 00 00JMP caseD_41
caseD_36:
0040256256PUSH ESI
00402563e8 b2 3c 00 00CALL FUN_0040621a
004025683b c3CMP EAX,EBX
0040256a0f 84 55 05 00 00JZ caseD_41
0040257050PUSH EAX
00402571e9 d7 f9 ff ffJMP LAB_00401f4d
caseD_37:
004025766a edPUSH -0x13
00402578e8 c4 06 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040257dff 75 e0PUSH dword ptr [EBP + local_24]
00402580ff 75 dcPUSH dword ptr [EBP + local_28]
0040258350PUSH EAX
00402584e8 27 38 00 00CALL FUN_00405db0; FUN_00405db0: GetFileAttributesW, CreateFileW
0040258983 f8 ffCMP EAX,-0x1
0040258c0f 84 f6 02 00 00JZ LAB_00402888
LAB_00402592:
0040259250PUSH EAX
00402593e9 d5 ef ff ffJMP LAB_0040156d
caseD_38:
004025988b 45 e0MOV EAX,dword ptr [EBP + local_24]
0040259b33 c9XOR ECX,ECX
0040259d83 fa 38CMP EDX,0x38
004025a089 45 b4MOV dword ptr [EBP + local_50],EAX
004025a30f 94 c1SETZ CL
004025a63b c3CMP EAX,EBX
004025a88b f9MOV EDI,ECX
004025aa74 1bJZ LAB_004025c7
004025ac6a 01PUSH 0x1
004025aee8 6c 06 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004025b366 a3 d0 e5 40 00MOV [DAT_0040e5d0],AX
004025b933 c0XOR EAX,EAX
004025bb3b fbCMP EDI,EBX
004025bd59POP ECX
004025be0f 94 c0SETZ AL
004025c189 55 c4MOV dword ptr [EBP + local_40],EDX
004025c440INC EAX
004025c5eb 43JMP LAB_0040260a
LAB_004025c7:
004025c783 fa 38CMP EDX,0x38
004025ca75 2fJNZ LAB_004025fb
004025cc6a 21PUSH 0x21
004025cee8 6e 06 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004025d353PUSH EBX
004025d453PUSH EBX
004025d568 00 20 00 00PUSH 0x2000
004025da68 d0 e5 40 00PUSH DAT_0040e5d0
004025df6a ffPUSH -0x1
004025e168 d0 25 41 00PUSH DAT_004125d0
004025e653PUSH EBX
004025e753PUSH EBX
004025e8ff 15 5c 81 40 00CALL dword ptr [PTR_WideCharToMultiByte_0040815c]
004025ee68 d0 e5 40 00PUSH DAT_0040e5d0
004025f3ff 15 50 81 40 00CALL dword ptr [PTR_lstrlenA_00408150]
004025f9eb 0fJMP LAB_0040260a
LAB_004025fb:
004025fb6a 11PUSH 0x11
004025fde8 3f 06 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040260250PUSH EAX
00402603e8 c8 3c 00 00CALL lstrlenW
0040260803 c0ADD EAX,EAX
LAB_0040260a:
0040260a66 39 1eCMP word ptr [ESI],BX
0040260d89 45 08MOV dword ptr [EBP + param_1],EAX
004026100f 84 75 02 00 00JZ LAB_0040288b
0040261656PUSH ESI
00402617e8 fe 3b 00 00CALL FUN_0040621a
0040261c0b 7d b4OR EDI,dword ptr [EBP + local_50]
0040261f8b f0MOV ESI,EAX
0040262175 14JNZ LAB_00402637
0040262339 5d e4CMP dword ptr [EBP + local_20],EBX
0040262674 0fJZ LAB_00402637
0040262856PUSH ESI
0040262956PUSH ESI
0040262ae8 62 38 00 00CALL FUN_00405e91; FUN_00405e91: SetFilePointer
0040262f85 c0TEST EAX,EAX
004026310f 8c 54 02 00 00JL LAB_0040288b
LAB_00402637:
00402637ff 75 08PUSH dword ptr [EBP + param_1]
0040263a68 d0 e5 40 00PUSH DAT_0040e5d0
0040263f56PUSH ESI
00402640e8 1d 38 00 00CALL FUN_00405e62; FUN_00405e62: WriteFile
00402645e9 6a ef ff ffJMP LAB_004015b4
caseD_39:
0040264a6a 02PUSH 0x2
0040264c89 5d f8MOV dword ptr [EBP + local_c],EBX
0040264f58POP EAX
0040265050PUSH EAX
0040265189 45 b8MOV dword ptr [EBP + local_4c],EAX
00402654e8 c6 05 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040265983 f8 01CMP EAX,0x1
0040265c59POP ECX
0040265d89 55 b4MOV dword ptr [EBP + local_50],EDX
0040266089 45 c4MOV dword ptr [EBP + local_40],EAX
004026630f 8c 5c 04 00 00JL caseD_41
00402669b9 ff 1f 00 00MOV ECX,0x1fff
0040266e3b c1CMP EAX,ECX
004026707e 03JLE LAB_00402675
0040267289 4d c4MOV dword ptr [EBP + local_40],ECX
LAB_00402675:
0040267566 39 1eCMP word ptr [ESI],BX
004026780f 84 5e 01 00 00JZ LAB_004027dc
0040267e56PUSH ESI
0040267f89 5d d0MOV dword ptr [EBP + local_34],EBX
00402682e8 93 3b 00 00CALL FUN_0040621a
0040268739 5d c4CMP dword ptr [EBP + local_40],EBX
0040268a89 45 f0MOV dword ptr [EBP + local_14],EAX
0040268d0f 8e 49 01 00 00JLE LAB_004027dc
004026938b 3d 58 81 40 00MOV EDI,dword ptr [PTR_MultiByteToWideChar_00408158]
LAB_00402699:
0040269983 7d d4 39CMP dword ptr [EBP + local_30],0x39
0040269d0f 85 8f 00 00 00JNZ LAB_00402732
004026a38d 45 c8LEA EAX,[EBP + -0x38]
004026a653PUSH EBX
004026a750PUSH EAX
004026a86a 02PUSH 0x2
004026aa58POP EAX
004026ab2b 45 e4SUB EAX,dword ptr [EBP + local_20]
004026ae50PUSH EAX
004026af8d 45 0aLEA EAX,[EBP + 0xa]
004026b250PUSH EAX
004026b3ff 75 f0PUSH dword ptr [EBP + local_14]
004026b6ff 15 48 81 40 00CALL dword ptr [PTR_ReadFile_00408148]
004026bc85 c0TEST EAX,EAX
004026be0f 84 18 01 00 00JZ LAB_004027dc
004026c48b 4d c8MOV ECX,dword ptr [EBP + local_3c]
004026c73b cbCMP ECX,EBX
004026c90f 84 0d 01 00 00JZ LAB_004027dc
004026cf66 0f b6 45 0aMOVZX AX,byte ptr [EBP + param_1+0x2]
004026d439 5d e4CMP dword ptr [EBP + local_20],EBX
004026d789 4d b8MOV dword ptr [EBP + local_4c],ECX
004026da89 45 bcMOV dword ptr [EBP + local_48],EAX
004026dd0f 85 b5 00 00 00JNZ LAB_00402798
004026e38d 45 bcLEA EAX,[EBP + -0x44]
004026e66a 01PUSH 0x1
004026e850PUSH EAX
004026e98d 45 0aLEA EAX,[EBP + 0xa]
004026ec51PUSH ECX
004026ed50PUSH EAX
004026ee6a 08PUSH 0x8
004026f053PUSH EBX
004026f1ff d7CALL EDI
004026f385 c0TEST EAX,EAX
004026f575 68JNZ LAB_0040275f
004026f78b 75 b8MOV ESI,dword ptr [EBP + local_4c]
004026faf7 deNEG ESI
LAB_004026fc:
004026fcff 4d c8DEC dword ptr [EBP + local_3c]
004026ffb8 fd ff 00 00MOV EAX,0xfffd
0040270489 45 bcMOV dword ptr [EBP + local_48],EAX
0040270774 59JZ LAB_00402762
00402709ff 4d b8DEC dword ptr [EBP + local_4c]
0040270c46INC ESI
0040270d6a 01PUSH 0x1
0040270f53PUSH EBX
0040271056PUSH ESI
00402711ff 75 f0PUSH dword ptr [EBP + local_14]
00402714ff 15 44 81 40 00CALL dword ptr [PTR_SetFilePointer_00408144]
0040271a8d 45 bcLEA EAX,[EBP + -0x44]
0040271d6a 01PUSH 0x1
0040271f50PUSH EAX
004027208d 45 0aLEA EAX,[EBP + 0xa]
00402723ff 75 c8PUSH dword ptr [EBP + local_3c]
0040272650PUSH EAX
004027276a 08PUSH 0x8
0040272953PUSH EBX
0040272aff d7CALL EDI
0040272c85 c0TEST EAX,EAX
0040272e74 ccJZ LAB_004026fc
00402730eb 2dJMP LAB_0040275f
LAB_00402732:
0040273239 5d e4CMP dword ptr [EBP + local_20],EBX
0040273575 16JNZ LAB_0040274d
0040273739 5d f8CMP dword ptr [EBP + local_c],EBX
0040273a75 11JNZ LAB_0040274d
0040273c53PUSH EBX
0040273dff 75 f0PUSH dword ptr [EBP + local_14]
00402740e8 4c 37 00 00CALL FUN_00405e91; FUN_00405e91: SetFilePointer
0040274585 c0TEST EAX,EAX
004027470f 8c 8f 00 00 00JL LAB_004027dc
LAB_0040274d:
0040274d8d 45 bcLEA EAX,[EBP + -0x44]
004027506a 02PUSH 0x2
0040275250PUSH EAX
00402753ff 75 f0PUSH dword ptr [EBP + local_14]
00402756e8 d8 36 00 00CALL FUN_00405e33; FUN_00405e33: ReadFile
0040275b85 c0TEST EAX,EAX
0040275d74 7dJZ LAB_004027dc
LAB_0040275f:
0040275f8b 45 bcMOV EAX,dword ptr [EBP + local_48]
LAB_00402762:
0040276239 5d e4CMP dword ptr [EBP + local_20],EBX
0040276575 31JNZ LAB_00402798
0040276766 83 7d d0 0dCMP word ptr [EBP + local_34],0xd
0040276c74 3bJZ LAB_004027a9
0040276e66 83 7d d0 0aCMP word ptr [EBP + local_34],0xa
0040277374 34JZ LAB_004027a9
004027758b 4d f4MOV ECX,dword ptr [EBP + local_10]
004027788b 55 f8MOV EDX,dword ptr [EBP + local_c]
0040277bff 45 f8INC dword ptr [EBP + local_c]
0040277e66 3b c3CMP AX,BX
0040278166 89 04 51MOV word ptr [ECX + EDX*0x2],AX
0040278589 45 d0MOV dword ptr [EBP + local_34],EAX
0040278874 52JZ LAB_004027dc
0040278a8b 45 f8MOV EAX,dword ptr [EBP + local_c]
0040278d3b 45 c4CMP EAX,dword ptr [EBP + local_40]
004027900f 8c 03 ff ff ffJL LAB_00402699
00402796eb 44JMP LAB_004027dc
LAB_00402798:
004027980f b7 c0MOVZX EAX,AX
0040279b50PUSH EAX
0040279cff 75 f4PUSH dword ptr [EBP + local_10]
0040279fe8 5d 3a 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
004027a4e9 25 03 00 00JMP LAB_00402ace
LAB_004027a9:
004027a966 39 45 d0CMP word ptr [EBP + local_34],AX
004027ad74 1bJZ LAB_004027ca
004027af66 3d 0d 00CMP AX,0xd
004027b374 06JZ LAB_004027bb
004027b566 3d 0a 00CMP AX,0xa
004027b975 0fJNZ LAB_004027ca
LAB_004027bb:
004027bb8b 4d f4MOV ECX,dword ptr [EBP + local_10]
004027be8b 55 f8MOV EDX,dword ptr [EBP + local_c]
004027c1ff 45 f8INC dword ptr [EBP + local_c]
004027c466 89 04 51MOV word ptr [ECX + EDX*0x2],AX
004027c8eb 12JMP LAB_004027dc
LAB_004027ca:
004027ca8b 45 b8MOV EAX,dword ptr [EBP + local_4c]
004027cd6a 01PUSH 0x1
004027cff7 d8NEG EAX
004027d153PUSH EBX
004027d250PUSH EAX
004027d3ff 75 f0PUSH dword ptr [EBP + local_14]
004027d6ff 15 44 81 40 00CALL dword ptr [PTR_SetFilePointer_00408144]
LAB_004027dc:
004027dc8b 4d f4MOV ECX,dword ptr [EBP + local_10]
004027df8b 45 f8MOV EAX,dword ptr [EBP + local_c]
004027e23b c3CMP EAX,EBX
004027e466 89 1c 41MOV word ptr [ECX + EAX*0x2],BX
004027e8e9 c9 ed ff ffJMP LAB_004015b6
caseD_3a:
004027ed66 39 1eCMP word ptr [ESI],BX
004027f00f 84 cf 02 00 00JZ caseD_41
004027f66a 02PUSH 0x2
004027f8e8 22 04 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004027fd59POP ECX
004027fe89 55 b4MOV dword ptr [EBP + local_50],EDX
00402801ff 75 e4PUSH dword ptr [EBP + local_20]
0040280453PUSH EBX
0040280550PUSH EAX
0040280656PUSH ESI
00402807e8 0e 3a 00 00CALL FUN_0040621a
0040280c50PUSH EAX
0040280dff 15 44 81 40 00CALL dword ptr [PTR_SetFilePointer_00408144]
0040281339 5d dcCMP dword ptr [EBP + local_28],EBX
004028160f 8c a9 02 00 00JL caseD_41
0040281ce9 46 02 00 00JMP LAB_00402a67
caseD_3b:
0040282156PUSH ESI
00402822e8 f3 39 00 00CALL FUN_0040621a
004028273b c3CMP EAX,EBX
004028290f 84 96 02 00 00JZ caseD_41
0040282f50PUSH EAX
00402830ff 15 4c 81 40 00CALL dword ptr [PTR_FindClose_0040814c]
00402836e9 8a 02 00 00JMP caseD_41
caseD_3c:
0040283bff 75 f4PUSH dword ptr [EBP + local_10]
0040283ee8 d7 39 00 00CALL FUN_0040621a
004028433b c3CMP EAX,EBX
0040284574 12JZ LAB_00402859
004028478d 8d 2c fd ff ffLEA ECX,[EBP + 0xfffffd2c]
0040284d51PUSH ECX
0040284e50PUSH EAX
0040284fff 15 3c 81 40 00CALL dword ptr [PTR_FindNextFileW_0040813c]
0040285585 c0TEST EAX,EAX
0040285775 47JNZ LAB_004028a0
LAB_00402859:
00402859c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
0040286066 89 1eMOV word ptr [ESI],BX
00402863e9 5d 02 00 00JMP caseD_41
caseD_3d:
004028686a 02PUSH 0x2
0040286ae8 d2 03 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
0040286f8d 8d 2c fd ff ffLEA ECX,[EBP + 0xfffffd2c]
0040287551PUSH ECX
0040287650PUSH EAX
00402877ff 15 38 81 40 00CALL dword ptr [PTR_FindFirstFileW_00408138]
0040287d83 f8 ffCMP EAX,-0x1
0040288075 15JNZ LAB_00402897
004028828b 45 f4MOV EAX,dword ptr [EBP + local_10]
0040288566 89 18MOV word ptr [EAX],BX
LAB_00402888:
0040288866 89 1eMOV word ptr [ESI],BX
LAB_0040288b:
0040288bc7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
00402892e9 2e 02 00 00JMP caseD_41
LAB_00402897:
0040289750PUSH EAX
00402898ff 75 f4PUSH dword ptr [EBP + local_10]
0040289be8 61 39 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
LAB_004028a0:
004028a08d 85 58 fd ff ffLEA EAX,[EBP + 0xfffffd58]
004028a650PUSH EAX
004028a756PUSH ESI
004028a8e9 34 01 00 00JMP LAB_004029e1
caseD_3e:
004028ad6a f0PUSH -0x10
004028afc7 45 d0 66 fd ff ffMOV dword ptr [EBP + local_34],0xfffffd66
004028b6e8 86 03 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
004028bb8b f0MOV ESI,EAX
004028bd56PUSH ESI
004028be89 75 c8MOV dword ptr [EBP + local_3c],ESI
004028c1e8 40 33 00 00CALL FUN_00405c06
004028c685 c0TEST EAX,EAX
004028c875 07JNZ LAB_004028d1
004028ca6a edPUSH -0x13
004028cce8 70 03 00 00CALL FUN_00402c41; FUN_00402c41: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +3
LAB_004028d1:
004028d156PUSH ESI
004028d2e8 b4 34 00 00CALL FUN_00405d8b; FUN_00405d8b: GetFileAttributesW, SetFileAttributesW
004028d76a 02PUSH 0x2
004028d968 00 00 00 40PUSH 0x40000000
004028de56PUSH ESI
004028dfe8 cc 34 00 00CALL FUN_00405db0; FUN_00405db0: GetFileAttributesW, CreateFileW
004028e483 f8 ffCMP EAX,-0x1
004028e789 45 08MOV dword ptr [EBP + param_1],EAX
004028ea0f 84 97 00 00 00JZ LAB_00402987
004028f0a1 f8 ae 47 00MOV EAX,[DAT_0047aef8]
004028f58b 35 34 81 40 00MOV ESI,dword ptr [PTR_GlobalAlloc_00408134]
004028fb50PUSH EAX
004028fc6a 40PUSH 0x40
004028fe89 45 c4MOV dword ptr [EBP + local_40],EAX
00402901ff d6CALL ESI
004029038b f8MOV EDI,EAX
004029053b fbCMP EDI,EBX
0040290774 75JZ LAB_0040297e
0040290953PUSH EBX
0040290ae8 38 0a 00 00CALL FUN_00403347; FUN_00403347: SetFilePointer
0040290fff 75 c4PUSH dword ptr [EBP + local_40]
0040291257PUSH EDI
00402913e8 19 0a 00 00CALL FUN_00403331; FUN_00403331: ReadFile
00402918ff 75 e0PUSH dword ptr [EBP + local_24]
0040291b6a 40PUSH 0x40
0040291dff d6CALL ESI
0040291f8b f0MOV ESI,EAX
004029213b f3CMP ESI,EBX
0040292389 75 b4MOV dword ptr [EBP + local_50],ESI
0040292674 34JZ LAB_0040295c
00402928ff 75 e0PUSH dword ptr [EBP + local_24]
0040292b56PUSH ESI
0040292c53PUSH EBX
0040292dff 75 dcPUSH dword ptr [EBP + local_28]
00402930e8 e1 07 00 00CALL FUN_00403116; FUN_00403116: GetTickCount, MulDiv, wsprintfW
00402935eb 18JMP LAB_0040294f
LAB_00402937:
004029378b 0eMOV ECX,dword ptr [ESI]
004029398b 46 04MOV EAX,dword ptr [ESI + 0x4]
0040293c83 c6 08ADD ESI,0x8
0040293f51PUSH ECX
0040294003 c7ADD EAX,EDI
0040294256PUSH ESI
0040294350PUSH EAX
0040294489 4d ccMOV dword ptr [EBP + local_38],ECX
00402947e8 1f 34 00 00CALL FUN_00405d6b
0040294c03 75 ccADD ESI,dword ptr [EBP + local_38]
LAB_0040294f:
0040294f38 1eCMP byte ptr [ESI],BL
0040295175 e4JNZ LAB_00402937
00402953ff 75 b4PUSH dword ptr [EBP + local_50]
00402956ff 15 28 81 40 00CALL dword ptr [PTR_GlobalFree_00408128]
LAB_0040295c:
0040295cff 75 c4PUSH dword ptr [EBP + local_40]
0040295f57PUSH EDI
00402960ff 75 08PUSH dword ptr [EBP + param_1]
00402963e8 fa 34 00 00CALL FUN_00405e62; FUN_00405e62: WriteFile
0040296857PUSH EDI
00402969ff 15 28 81 40 00CALL dword ptr [PTR_GlobalFree_00408128]
0040296f53PUSH EBX
0040297053PUSH EBX
00402971ff 75 08PUSH dword ptr [EBP + param_1]
004029746a ffPUSH -0x1
00402976e8 9b 07 00 00CALL FUN_00403116; FUN_00403116: GetTickCount, MulDiv, wsprintfW
0040297b89 45 d0MOV dword ptr [EBP + local_34],EAX
LAB_0040297e:
0040297eff 75 08PUSH dword ptr [EBP + param_1]
00402981ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
LAB_00402987:
0040298739 5d d0CMP dword ptr [EBP + local_34],EBX
0040298a6a f3PUSH -0xd
0040298c5ePOP ESI
0040298d7d 13JGE LAB_004029a2
0040298f6a efPUSH -0x11
004029915ePOP ESI
00402992ff 75 c8PUSH dword ptr [EBP + local_3c]
00402995ff 15 40 81 40 00CALL dword ptr [PTR_DeleteFileW_00408140]
0040299bc7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
LAB_004029a2:
004029a256PUSH ESI
004029a3e9 a3 f8 ff ffJMP LAB_0040224b
caseD_3f:
004029a853PUSH EBX
004029a9e8 71 02 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004029ae8b f8MOV EDI,EAX
004029b059POP ECX
004029b13b 3d 2c af 47 00CMP EDI,dword ptr [DAT_0047af2c]
004029b789 55 b4MOV dword ptr [EBP + local_50],EDX
004029ba0f 83 cb fe ff ffJNC LAB_0040288b
004029c08b f7MOV ESI,EDI
004029c28b 45 e0MOV EAX,dword ptr [EBP + local_24]
004029c569 f6 18 40 00 00IMUL ESI,ESI,0x4018
004029cb03 35 28 af 47 00ADD ESI,dword ptr [DAT_0047af28]
004029d13b c3CMP EAX,EBX
004029d37c 19JL LAB_004029ee
004029d58b 0c 86MOV ECX,dword ptr [ESI + EAX*0x4]
004029d875 11JNZ LAB_004029eb
004029da83 c6 18ADD ESI,0x18
004029dd56PUSH ESI
004029deff 75 f4PUSH dword ptr [EBP + local_10]
LAB_004029e1:
004029e1e8 d4 38 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
004029e6e9 da 00 00 00JMP caseD_41
LAB_004029eb:
004029eb51PUSH ECX
004029eceb 7aJMP LAB_00402a68
LAB_004029ee:
004029ee83 c9 ffOR ECX,0xffffffff
004029f12b c8SUB ECX,EAX
004029f389 4d e0MOV dword ptr [EBP + local_24],ECX
004029f674 10JZ LAB_00402a08
004029f86a 01PUSH 0x1
004029fae8 20 02 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004029ff59POP ECX
00402a0089 55 b4MOV dword ptr [EBP + local_50],EDX
00402a0389 45 dcMOV dword ptr [EBP + local_28],EAX
00402a06eb 10JMP LAB_00402a18
LAB_00402a08:
00402a08ff 75 e8PUSH dword ptr [EBP + local_1c]
00402a0b8d 46 18LEA EAX,[ESI + 0x18]
00402a0e50PUSH EAX
00402a0fe8 c8 38 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00402a1480 4e 09 01OR byte ptr [ESI + 0x9],0x1
LAB_00402a18:
00402a188b 45 e0MOV EAX,dword ptr [EBP + local_24]
00402a1b8b 4d dcMOV ECX,dword ptr [EBP + local_28]
00402a1e89 0c 86MOV dword ptr [ESI + EAX*0x4],ECX
00402a2139 5d e4CMP dword ptr [EBP + local_20],EBX
00402a240f 84 9b 00 00 00JZ caseD_41
00402a2a57PUSH EDI
00402a2be8 4d e7 ff ffCALL FUN_0040117d
00402a30e9 90 00 00 00JMP caseD_41
caseD_40:
00402a3553PUSH EBX
00402a36e8 e4 01 00 00CALL FUN_00402c1f; FUN_00402c1f: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00402a3b83 f8 20CMP EAX,0x20
00402a3e59POP ECX
00402a3f89 55 b4MOV dword ptr [EBP + local_50],EDX
00402a420f 83 43 fe ff ffJNC LAB_0040288b
00402a4839 5d e4CMP dword ptr [EBP + local_20],EBX
00402a4b74 25JZ LAB_00402a72
00402a4d39 5d e0CMP dword ptr [EBP + local_24],EBX
00402a5074 0fJZ LAB_00402a61
00402a5250PUSH EAX
00402a53e8 41 e8 ff ffCALL FUN_00401299
00402a5853PUSH EBX
00402a5953PUSH EBX
00402a5ae8 90 e7 ff ffCALL FUN_004011ef
00402a5feb 64JMP caseD_41
LAB_00402a61:
00402a6153PUSH EBX
00402a62e8 7b e8 ff ffCALL FUN_004012e2
LAB_00402a67:
00402a6750PUSH EAX
LAB_00402a68:
00402a68ff 75 f4PUSH dword ptr [EBP + local_10]
default:
00402a6be8 91 37 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
00402a70eb 53JMP caseD_41
LAB_00402a72:
00402a7239 5d e0CMP dword ptr [EBP + local_24],EBX
00402a7574 12JZ LAB_00402a89
00402a778b 15 f4 ae 47 00MOV EDX,dword ptr [DAT_0047aef4]
00402a7d8b 4d dcMOV ECX,dword ptr [EBP + local_28]
00402a8089 8c 82 94 00 00 00MOV dword ptr [EDX + EAX*0x4 + 0x94],ECX
00402a87eb 3cJMP caseD_41
LAB_00402a89:
00402a898b 0d f4 ae 47 00MOV ECX,dword ptr [DAT_0047aef4]
00402a8fff b4 81 94 00 00 00PUSH dword ptr [ECX + EAX*0x4 + 0x94]
00402a96ff 75 f4PUSH dword ptr [EBP + local_10]
00402a99e8 3e 38 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00402a9eeb 25JMP caseD_41
caseD_43:
00402aa08b 0d 48 02 46 00MOV ECX,dword ptr [DAT_00460248]
00402aa653PUSH EBX
00402aa723 c8AND ECX,EAX
00402aa951PUSH ECX
00402aaa6a 0bPUSH 0xb
00402aacff 75 f8PUSH dword ptr [EBP + local_c]
00402aafff 15 18 82 40 00CALL dword ptr [PTR_SendMessageW_00408218]
00402ab539 5d d8CMP dword ptr [EBP + local_2c],EBX
00402ab874 0bJZ caseD_41
00402aba53PUSH EBX
00402abb53PUSH EBX
00402abcff 75 f8PUSH dword ptr [EBP + local_c]
00402abfff 15 14 82 40 00CALL dword ptr [PTR_InvalidateRect_00408214]
caseD_41:
00402ac58b 45 fcMOV EAX,dword ptr [EBP + local_8]
00402ac801 05 88 af 47 00ADD dword ptr [DAT_0047af88],EAX
LAB_00402ace:
00402ace33 c0XOR EAX,EAX
caseD_2:
00402ad05fPOP EDI
00402ad15ePOP ESI
00402ad25bPOP EBX
00402ad3c9LEAVE
00402ad4c2 04 00RET 0x4

recursive registry key deletion via…

0x402d44175 bytes
LSTATUS FUN_00402d44(HKEY param_1, LPCWSTR param_2, uint param_3)

recursive registry key deletion via RegDeleteKeyW and RegEnumKeyW

Behaviours
B6
Called from
FUN_00402cff, FUN_00402d44
Calls
RegDeleteKeyW RegCloseKey RegEnumKeyW FUN_00402d44, FUN_00406127, FUN_00406694
Decompiled C · 32 lines
LSTATUS FUN_00402d44(HKEY param_1,LPCWSTR param_2,uint param_3)

{
  LSTATUS LVar1;
  FARPROC pFVar2;
  WCHAR local_214 [262];
  HKEY local_8;
  
  LVar1 = FUN_00406127((uint)param_1,param_2,CONCAT31((int3)((param_3 & 0x300) >> 8),8),&local_8);
  if (LVar1 == 0) {
    do {
      LVar1 = RegEnumKeyW(local_8,0,local_214,0x105);
      if (LVar1 != 0) break;
      if ((param_3 & 1) != 0) {
        RegCloseKey(local_8);
        return 0x3eb;
      }
      LVar1 = FUN_00402d44(local_8,local_214,param_3);
    } while (LVar1 == 0);
    RegCloseKey(local_8);
    pFVar2 = FUN_00406694(3);
    if (pFVar2 == (FARPROC)0x0) {
      LVar1 = RegDeleteKeyW(param_1,param_2);
    }
    else {
      LVar1 = (*pFVar2)(param_1,param_2,param_3 & 0x300,0);
    }
  }
  return LVar1;
}
Assembly · 63 instructions, 2 annotated
AddressBytesInstructionComment
00402d4455PUSH EBP
00402d458b ecMOV EBP,ESP
00402d4781 ec 10 02 00 00SUB ESP,0x210
00402d4d53PUSH EBX
00402d4e56PUSH ESI
00402d4f8b 75 10MOV ESI,dword ptr [EBP + param_3]
00402d5257PUSH EDI
00402d538b feMOV EDI,ESI
00402d558d 45 fcLEA EAX,[EBP + -0x4]
00402d5881 e6 00 03 00 00AND ESI,0x300
00402d5e50PUSH EAX
00402d5f8b c6MOV EAX,ESI
00402d6183 e7 01AND EDI,0x1
00402d640c 08OR AL,0x8
00402d6650PUSH EAX
00402d67ff 75 0cPUSH dword ptr [EBP + param_2]
00402d6aff 75 08PUSH dword ptr [EBP + param_1]
00402d6de8 b5 33 00 00CALL FUN_00406127; FUN_00406127: RegOpenKeyExW
00402d7285 c0TEST EAX,EAX
00402d7475 76JNZ LAB_00402dec
00402d768b 1d 30 80 40 00MOV EBX,dword ptr [PTR_RegEnumKeyW_00408030]
00402d7ceb 1aJMP LAB_00402d98
LAB_00402d7e:
00402d7e85 ffTEST EDI,EDI
00402d8075 4eJNZ LAB_00402dd0
00402d82ff 75 10PUSH dword ptr [EBP + param_3]
00402d858d 85 f0 fd ff ffLEA EAX,[EBP + 0xfffffdf0]
00402d8b50PUSH EAX
00402d8cff 75 fcPUSH dword ptr [EBP + local_8]
00402d8fe8 b0 ff ff ffCALL FUN_00402d44
00402d9485 c0TEST EAX,EAX
00402d9675 17JNZ LAB_00402daf
LAB_00402d98:
00402d988d 85 f0 fd ff ffLEA EAX,[EBP + 0xfffffdf0]
00402d9e68 05 01 00 00PUSH 0x105
00402da350PUSH EAX
00402da46a 00PUSH 0x0
00402da6ff 75 fcPUSH dword ptr [EBP + local_8]
00402da9ff d3CALL EBX
00402dab85 c0TEST EAX,EAX
00402dad74 cfJZ LAB_00402d7e
LAB_00402daf:
00402dafff 75 fcPUSH dword ptr [EBP + local_8]
00402db2ff 15 24 80 40 00CALL dword ptr [PTR_RegCloseKey_00408024]
00402db86a 03PUSH 0x3
00402dbae8 d5 38 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
00402dbf85 c0TEST EAX,EAX
00402dc174 1dJZ LAB_00402de0
00402dc36a 00PUSH 0x0
00402dc556PUSH ESI
00402dc6ff 75 0cPUSH dword ptr [EBP + param_2]
00402dc9ff 75 08PUSH dword ptr [EBP + param_1]
00402dccff d0CALL EAX
00402dceeb 1cJMP LAB_00402dec
LAB_00402dd0:
00402dd0ff 75 fcPUSH dword ptr [EBP + local_8]
00402dd3ff 15 24 80 40 00CALL dword ptr [PTR_RegCloseKey_00408024]
00402dd9b8 eb 03 00 00MOV EAX,0x3eb
00402ddeeb 0cJMP LAB_00402dec
LAB_00402de0:
00402de0ff 75 0cPUSH dword ptr [EBP + param_2]
00402de3ff 75 08PUSH dword ptr [EBP + param_1]
00402de6ff 15 1c 80 40 00CALL dword ptr [PTR_RegDeleteKeyW_0040801c]
LAB_00402dec:
00402dec5fPOP EDI
00402ded5ePOP ESI
00402dee5bPOP EBX
00402defc9LEAVE
00402df0c2 0c 00RET 0xc

progress dialog procedure

0x402df3134 bytes
undefined4 FUN_00402df3(HWND param_1, int param_2)

Progress dialog procedure: displays extraction percentage via timer (WM_TIMER)

Called from
none found
Calls
MulDiv SetTimer SetWindowTextW wsprintfW SetDlgItemTextW
Decompiled C · 24 lines
undefined4 FUN_00402df3(HWND param_1,int param_2)

{
  int iVar1;
  WCHAR local_84 [64];
  
  if (param_2 == 0x110) {
    SetTimer(param_1,1,0xfa,(TIMERPROC)0x0);
    param_2 = 0x113;
  }
  if (param_2 == 0x113) {
    iVar1 = DAT_004281f8;
    if (DAT_00434204 <= DAT_004281f8) {
      iVar1 = DAT_00434204;
    }
    iVar1 = MulDiv(iVar1,100,DAT_00434204);
    wsprintfW(local_84,u_verifying_installer___d___0040a01c,iVar1);
    SetWindowTextW(param_1,local_84);
    SetDlgItemTextW(param_1,0x406,local_84);
  }
  return 0;
}
Assembly · 40 instructions, 1 annotated
AddressBytesInstructionComment
00402df355PUSH EBP
00402df48b ecMOV EBP,ESP
00402df681 ec 80 00 00 00SUB ESP,0x80
00402dfc81 7d 0c 10 01 00 00CMP dword ptr [EBP + param_2],0x110
00402e0375 19JNZ LAB_00402e1e
00402e056a 00PUSH 0x0
00402e0768 fa 00 00 00PUSH 0xfa
00402e0c6a 01PUSH 0x1
00402e0eff 75 08PUSH dword ptr [EBP + param_1]
00402e11ff 15 58 82 40 00CALL dword ptr [PTR_SetTimer_00408258]
00402e17c7 45 0c 13 01 00 00MOV dword ptr [EBP + param_2],0x113
LAB_00402e1e:
00402e1e81 7d 0c 13 01 00 00CMP dword ptr [EBP + param_2],0x113
00402e2575 4cJNZ LAB_00402e73
00402e278b 0d f8 81 42 00MOV ECX,dword ptr [DAT_004281f8]
00402e2da1 04 42 43 00MOV EAX,[DAT_00434204]
00402e323b c8CMP ECX,EAX
00402e347c 02JL LAB_00402e38
00402e368b c8MOV ECX,EAX
LAB_00402e38:
00402e3850PUSH EAX
00402e396a 64PUSH 0x64
00402e3b51PUSH ECX
00402e3cff 15 54 81 40 00CALL dword ptr [PTR_MulDiv_00408154]
00402e4250PUSH EAX
00402e438d 45 80LEA EAX,[EBP + -0x80]
00402e4668 1c a0 40 00PUSH u_verifying_installer:_%d%%_0040a01c; "verifying installer: %d%%"
00402e4b50PUSH EAX
00402e4cff 15 90 82 40 00CALL dword ptr [PTR_wsprintfW_00408290]
00402e5283 c4 0cADD ESP,0xc
00402e558d 45 80LEA EAX,[EBP + -0x80]
00402e5850PUSH EAX
00402e59ff 75 08PUSH dword ptr [EBP + param_1]
00402e5cff 15 5c 82 40 00CALL dword ptr [PTR_SetWindowTextW_0040825c]
00402e628d 45 80LEA EAX,[EBP + -0x80]
00402e6550PUSH EAX
00402e6668 06 04 00 00PUSH 0x406
00402e6bff 75 08PUSH dword ptr [EBP + param_1]
00402e6ee8 8b 2a 00 00CALL SetDlgItemTextW
LAB_00402e73:
00402e7333 c0XOR EAX,EAX
00402e75c9LEAVE
00402e76c2 10 00RET 0x10

progress dialog manager

0x402e79100 bytes
undefined FUN_00402e79(int param_1)

Progress dialog manager: shows or destroys the extraction progress window based on tick count

Called from
FUN_00402edd
Calls
GetTickCount DestroyWindow ShowWindow FUN_004066d0
Decompiled C · 25 lines
void __cdecl FUN_00402e79(int param_1)

{
  DWORD DVar1;
  
  if (param_1 != 0) {
    if (DAT_00434200 != (HWND)0x0) {
      DestroyWindow(DAT_00434200);
    }
    DAT_00434200 = (HWND)0x0;
    return;
  }
  if (DAT_00434200 != (HWND)0x0) {
    FUN_004066d0(0);
    return;
  }
  DVar1 = GetTickCount();
  if (DAT_0047aef0 < DVar1) {
    DAT_00434200 = CreateDialogParamW(DAT_0047aee0,(LPCWSTR)0x6f,(HWND)0x0,FUN_00402df3,0);
    ShowWindow(DAT_00434200,5);
  }
  return;
}
Assembly · 33 instructions, 1 annotated
AddressBytesInstructionComment
00402e7956PUSH ESI
00402e7a33 f6XOR ESI,ESI
00402e7c39 74 24 08CMP dword ptr [ESP + param_1],ESI
00402e8074 18JZ LAB_00402e9a
00402e82a1 00 42 43 00MOV EAX,[DAT_00434200]
00402e873b c6CMP EAX,ESI
00402e8974 07JZ LAB_00402e92
00402e8b50PUSH EAX
00402e8cff 15 50 82 40 00CALL dword ptr [PTR_DestroyWindow_00408250]
LAB_00402e92:
00402e9289 35 00 42 43 00MOV dword ptr [DAT_00434200],ESI
00402e985ePOP ESI
00402e99c3RET
LAB_00402e9a:
00402e9a39 35 00 42 43 00CMP dword ptr [DAT_00434200],ESI
00402ea074 08JZ LAB_00402eaa
00402ea256PUSH ESI
00402ea3e8 28 38 00 00CALL FUN_004066d0; FUN_004066d0: DispatchMessageW
00402ea85ePOP ESI
00402ea9c3RET
LAB_00402eaa:
00402eaaff 15 7c 80 40 00CALL dword ptr [PTR_GetTickCount_0040807c]
00402eb03b 05 f0 ae 47 00CMP EAX,dword ptr [DAT_0047aef0]
00402eb676 23JBE LAB_00402edb
00402eb856PUSH ESI
00402eb968 f3 2d 40 00PUSH FUN_00402df3
00402ebe56PUSH ESI
00402ebf6a 6fPUSH 0x6f
00402ec1ff 35 e0 ae 47 00PUSH dword ptr [DAT_0047aee0]
00402ec7ff 15 88 82 40 00CALL dword ptr [PTR_CreateDialogParamW_00408288]
00402ecd6a 05PUSH 0x5
00402ecf50PUSH EAX
00402ed0a3 00 42 43 00MOV [DAT_00434200],EAX
00402ed5ff 15 68 82 40 00CALL dword ptr [PTR_ShowWindow_00408268]
LAB_00402edb:
00402edb5ePOP ESI
00402edcc3RET

NSIS self-reader

0x402edd569 bytes
wchar_t * FUN_00402edd(uint param_1)

NSIS self-reader: opens own file, validates NSIS header magic, reads archive data into memory

Cited as
E10, E29
Behaviours
B10
Called from
entry
Calls
GetTickCount GetFileSize GetModuleFileNameW GlobalAlloc SetFilePointer FUN_00402e79, FUN_00403116, FUN_00403331, FUN_00403347, FUN_00405bdb, FUN_00405d6b, FUN_00405db0, FUN_004062ba, FUN_00406787
Decompiled C · 109 lines
wchar_t * FUN_00402edd(uint param_1)

{
  DWORD DVar1;
  HANDLE hFile;
  LPCWSTR pWVar2;
  uint uVar3;
  uint uVar4;
  int iVar5;
  undefined4 *puVar6;
  int *piVar7;
  uint uVar8;
  uint local_2c;
  int local_28;
  int local_24;
  int local_20;
  int local_1c;
  SIZE_T local_18;
  int local_14;
  HANDLE local_10;
  uint local_c;
  int local_8;
  
  local_c = 0;
  local_8 = 0;
  DVar1 = GetTickCount();
  DAT_0047aef0 = DVar1 + 1000;
  GetModuleFileNameW((HMODULE)0x0,(LPWSTR)&DAT_004e7000,0x2000);
  hFile = (HANDLE)FUN_00405db0((LPCWSTR)&DAT_004e7000,0x80000000,3);
  if (hFile == (HANDLE)0xffffffff) {
    DAT_0040a018 = hFile;
    return u_Error_launching_installer_0040a1e8;
  }
  DAT_0040a018 = hFile;
  local_10 = hFile;
  FUN_004062ba((LPWSTR)&DAT_004d7000,(LPCWSTR)&DAT_004e7000);
  pWVar2 = FUN_00405bdb((LPCWSTR)&DAT_004d7000);
  FUN_004062ba((LPWSTR)&DAT_004eb000,pWVar2);
  uVar3 = GetFileSize(hFile,(LPDWORD)0x0);
  DAT_00434204 = uVar3;
  for (; 0 < (int)uVar3; uVar3 = uVar3 - uVar8) {
    uVar4 = (-(uint)(DAT_0047aef8 != 0) & 0x7e00) + 0x200;
    uVar8 = uVar3;
    if ((int)uVar4 <= (int)uVar3) {
      uVar8 = uVar4;
    }
    iVar5 = FUN_00403331(&DAT_00434208,uVar8);
    if (iVar5 == 0) {
      FUN_00402e79(1);
      goto LAB_004030b5;
    }
    if (DAT_0047aef8 == 0) {
      FUN_00405d6b((undefined1 *)&local_2c,0x434208,0x1c);
      if (((((local_2c & 0xfffffff0) == 0) && (local_28 == -0x21524111)) && (local_1c == 0x74736e49)
          ) && ((local_20 == 0x74666f73 && (local_24 == 0x6c6c754e)))) {
        param_1 = param_1 | local_2c;
        DAT_0047afa0 = DAT_0047afa0 | param_1 & 2;
        DAT_0047aef8 = DAT_004281f8;
        if ((int)uVar3 < local_14) goto LAB_004030b5;
        if (((param_1 & 8) == 0) && ((param_1 & 4) != 0)) break;
        local_8 = local_8 + 1;
        uVar3 = local_14 - 4;
        if (uVar3 < uVar8) {
          uVar8 = uVar3;
        }
      }
    }
    else if ((param_1 & 2) == 0) {
      FUN_00402e79(0);
    }
    if ((int)uVar3 < (int)DAT_00434204) {
      local_c = FUN_00406787(local_c,&DAT_00434208,uVar8);
    }
    DAT_004281f8 = DAT_004281f8 + uVar8;
  }
  FUN_00402e79(1);
  if (DAT_0047aef8 != 0) {
    if (local_8 != 0) {
      FUN_00403347(DAT_004281f8);
      iVar5 = FUN_00403331(&param_1,4);
      if ((iVar5 == 0) || (local_c != param_1)) goto LAB_004030b5;
    }
    puVar6 = GlobalAlloc(0x40,local_18);
    FUN_00403347(DAT_0047aef8 + 0x1c);
    DVar1 = FUN_00403116(-1,(HANDLE)0x0,(undefined *)puVar6,local_18);
    if (DVar1 == local_18) {
      DAT_0047aefc = *puVar6;
      if ((local_2c & 1) != 0) {
        DAT_0047af00 = DAT_0047af00 + 1;
      }
      piVar7 = puVar6 + 0x11;
      iVar5 = 8;
      DAT_0047aef4 = puVar6;
      do {
        piVar7 = piVar7 + -2;
        *piVar7 = *piVar7 + (int)puVar6;
        iVar5 = iVar5 + -1;
      } while (iVar5 != 0);
      DVar1 = SetFilePointer(local_10,0,(PLONG)0x0,1);
      puVar6[0xf] = DVar1;
      FUN_00405d6b(&DAT_0047af20,(int)(puVar6 + 1),0x40);
      return (wchar_t *)0x0;
    }
  }
LAB_004030b5:
  return u_Installer_integrity_check_has_fa_0040a050;
}
Assembly · 182 instructions, 14 annotated
AddressBytesInstructionComment
00402edd55PUSH EBP
00402ede8b ecMOV EBP,ESP
00402ee083 ec 28SUB ESP,0x28
00402ee353PUSH EBX
00402ee456PUSH ESI
00402ee533 dbXOR EBX,EBX
00402ee757PUSH EDI
00402ee889 5d f8MOV dword ptr [EBP + local_c],EBX
00402eeb89 5d fcMOV dword ptr [EBP + local_8],EBX
00402eeeff 15 7c 80 40 00CALL dword ptr [PTR_GetTickCount_0040807c]
00402ef4be 00 70 4e 00MOV ESI,DAT_004e7000
00402ef968 00 20 00 00PUSH 0x2000
00402efe05 e8 03 00 00ADD EAX,0x3e8
00402f0356PUSH ESI
00402f0453PUSH EBX
00402f05a3 f0 ae 47 00MOV [DAT_0047aef0],EAX
00402f0aff 15 84 80 40 00CALL dword ptr [PTR_GetModuleFileNameW_00408084]
00402f106a 03PUSH 0x3
00402f1268 00 00 00 80PUSH 0x80000000
00402f1756PUSH ESI
00402f18e8 93 2e 00 00CALL FUN_00405db0; FUN_00405db0: GetFileAttributesW, CreateFileW
00402f1d8b f8MOV EDI,EAX
00402f1f83 ff ffCMP EDI,-0x1
00402f2289 7d f4MOV dword ptr [EBP + local_10],EDI
00402f2589 3d 18 a0 40 00MOV dword ptr [DAT_0040a018],EDI
00402f2b75 0aJNZ LAB_00402f37
00402f2db8 e8 a1 40 00MOV EAX,u_Error_launching_installer_0040a1e8; "Error launching installer"
00402f32e9 d8 01 00 00JMP LAB_0040310f
LAB_00402f37:
00402f3756PUSH ESI
00402f38be 00 70 4d 00MOV ESI,DAT_004d7000
00402f3d56PUSH ESI
00402f3ee8 77 33 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00402f4356PUSH ESI
00402f44e8 92 2c 00 00CALL FUN_00405bdb; FUN_00405bdb: CharPrevW
00402f4950PUSH EAX
00402f4a68 00 b0 4e 00PUSH DAT_004eb000
00402f4fe8 66 33 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00402f5453PUSH EBX
00402f5557PUSH EDI
00402f56ff 15 80 80 40 00CALL dword ptr [PTR_GetFileSize_00408080]
00402f5c3b c3CMP EAX,EBX
00402f5ea3 04 42 43 00MOV [DAT_00434204],EAX
00402f638b f0MOV ESI,EAX
00402f650f 8e e7 00 00 00JLE LAB_00403052
00402f6bbb 08 42 43 00MOV EBX,DAT_00434208
LAB_00402f70:
00402f70a1 f8 ae 47 00MOV EAX,[DAT_0047aef8]
00402f758b feMOV EDI,ESI
00402f77f7 d8NEG EAX
00402f791b c0SBB EAX,EAX
00402f7b25 00 7e 00 00AND EAX,0x7e00
00402f8005 00 02 00 00ADD EAX,0x200
00402f853b f0CMP ESI,EAX
00402f877c 02JL LAB_00402f8b
00402f898b f8MOV EDI,EAX
LAB_00402f8b:
00402f8b57PUSH EDI
00402f8c53PUSH EBX
00402f8de8 9f 03 00 00CALL FUN_00403331; FUN_00403331: ReadFile
00402f9285 c0TEST EAX,EAX
00402f940f 84 22 01 00 00JZ LAB_004030bc
00402f9a83 3d f8 ae 47 00 00CMP dword ptr [DAT_0047aef8],0x0
00402fa175 7aJNZ LAB_0040301d
00402fa36a 1cPUSH 0x1c
00402fa58d 45 d8LEA EAX,[EBP + -0x28]
00402fa853PUSH EBX
00402fa950PUSH EAX
00402faae8 bc 2d 00 00CALL FUN_00405d6b
00402faf8b 45 d8MOV EAX,dword ptr [EBP + local_2c]
00402fb2a9 f0 ff ff ffTEST EAX,0xfffffff0
00402fb775 72JNZ LAB_0040302b
00402fb981 7d dc ef be ad deCMP dword ptr [EBP + local_28],0xdeadbeef
00402fc075 69JNZ LAB_0040302b
00402fc281 7d e8 49 6e 73 74CMP dword ptr [EBP + local_1c],0x74736e49
00402fc975 60JNZ LAB_0040302b
00402fcb81 7d e4 73 6f 66 74CMP dword ptr [EBP + local_20],0x74666f73
00402fd275 57JNZ LAB_0040302b
00402fd481 7d e0 4e 75 6c 6cCMP dword ptr [EBP + local_24],0x6c6c754e
00402fdb75 4eJNZ LAB_0040302b
00402fdd09 45 08OR dword ptr [EBP + param_1],EAX
00402fe08b 45 08MOV EAX,dword ptr [EBP + param_1]
00402fe38b 0d f8 81 42 00MOV ECX,dword ptr [DAT_004281f8]
00402fe983 e0 02AND EAX,0x2
00402fec09 05 a0 af 47 00OR dword ptr [DAT_0047afa0],EAX
00402ff28b 45 f0MOV EAX,dword ptr [EBP + local_14]
00402ff53b c6CMP EAX,ESI
00402ff789 0d f8 ae 47 00MOV dword ptr [DAT_0047aef8],ECX
00402ffd0f 8f b2 00 00 00JG LAB_004030b5
00403003f6 45 08 08TEST byte ptr [EBP + param_1],0x8
0040300775 06JNZ LAB_0040300f
00403009f6 45 08 04TEST byte ptr [EBP + param_1],0x4
0040300d75 41JNZ LAB_00403050
LAB_0040300f:
0040300fff 45 fcINC dword ptr [EBP + local_8]
004030128d 70 fcLEA ESI,[EAX + -0x4]
004030153b feCMP EDI,ESI
0040301776 12JBE LAB_0040302b
004030198b feMOV EDI,ESI
0040301beb 0eJMP LAB_0040302b
LAB_0040301d:
0040301df6 45 08 02TEST byte ptr [EBP + param_1],0x2
0040302175 08JNZ LAB_0040302b
004030236a 00PUSH 0x0
00403025e8 4f fe ff ffCALL FUN_00402e79; FUN_00402e79: DestroyWindow, GetTickCount, CreateDialogParamW, ShowWindow
0040302a59POP ECX
LAB_0040302b:
0040302b3b 35 04 42 43 00CMP ESI,dword ptr [DAT_00434204]
004030317d 0dJGE LAB_00403040
0040303357PUSH EDI
0040303453PUSH EBX
00403035ff 75 f8PUSH dword ptr [EBP + local_c]
00403038e8 4a 37 00 00CALL FUN_00406787
0040303d89 45 f8MOV dword ptr [EBP + local_c],EAX
LAB_00403040:
0040304001 3d f8 81 42 00ADD dword ptr [DAT_004281f8],EDI
004030462b f7SUB ESI,EDI
0040304885 f6TEST ESI,ESI
0040304a0f 8f 20 ff ff ffJG LAB_00402f70
LAB_00403050:
0040305033 dbXOR EBX,EBX
LAB_00403052:
004030526a 01PUSH 0x1
00403054e8 20 fe ff ffCALL FUN_00402e79; FUN_00402e79: DestroyWindow, GetTickCount, CreateDialogParamW, ShowWindow
0040305939 1d f8 ae 47 00CMP dword ptr [DAT_0047aef8],EBX
0040305f59POP ECX
0040306074 53JZ LAB_004030b5
0040306239 5d fcCMP dword ptr [EBP + local_8],EBX
0040306574 22JZ LAB_00403089
00403067ff 35 f8 81 42 00PUSH dword ptr [DAT_004281f8]
0040306de8 d5 02 00 00CALL FUN_00403347; FUN_00403347: SetFilePointer
004030728d 45 08LEA EAX,[EBP + 0x8]
004030756a 04PUSH 0x4
0040307750PUSH EAX
00403078e8 b4 02 00 00CALL FUN_00403331; FUN_00403331: ReadFile
0040307d85 c0TEST EAX,EAX
0040307f74 34JZ LAB_004030b5
004030818b 45 f8MOV EAX,dword ptr [EBP + local_c]
004030843b 45 08CMP EAX,dword ptr [EBP + param_1]
0040308775 2cJNZ LAB_004030b5
LAB_00403089:
00403089ff 75 ecPUSH dword ptr [EBP + local_18]
0040308c6a 40PUSH 0x40
0040308eff 15 34 81 40 00CALL dword ptr [PTR_GlobalAlloc_00408134]
004030948b f0MOV ESI,EAX
00403096a1 f8 ae 47 00MOV EAX,[DAT_0047aef8]
0040309b83 c0 1cADD EAX,0x1c
0040309e50PUSH EAX
0040309fe8 a3 02 00 00CALL FUN_00403347; FUN_00403347: SetFilePointer
004030a4ff 75 ecPUSH dword ptr [EBP + local_18]
004030a756PUSH ESI
004030a853PUSH EBX
004030a96a ffPUSH -0x1
004030abe8 66 00 00 00CALL FUN_00403116; FUN_00403116: GetTickCount, MulDiv, wsprintfW
004030b03b 45 ecCMP EAX,dword ptr [EBP + local_18]
004030b374 11JZ LAB_004030c6
LAB_004030b5:
004030b5b8 50 a0 40 00MOV EAX,u_Installer_integrity_check_has_fa_0040a050; "Installer integrity check has failed. Common causes include\nincomplete download …"
004030baeb 53JMP LAB_0040310f
LAB_004030bc:
004030bc6a 01PUSH 0x1
004030bee8 b6 fd ff ffCALL FUN_00402e79; FUN_00402e79: DestroyWindow, GetTickCount, CreateDialogParamW, ShowWindow
004030c359POP ECX
004030c4eb efJMP LAB_004030b5
LAB_004030c6:
004030c6f6 45 d8 01TEST byte ptr [EBP + local_2c],0x1
004030ca89 35 f4 ae 47 00MOV dword ptr [DAT_0047aef4],ESI
004030d08b 06MOV EAX,dword ptr [ESI]
004030d2a3 fc ae 47 00MOV [DAT_0047aefc],EAX
004030d774 06JZ LAB_004030df
004030d9ff 05 00 af 47 00INC dword ptr [DAT_0047af00]
LAB_004030df:
004030df6a 08PUSH 0x8
004030e18d 46 44LEA EAX,[ESI + 0x44]
004030e459POP ECX
LAB_004030e5:
004030e583 e8 08SUB EAX,0x8
004030e801 30ADD dword ptr [EAX],ESI
004030ea49DEC ECX
004030eb75 f8JNZ LAB_004030e5
004030ed6a 01PUSH 0x1
004030ef53PUSH EBX
004030f053PUSH EBX
004030f1ff 75 f4PUSH dword ptr [EBP + local_10]
004030f4ff 15 44 81 40 00CALL dword ptr [PTR_SetFilePointer_00408144]
004030fa89 46 3cMOV dword ptr [ESI + 0x3c],EAX
004030fd83 c6 04ADD ESI,0x4
004031006a 40PUSH 0x40
0040310256PUSH ESI
0040310368 20 af 47 00PUSH DAT_0047af20
00403108e8 5e 2c 00 00CALL FUN_00405d6b
0040310d33 c0XOR EAX,EAX
LAB_0040310f:
0040310f5fPOP EDI
004031105ePOP ESI
004031115bPOP EBX
00403112c9LEAVE
00403113c2 04 00RET 0x4

NSIS archive data extractor

0x403116539 bytes
DWORD FUN_00403116(int param_1, HANDLE param_2, undefined * param_3, uint param_4)

NSIS archive data extractor: reads blocks from the archive and writes to a file handle or buffer

Called from
FUN_00401434, FUN_00402edd
Calls
GetTickCount MulDiv wsprintfW FUN_00403331, FUN_00403347, FUN_00405322, FUN_00405e62, FUN_004067f5
Decompiled C · 131 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

DWORD FUN_00403116(int param_1,HANDLE param_2,undefined *param_3,uint param_4)

{
  undefined *puVar1;
  int iVar2;
  DWORD DVar3;
  DWORD DVar4;
  uint uVar5;
  WCHAR local_98 [64];
  int local_18;
  DWORD local_14;
  undefined *local_10;
  DWORD local_c;
  DWORD local_8;
  
  uVar5 = param_4;
  local_c = param_4;
  if (param_3 == (undefined *)0x0) {
    local_c = 0x8000;
  }
  local_8 = 0;
  local_10 = param_3;
  if (param_3 == (undefined *)0x0) {
    local_10 = &DAT_0042c200;
  }
  if (-1 < param_1) {
    FUN_00403347(DAT_0047af58 + param_1);
  }
  iVar2 = FUN_00403331(&param_4,4);
  DVar3 = local_c;
  if (iVar2 != 0) {
    if ((param_4 & 0x80000000) == 0) {
      if (param_3 == (undefined *)0x0) {
        while( true ) {
          if ((int)param_4 < 1) {
            return local_8;
          }
          DVar4 = param_4;
          if ((int)DVar3 <= (int)param_4) {
            DVar4 = DVar3;
          }
          iVar2 = FUN_00403331(&DAT_00428200,DVar4);
          if (iVar2 == 0) break;
          iVar2 = FUN_00405e62(param_2,&DAT_00428200,DVar4);
          if (iVar2 == 0) {
            return 0xfffffffe;
          }
          local_8 = local_8 + DVar4;
          param_4 = param_4 - DVar4;
        }
      }
      else {
        if ((int)param_4 < (int)uVar5) {
          uVar5 = param_4;
        }
        iVar2 = FUN_00403331(param_3,uVar5);
        if (iVar2 != 0) {
          return uVar5;
        }
      }
    }
    else {
      local_14 = GetTickCount();
      _DAT_0041eb64 = 0;
      _DAT_0041eb60 = 0;
      uVar5 = param_4 & 0x7fffffff;
      _DAT_0041e648 = 8;
      _DAT_004281f0 = &DAT_004201e8;
      _DAT_004281ec = &DAT_004201e8;
      _DAT_004281e8 = &DAT_004281e8;
      param_4 = uVar5;
      if (uVar5 == 0) {
        _DAT_0041e648 = 8;
        _DAT_0041eb60 = 0;
        _DAT_0041eb64 = 0;
        return local_8;
      }
      while( true ) {
        DVar3 = 0x4000;
        if ((int)param_4 < 0x4000) {
          DVar3 = param_4;
        }
        iVar2 = FUN_00403331(&DAT_00428200,DVar3);
        if (iVar2 == 0) break;
        param_4 = param_4 - DVar3;
        _DAT_0041e638 = &DAT_00428200;
        _DAT_0041e63c = DVar3;
        while( true ) {
          puVar1 = local_10;
          DAT_0041e640 = local_10;
          _DAT_0041e644 = local_c;
          local_18 = FUN_004067f5((int *)&DAT_0041e638);
          if (local_18 < 0) {
            return 0xfffffffc;
          }
          DVar4 = (int)DAT_0041e640 - (int)puVar1;
          DVar3 = GetTickCount();
          if ((((byte)DAT_0047afb4 & 1) != 0) && ((200 < DVar3 - local_14 || (param_4 == 0)))) {
            iVar2 = MulDiv(uVar5 - param_4,100,uVar5);
            wsprintfW(local_98,u______d___0040a21c,iVar2);
            FUN_00405322(0,local_98);
            local_14 = DVar3;
          }
          if (DVar4 == 0) break;
          if (param_3 == (undefined *)0x0) {
            iVar2 = FUN_00405e62(param_2,local_10,DVar4);
            if (iVar2 == 0) {
              return 0xfffffffe;
            }
          }
          else {
            local_c = local_c - DVar4;
            local_10 = DAT_0041e640;
          }
          local_8 = local_8 + DVar4;
          if (local_18 == 1) {
            return local_8;
          }
        }
        if ((int)param_4 < 1) {
          return local_8;
        }
      }
    }
  }
  return 0xfffffffd;
}
Assembly · 166 instructions, 9 annotated
AddressBytesInstructionComment
0040311655PUSH EBP
004031178b ecMOV EBP,ESP
0040311981 ec 94 00 00 00SUB ESP,0x94
0040311f53PUSH EBX
0040312056PUSH ESI
004031218b 75 14MOV ESI,dword ptr [EBP + param_4]
0040312457PUSH EDI
004031258b 7d 10MOV EDI,dword ptr [EBP + param_3]
0040312889 75 f8MOV dword ptr [EBP + local_c],ESI
0040312b85 ffTEST EDI,EDI
0040312d75 07JNZ LAB_00403136
0040312fc7 45 f8 00 80 00 00MOV dword ptr [EBP + local_c],0x8000
LAB_00403136:
0040313683 65 fc 00AND dword ptr [EBP + local_8],0x0
0040313a89 7d f4MOV dword ptr [EBP + local_10],EDI
0040313d85 ffTEST EDI,EDI
0040313f75 07JNZ LAB_00403148
00403141c7 45 f4 00 c2 42 00MOV dword ptr [EBP + local_10],DAT_0042c200
LAB_00403148:
004031488b 45 08MOV EAX,dword ptr [EBP + param_1]
0040314b85 c0TEST EAX,EAX
0040314d7c 0eJL LAB_0040315d
0040314f8b 0d 58 af 47 00MOV ECX,dword ptr [DAT_0047af58]
0040315503 c8ADD ECX,EAX
0040315751PUSH ECX
00403158e8 ea 01 00 00CALL FUN_00403347; FUN_00403347: SetFilePointer
LAB_0040315d:
0040315d8d 45 14LEA EAX,[EBP + 0x14]
004031606a 04PUSH 0x4
0040316250PUSH EAX
00403163e8 c9 01 00 00CALL FUN_00403331; FUN_00403331: ReadFile
0040316885 c0TEST EAX,EAX
0040316a0f 84 af 01 00 00JZ LAB_0040331f
00403170f6 45 17 80TEST byte ptr [EBP + param_4+0x3],0x80
004031740f 84 50 01 00 00JZ LAB_004032ca
0040317a8b 1d 7c 80 40 00MOV EBX,dword ptr [PTR_GetTickCount_0040807c]
00403180ff d3CALL EBX
0040318283 25 64 eb 41 00 00AND dword ptr [DAT_0041eb64],0x0
0040318983 25 60 eb 41 00 00AND dword ptr [DAT_0041eb60],0x0
0040319081 65 14 ff ff ff 7fAND dword ptr [EBP + param_4],0x7fffffff
0040319789 45 f0MOV dword ptr [EBP + local_14],EAX
0040319ab8 e8 01 42 00MOV EAX,DAT_004201e8
0040319fc7 05 48 e6 41 00 08 00 …MOV dword ptr [DAT_0041e648],0x8
004031a9a3 f0 81 42 00MOV [DAT_004281f0],EAX
004031aea3 ec 81 42 00MOV [DAT_004281ec],EAX
004031b38b 45 14MOV EAX,dword ptr [EBP + param_4]
004031b6c7 05 e8 81 42 00 e8 81 …MOV dword ptr [DAT_004281e8],DAT_004281e8
004031c089 45 08MOV dword ptr [EBP + param_1],EAX
004031c30f 8e 5e 01 00 00JLE LAB_00403327
LAB_004031c9:
004031c9be 00 40 00 00MOV ESI,0x4000
004031ce39 75 14CMP dword ptr [EBP + param_4],ESI
004031d17d 03JGE LAB_004031d6
004031d38b 75 14MOV ESI,dword ptr [EBP + param_4]
LAB_004031d6:
004031d6bf 00 82 42 00MOV EDI,DAT_00428200
004031db56PUSH ESI
004031dc57PUSH EDI
004031dde8 4f 01 00 00CALL FUN_00403331; FUN_00403331: ReadFile
004031e285 c0TEST EAX,EAX
004031e40f 84 35 01 00 00JZ LAB_0040331f
004031ea29 75 14SUB dword ptr [EBP + param_4],ESI
004031ed89 3d 38 e6 41 00MOV dword ptr [DAT_0041e638],EDI
004031f389 35 3c e6 41 00MOV dword ptr [DAT_0041e63c],ESI
LAB_004031f9:
004031f98b 7d f4MOV EDI,dword ptr [EBP + local_10]
004031fc8b 45 f8MOV EAX,dword ptr [EBP + local_c]
004031ff68 38 e6 41 00PUSH DAT_0041e638
0040320489 3d 40 e6 41 00MOV dword ptr [DAT_0041e640],EDI
0040320aa3 44 e6 41 00MOV [DAT_0041e644],EAX
0040320fe8 e1 35 00 00CALL FUN_004067f5
0040321485 c0TEST EAX,EAX
0040321689 45 ecMOV dword ptr [EBP + local_18],EAX
004032190f 8c a3 00 00 00JL LAB_004032c2
0040321f8b 35 40 e6 41 00MOV ESI,dword ptr [DAT_0041e640]
004032252b f7SUB ESI,EDI
00403227ff d3CALL EBX
00403229f6 05 b4 af 47 00 01TEST byte ptr [DAT_0047afb4],0x1
004032308b f8MOV EDI,EAX
0040323274 49JZ LAB_0040327d
004032342b 45 f0SUB EAX,dword ptr [EBP + local_14]
004032373d c8 00 00 00CMP EAX,0xc8
0040323c77 06JA LAB_00403244
0040323e83 7d 14 00CMP dword ptr [EBP + param_4],0x0
0040324275 39JNZ LAB_0040327d
LAB_00403244:
004032448b 45 08MOV EAX,dword ptr [EBP + param_1]
00403247ff 75 08PUSH dword ptr [EBP + param_1]
0040324a2b 45 14SUB EAX,dword ptr [EBP + param_4]
0040324d6a 64PUSH 0x64
0040324f50PUSH EAX
00403250ff 15 54 81 40 00CALL dword ptr [PTR_MulDiv_00408154]
0040325650PUSH EAX
004032578d 85 6c ff ff ffLEA EAX,[EBP + 0xffffff6c]
0040325d68 1c a2 40 00PUSH u_..._%d%%_0040a21c; "... %d%%"
0040326250PUSH EAX
00403263ff 15 90 82 40 00CALL dword ptr [PTR_wsprintfW_00408290]
0040326983 c4 0cADD ESP,0xc
0040326c8d 85 6c ff ff ffLEA EAX,[EBP + 0xffffff6c]
0040327250PUSH EAX
004032736a 00PUSH 0x0
00403275e8 a8 20 00 00CALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
0040327a89 7d f0MOV dword ptr [EBP + local_14],EDI
LAB_0040327d:
0040327d85 f6TEST ESI,ESI
0040327f74 35JZ LAB_004032b6
0040328183 7d 10 00CMP dword ptr [EBP + param_3],0x0
0040328575 15JNZ LAB_0040329c
0040328756PUSH ESI
00403288ff 75 f4PUSH dword ptr [EBP + -0xc]
0040328bff 75 0cPUSH dword ptr [EBP + param_2]
0040328ee8 cf 2b 00 00CALL FUN_00405e62; FUN_00405e62: WriteFile
0040329385 c0TEST EAX,EAX
0040329574 2fJZ LAB_004032c6
0040329701 75 fcADD dword ptr [EBP + local_8],ESI
0040329aeb 0eJMP LAB_004032aa
LAB_0040329c:
0040329ca1 40 e6 41 00MOV EAX,[DAT_0041e640]
004032a101 75 fcADD dword ptr [EBP + local_8],ESI
004032a429 75 f8SUB dword ptr [EBP + local_c],ESI
004032a789 45 f4MOV dword ptr [EBP + local_10],EAX
LAB_004032aa:
004032aa83 7d ec 01CMP dword ptr [EBP + local_18],0x1
004032ae0f 85 45 ff ff ffJNZ LAB_004031f9
004032b4eb 71JMP LAB_00403327
LAB_004032b6:
004032b683 7d 14 00CMP dword ptr [EBP + param_4],0x0
004032ba0f 8f 09 ff ff ffJG LAB_004031c9
004032c0eb 65JMP LAB_00403327
LAB_004032c2:
004032c26a fcPUSH -0x4
004032c4eb 5bJMP LAB_00403321
LAB_004032c6:
004032c66a fePUSH -0x2
004032c8eb 57JMP LAB_00403321
LAB_004032ca:
004032ca85 ffTEST EDI,EDI
004032cc75 3eJNZ LAB_0040330c
004032ce39 7d 14CMP dword ptr [EBP + param_4],EDI
004032d17e 54JLE LAB_00403327
004032d38b 5d f8MOV EBX,dword ptr [EBP + local_c]
LAB_004032d6:
004032d639 5d 14CMP dword ptr [EBP + param_4],EBX
004032d98b 75 14MOV ESI,dword ptr [EBP + param_4]
004032dc7c 02JL LAB_004032e0
004032de8b f3MOV ESI,EBX
LAB_004032e0:
004032e0bf 00 82 42 00MOV EDI,DAT_00428200
004032e556PUSH ESI
004032e657PUSH EDI
004032e7e8 45 00 00 00CALL FUN_00403331; FUN_00403331: ReadFile
004032ec85 c0TEST EAX,EAX
004032ee74 2fJZ LAB_0040331f
004032f056PUSH ESI
004032f157PUSH EDI
004032f2ff 75 0cPUSH dword ptr [EBP + param_2]
004032f5e8 68 2b 00 00CALL FUN_00405e62; FUN_00405e62: WriteFile
004032fa85 c0TEST EAX,EAX
004032fc74 c8JZ LAB_004032c6
004032fe01 75 fcADD dword ptr [EBP + local_8],ESI
0040330129 75 14SUB dword ptr [EBP + param_4],ESI
0040330483 7d 14 00CMP dword ptr [EBP + param_4],0x0
004033087f ccJG LAB_004032d6
0040330aeb 1bJMP LAB_00403327
LAB_0040330c:
0040330c39 75 14CMP dword ptr [EBP + param_4],ESI
0040330f7d 03JGE LAB_00403314
004033118b 75 14MOV ESI,dword ptr [EBP + param_4]
LAB_00403314:
0040331456PUSH ESI
0040331557PUSH EDI
00403316e8 16 00 00 00CALL FUN_00403331; FUN_00403331: ReadFile
0040331b85 c0TEST EAX,EAX
0040331d75 05JNZ LAB_00403324
LAB_0040331f:
0040331f6a fdPUSH -0x3
LAB_00403321:
0040332158POP EAX
00403322eb 06JMP LAB_0040332a
LAB_00403324:
0040332489 75 fcMOV dword ptr [EBP + local_8],ESI
LAB_00403327:
004033278b 45 fcMOV EAX,dword ptr [EBP + local_8]
LAB_0040332a:
0040332a5fPOP EDI
0040332b5ePOP ESI
0040332c5bPOP EBX
0040332dc9LEAVE
0040332ec2 10 00RET 0x10

entry

0x40338f1345 bytes
undefined entry(void)

NSIS initialization: parses command line, adjusts privileges, sets up temp directory and environment, calls archive parser and UI

Cited as
E1, E2, E4
Behaviours
B1, B2, B4
Called from
none found
Calls
SetEnvironmentVariableW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode ExitProcess lstrcmpiW CloseHandle DeleteFileW lstrlenA CharNextW ExitWindowsEx SHGetFileInfoW AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW Ordinal_17 OleUninitialize OleInitialize FUN_0040140b, FUN_00402edd
Decompiled C · 216 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void entry(void)

{
  bool bVar1;
  DWORD DVar2;
  FARPROC pFVar3;
  int iVar4;
  LPWSTR pWVar5;
  short *psVar6;
  LPCWSTR pWVar7;
  WCHAR *pWVar8;
  int *piVar9;
  undefined3 extraout_var;
  int iVar10;
  HANDLE pvVar11;
  BOOL BVar12;
  WCHAR *pWVar13;
  WCHAR WVar14;
  char *lpString;
  WCHAR WVar15;
  LPWSTR *TokenHandle;
  wchar_t *local_2d4;
  UINT local_2d0;
  LPWSTR pWStack_2cc;
  uint local_2c8;
  _TOKEN_PRIVILEGES _Stack_2c4;
  SHFILEINFOW SStack_2b4;
  
  WVar15 = L' ';
  local_2d0 = 0;
  local_2d4 = u_Error_writing_temporary_file__Ma_0040a2e0;
  local_2c8 = 0;
  SetErrorMode(0x8001);
  DVar2 = GetVersion();
  DAT_0047aeec = DVar2 & 0xbfffffff;
  if (((short)DAT_0047aeec != 6) && (pFVar3 = FUN_00406694(0), pFVar3 != (FARPROC)0x0)) {
    (*pFVar3)(0xc00);
  }
  lpString = "UXTHEME";
  do {
    FUN_00406624(lpString);
    iVar4 = lstrlenA(lpString);
    lpString = lpString + iVar4 + 1;
  } while (*lpString != '\0');
  FUN_00406694(10);
  DAT_0047aee4 = FUN_00406694(8);
  pFVar3 = FUN_00406694(6);
  if ((pFVar3 != (FARPROC)0x0) && (iVar4 = (*pFVar3)(0x1e), iVar4 != 0)) {
    DAT_0047aeec = DAT_0047aeec | 0x40000000;
  }
  Ordinal_17();
  DAT_0047afb8 = OleInitialize((LPVOID)0x0);
  SHGetFileInfoW((LPCWSTR)&DAT_00440208,0,&SStack_2b4,0x2b4,0);
  FUN_004062ba((LPWSTR)&DAT_00472ee0,u_NSIS_Error_0040a2c8);
  pWVar5 = GetCommandLineW();
  FUN_004062ba(&DAT_004cb000,pWVar5);
  DAT_0047aee0 = 0x400000;
  psVar6 = &DAT_004cb000;
  if (DAT_004cb000 == 0x22) {
    psVar6 = (short *)&DAT_004cb002;
    WVar15 = L'\"';
  }
  pWVar7 = (LPCWSTR)FUN_00405bbc(psVar6,WVar15);
  pWVar8 = CharNextW(pWVar7);
  WVar15 = *pWVar8;
  pWStack_2cc = pWVar8;
  while (WVar15 != L'\0') {
    WVar14 = L' ';
    while (WVar15 == L' ') {
      pWVar8 = pWVar8 + 1;
      WVar15 = *pWVar8;
    }
    if (*pWVar8 == L'\"') {
      pWVar8 = pWVar8 + 1;
      WVar14 = L'\"';
    }
    pWVar13 = pWVar8;
    if (*pWVar8 == L'/') {
      pWVar13 = pWVar8 + 1;
      if ((*pWVar13 == L'S') && ((pWVar8[2] == L' ' || (pWVar8[2] == L'\0')))) {
        DAT_0047afa0 = 1;
      }
      if (((*(int *)pWVar13 == CONCAT22(DAT_0040a2be,DAT_0040a2bc)) &&
          (*(uint *)(pWVar8 + 3) == (CONCAT22(DAT_0040a2c2,DAT_0040a2c0) | (int)DAT_0040a2be >> 0xf)
          )) && ((pWVar8[5] == L' ' || (pWVar8[5] == L'\0')))) {
        local_2c8 = local_2c8 | 4;
      }
      if ((*(int *)(pWVar8 + -1) == CONCAT22(DAT_0040a2b2,DAT_0040a2b0)) &&
         (*(uint *)pWVar13 == (CONCAT22(DAT_0040a2b6,DAT_0040a2b4) | (int)DAT_0040a2b2 >> 0xf))) {
        pWVar8[-1] = L'\0';
        FUN_004062ba(&DAT_004cf000,pWVar8 + 3);
        break;
      }
    }
    pWVar8 = (WCHAR *)FUN_00405bbc(pWVar13,WVar14);
    if (*pWVar8 == L'\"') {
      pWVar8 = pWVar8 + 1;
    }
    WVar15 = *pWVar8;
  }
  GetTempPathW(0x2000,(LPWSTR)&DAT_004df000);
  iVar4 = FUN_0040335e();
  if (iVar4 == 0) {
    GetWindowsDirectoryW((LPWSTR)&DAT_004df000,0x1ffb);
    lstrcatW((LPWSTR)&DAT_004df000,u__Temp_0040a2a4);
    iVar4 = FUN_0040335e();
    if (iVar4 == 0) {
      GetTempPathW(0x1ffc,(LPWSTR)&DAT_004df000);
      lstrcatW((LPWSTR)&DAT_004df000,(LPCWSTR)&DAT_0040a29c);
      SetEnvironmentVariableW(u_TEMP_0040a290,(LPCWSTR)&DAT_004df000);
      SetEnvironmentVariableW((LPCWSTR)&PTR_DAT_0040a288,(LPCWSTR)&DAT_004df000);
      iVar4 = FUN_0040335e();
      if (iVar4 == 0) goto LAB_004036fe;
    }
  }
  DeleteFileW((LPCWSTR)&DAT_004db000);
  local_2d4 = FUN_00402edd(local_2c8);
  if (local_2d4 != (wchar_t *)0x0) goto LAB_004036fe;
  if (DAT_0047af00 != 0) {
    piVar9 = (int *)FUN_00405bbc(&DAT_004cb000,L'\0');
    if ((int *)0x4cafff < piVar9) {
      do {
        if ((*piVar9 == CONCAT22(DAT_0040a27e,DAT_0040a27c)) &&
           (piVar9[1] == (CONCAT22(DAT_0040a282,DAT_0040a280) | (int)DAT_0040a27e >> 0xf))) break;
        piVar9 = (int *)((int)piVar9 + -2);
      } while ((int *)0x4cafff < piVar9);
    }
    local_2d4 = u_Error_launching_installer_0040a1e8;
    if (piVar9 < &DAT_004cb000) {
      iVar4 = FUN_0040588b();
      lstrcatW((LPWSTR)&DAT_004df000,u__nsu_0040a270);
      if (iVar4 != 0) {
        lstrcatW((LPWSTR)&DAT_004df000,(LPCWSTR)&DAT_0040a26c);
      }
      lstrcatW((LPWSTR)&DAT_004df000,u__tmp_0040a260);
      iVar10 = lstrcmpiW((LPCWSTR)&DAT_004df000,(LPCWSTR)&DAT_004d7000);
      if (iVar10 != 0) {
        if (iVar4 == 0) {
          FUN_0040586e((LPCWSTR)&DAT_004df000);
        }
        else {
          FUN_004057f1((LPCWSTR)&DAT_004df000);
        }
        SetCurrentDirectoryW((LPCWSTR)&DAT_004df000);
        if (DAT_004cf000 == 0) {
          FUN_004062ba(&DAT_004cf000,(LPCWSTR)&DAT_004d7000);
        }
        FUN_004062ba((LPWSTR)&DAT_0047b000,pWStack_2cc);
        _DAT_0047f000 = CONCAT22(DAT_0040a25a,DAT_0040a258);
        iVar4 = 0x1a;
        do {
          FUN_004062dc((LPWSTR)&DAT_0043c208,*(int *)(DAT_0047aef4 + 0x120));
          DeleteFileW((LPCWSTR)&DAT_0043c208);
          if ((local_2d4 != (wchar_t *)0x0) &&
             (BVar12 = CopyFileW((LPCWSTR)&DAT_004e7000,(LPCWSTR)&DAT_0043c208,1), BVar12 != 0)) {
            FUN_00406080((LPCWSTR)&DAT_0043c208,(LPCWSTR)0x0);
            FUN_004062dc((LPWSTR)&DAT_0043c208,*(int *)(DAT_0047aef4 + 0x124));
            pvVar11 = FUN_004058a3((LPWSTR)&DAT_0043c208);
            if (pvVar11 != (HANDLE)0x0) {
              CloseHandle(pvVar11);
              local_2d4 = (wchar_t *)0x0;
            }
          }
          _DAT_0047f000 = _DAT_0047f000 + 1;
          iVar4 = iVar4 + -1;
        } while (iVar4 != 0);
        FUN_00406080((LPCWSTR)&DAT_004df000,(LPCWSTR)0x0);
      }
      goto LAB_004036fe;
    }
    *(undefined2 *)piVar9 = 0;
    pWVar7 = (LPCWSTR)(piVar9 + 2);
    bVar1 = FUN_00405c97(pWVar7);
    if (CONCAT31(extraout_var,bVar1) == 0) goto LAB_004036fe;
    FUN_004062ba(&DAT_004cf000,pWVar7);
    FUN_004062ba((LPWSTR)&DAT_004d3000,pWVar7);
    local_2d4 = (wchar_t *)0x0;
  }
  DAT_0047afac = -1;
  local_2d0 = FUN_004039aa();
LAB_004036fe:
  FUN_004038d0();
  OleUninitialize();
  if (local_2d4 == (wchar_t *)0x0) {
    if (DAT_0047af94 != 0) {
      TokenHandle = &pWStack_2cc;
      DVar2 = 0x28;
      pvVar11 = GetCurrentProcess();
      BVar12 = OpenProcessToken(pvVar11,DVar2,TokenHandle);
      if (BVar12 != 0) {
        LookupPrivilegeValueW
                  ((LPCWSTR)0x0,u_SeShutdownPrivilege_0040a230,&_Stack_2c4.Privileges[0].Luid);
        _Stack_2c4.PrivilegeCount = 1;
        _Stack_2c4.Privileges[0].Attributes = 2;
        AdjustTokenPrivileges(pWStack_2cc,0,&_Stack_2c4,0,(PTOKEN_PRIVILEGES)0x0,(PDWORD)0x0);
      }
      pFVar3 = FUN_00406694(4);
      if (((pFVar3 != (FARPROC)0x0) && (iVar4 = (*pFVar3)(0,0,0,0x25,0x80040002), iVar4 == 0)) ||
         (BVar12 = ExitWindowsEx(2,0x80040002), BVar12 == 0)) {
        FUN_0040140b(9);
      }
    }
    if (DAT_0047afac != -1) {
      local_2d0 = DAT_0047afac;
    }
                    /* WARNING: Subroutine does not return */
    ExitProcess(local_2d0);
  }
  FUN_00405920(local_2d4,0x200010);
                    /* WARNING: Subroutine does not return */
  ExitProcess(2);
}
Assembly · 410 instructions, 44 annotated
AddressBytesInstructionComment
0040338f81 ec d4 02 00 00SUB ESP,0x2d4
0040339553PUSH EBX
0040339656PUSH ESI
0040339757PUSH EDI
004033986a 20PUSH 0x20
0040339a5fPOP EDI
0040339b33 dbXOR EBX,EBX
0040339d68 01 80 00 00PUSH 0x8001
004033a289 5c 24 14MOV dword ptr [ESP + local_2d0],EBX
004033a6c7 44 24 10 e0 a2 40 00MOV dword ptr [ESP + local_2d4],u_Error_writing_temporary_file._Ma_0040a2e0; "Error writing temporary file. Make sure your temp folder is valid."
004033ae89 5c 24 1cMOV dword ptr [ESP + local_2c8],EBX
004033b2ff 15 a8 80 40 00CALL dword ptr [PTR_SetErrorMode_004080a8]
004033b8ff 15 a4 80 40 00CALL dword ptr [PTR_GetVersion_004080a4]
004033be25 ff ff ff bfAND EAX,0xbfffffff
004033c366 3d 06 00CMP AX,0x6
004033c7a3 ec ae 47 00MOV [DAT_0047aeec],EAX
004033cc74 11JZ LAB_004033df
004033ce53PUSH EBX
004033cfe8 c0 32 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
004033d43b c3CMP EAX,EBX
004033d674 07JZ LAB_004033df
004033d868 00 0c 00 00PUSH 0xc00
004033ddff d0CALL EAX
LAB_004033df:
004033dfbe b0 82 40 00MOV ESI,s_UXTHEME_004082b0; "UXTHEME"
LAB_004033e4:
004033e456PUSH ESI; "UXTHEME"
004033e5e8 3a 32 00 00CALL FUN_00406624; FUN_00406624: GetSystemDirectoryW, wsprintfW, LoadLibraryExW
004033ea56PUSH ESI; "UXTHEME"
004033ebff 15 50 81 40 00CALL dword ptr [PTR_lstrlenA_00408150]
004033f18d 74 06 01LEA ESI,[ESI + EAX*0x1 + 0x1]
004033f580 3e 00CMP byte ptr [ESI],0x0
004033f875 eaJNZ LAB_004033e4
004033fa6a 0aPUSH 0xa
004033fce8 93 32 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
004034016a 08PUSH 0x8
00403403e8 8c 32 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
004034086a 06PUSH 0x6
0040340aa3 e4 ae 47 00MOV [DAT_0047aee4],EAX
0040340fe8 80 32 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
004034143b c3CMP EAX,EBX
0040341674 0fJZ LAB_00403427
004034186a 1ePUSH 0x1e
0040341aff d0CALL EAX
0040341c85 c0TEST EAX,EAX
0040341e74 07JZ LAB_00403427
0040342080 0d ef ae 47 00 40OR byte ptr [DAT_0047aeec+3],0x40
LAB_00403427:
0040342755PUSH EBP
00403428ff 15 44 80 40 00CALL dword ptr [PTR_Ordinal_17_00408044]
0040342e53PUSH EBX
0040342fff 15 a0 82 40 00CALL dword ptr [PTR_OleInitialize_004082a0]
00403435a3 b8 af 47 00MOV [DAT_0047afb8],EAX
0040343a53PUSH EBX
0040343b8d 44 24 34LEA EAX,[ESP + 0x34]
0040343f68 b4 02 00 00PUSH 0x2b4
0040344450PUSH EAX
0040344553PUSH EBX
0040344668 08 02 44 00PUSH DAT_00440208
0040344bff 15 88 81 40 00CALL dword ptr [PTR_SHGetFileInfoW_00408188]
0040345168 c8 a2 40 00PUSH u_NSIS_Error_0040a2c8; "NSIS Error"
0040345668 e0 2e 47 00PUSH DAT_00472ee0
0040345be8 5a 2e 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
00403460ff 15 a0 80 40 00CALL dword ptr [PTR_GetCommandLineW_004080a0]
00403466bd 00 b0 4c 00MOV EBP,DAT_004cb000
0040346b50PUSH EAX
0040346c55PUSH EBP
0040346de8 48 2e 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
0040347266 83 3d 00 b0 4c 00 22CMP word ptr [DAT_004cb000],0x22
0040347ac7 05 e0 ae 47 00 00 00 …MOV dword ptr [DAT_0047aee0],IMAGE_DOS_HEADER_00400000
004034848b c5MOV EAX,EBP
0040348675 08JNZ LAB_00403490
004034886a 22PUSH 0x22
0040348ab8 02 b0 4c 00MOV EAX,DAT_004cb002
0040348f5fPOP EDI
LAB_00403490:
0040349057PUSH EDI
0040349150PUSH EAX
00403492e8 25 27 00 00CALL FUN_00405bbc; FUN_00405bbc: CharNextW
0040349750PUSH EAX
00403498ff 15 48 82 40 00CALL dword ptr [PTR_CharNextW_00408248]
0040349e8b c8MOV ECX,EAX
004034a089 4c 24 18MOV dword ptr [ESP + 0x18],ECX
004034a466 8b 01MOV AX,word ptr [ECX]
004034a766 3b c3CMP AX,BX
004034aa0f 84 11 01 00 00JZ LAB_004035c1
LAB_004034b0:
004034b06a 20PUSH 0x20
004034b25bPOP EBX
004034b366 3b c3CMP AX,BX
004034b675 07JNZ LAB_004034bf
LAB_004034b8:
004034b841INC ECX
004034b941INC ECX
004034ba66 39 19CMP word ptr [ECX],BX
004034bd74 f9JZ LAB_004034b8
LAB_004034bf:
004034bf66 83 39 22CMP word ptr [ECX],0x22
004034c375 05JNZ LAB_004034ca
004034c541INC ECX
004034c66a 22PUSH 0x22
004034c841INC ECX
004034c95bPOP EBX
LAB_004034ca:
004034ca66 83 39 2fCMP word ptr [ECX],0x2f
004034ce0f 85 b9 00 00 00JNZ LAB_0040358d
004034d441INC ECX
004034d541INC ECX
004034d666 83 39 53CMP word ptr [ECX],0x53
004034da75 19JNZ LAB_004034f5
004034dc66 8b 41 02MOV AX,word ptr [ECX + 0x2]
004034e066 3d 20 00CMP AX,0x20
004034e474 05JZ LAB_004034eb
004034e666 85 c0TEST AX,AX
004034e975 0aJNZ LAB_004034f5
LAB_004034eb:
004034ebc7 05 a0 af 47 00 01 00 …MOV dword ptr [DAT_0047afa0],0x1
LAB_004034f5:
004034f50f b7 05 c2 a2 40 00MOVZX EAX,word ptr [DAT_0040a2c2]
004034fc99CDQ
004034fd0f a4 c2 10SHLD EDX,EAX,0x10
00403501c1 e0 10SHL EAX,0x10
004035048b f8MOV EDI,EAX
0040350633 f6XOR ESI,ESI
004035080f b7 05 c0 a2 40 00MOVZX EAX,word ptr [DAT_0040a2c0]
0040350f99CDQ
004035100f b7 15 bc a2 40 00MOVZX EDX,word ptr [DAT_0040a2bc]
004035170b f8OR EDI,EAX
004035190f b7 05 be a2 40 00MOVZX EAX,word ptr [DAT_0040a2be]
00403520c1 e0 10SHL EAX,0x10
004035230b c2OR EAX,EDX
0040352599CDQ
004035260b f0OR ESI,EAX
004035288b 01MOV EAX,dword ptr [ECX]
0040352a0b faOR EDI,EDX
0040352c3b c6CMP EAX,ESI
0040352e75 1bJNZ LAB_0040354b
004035308b 41 04MOV EAX,dword ptr [ECX + 0x4]
004035333b c7CMP EAX,EDI
0040353575 14JNZ LAB_0040354b
0040353766 8b 41 08MOV AX,word ptr [ECX + 0x8]
0040353b66 3d 20 00CMP AX,0x20
0040353f74 05JZ LAB_00403546
0040354166 85 c0TEST AX,AX
0040354475 05JNZ LAB_0040354b
LAB_00403546:
0040354683 4c 24 1c 04OR dword ptr [ESP + 0x1c],0x4
LAB_0040354b:
0040354b0f b7 05 b6 a2 40 00MOVZX EAX,word ptr [DAT_0040a2b6]
0040355299CDQ
004035530f a4 c2 10SHLD EDX,EAX,0x10
00403557c1 e0 10SHL EAX,0x10
0040355a8b f8MOV EDI,EAX
0040355c33 f6XOR ESI,ESI
0040355e0f b7 05 b4 a2 40 00MOVZX EAX,word ptr [DAT_0040a2b4]
0040356599CDQ
004035660f b7 15 b0 a2 40 00MOVZX EDX,word ptr [DAT_0040a2b0]
0040356d0b f8OR EDI,EAX
0040356f0f b7 05 b2 a2 40 00MOVZX EAX,word ptr [DAT_0040a2b2]
00403576c1 e0 10SHL EAX,0x10
004035790b c2OR EAX,EDX
0040357b99CDQ
0040357c0b f0OR ESI,EAX
0040357e8b 41 fcMOV EAX,dword ptr [ECX + -0x4]
004035810b faOR EDI,EDX
004035833b c6CMP EAX,ESI
0040358575 06JNZ LAB_0040358d
004035878b 01MOV EAX,dword ptr [ECX]
004035893b c7CMP EAX,EDI
0040358b74 1fJZ LAB_004035ac
LAB_0040358d:
0040358d53PUSH EBX
0040358e51PUSH ECX
0040358fe8 28 26 00 00CALL FUN_00405bbc; FUN_00405bbc: CharNextW
004035948b c8MOV ECX,EAX
0040359666 83 39 22CMP word ptr [ECX],0x22
0040359a75 02JNZ LAB_0040359e
0040359c41INC ECX
0040359d41INC ECX
LAB_0040359e:
0040359e66 8b 01MOV AX,word ptr [ECX]
004035a166 85 c0TEST AX,AX
004035a40f 85 06 ff ff ffJNZ LAB_004034b0
004035aaeb 13JMP LAB_004035bf
LAB_004035ac:
004035ac66 83 61 fc 00AND word ptr [ECX + -0x4],0x0
004035b183 c1 04ADD ECX,0x4
004035b451PUSH ECX
004035b568 00 f0 4c 00PUSH DAT_004cf000
004035bae8 fb 2c 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
LAB_004035bf:
004035bf33 dbXOR EBX,EBX
LAB_004035c1:
004035c18b 35 9c 80 40 00MOV ESI,dword ptr [PTR_GetTempPathW_0040809c]
004035c7bf 00 f0 4d 00MOV EDI,DAT_004df000
004035cc57PUSH EDI
004035cd68 00 20 00 00PUSH 0x2000
004035d2ff d6CALL ESI
004035d4e8 85 fd ff ffCALL FUN_0040335e; FUN_0040335e: CharNextW, CharPrevW, CreateDirectoryW, GetLastError +2
004035d985 c0TEST EAX,EAX
004035db75 56JNZ LAB_00403633
004035dd68 fb 1f 00 00PUSH 0x1ffb
004035e257PUSH EDI
004035e3ff 15 98 80 40 00CALL dword ptr [PTR_GetWindowsDirectoryW_00408098]
004035e968 a4 a2 40 00PUSH u_\Temp_0040a2a4; "\\Temp"
004035ee57PUSH EDI
004035efe8 e2 2c 00 00CALL lstrcatW
004035f4e8 65 fd ff ffCALL FUN_0040335e; FUN_0040335e: CharNextW, CharPrevW, CreateDirectoryW, GetLastError +2
004035f985 c0TEST EAX,EAX
004035fb75 36JNZ LAB_00403633
004035fd57PUSH EDI
004035fe68 fc 1f 00 00PUSH 0x1ffc
00403603ff d6CALL ESI
0040360568 9c a2 40 00PUSH DAT_0040a29c
0040360a57PUSH EDI
0040360be8 c6 2c 00 00CALL lstrcatW
004036108b 35 70 80 40 00MOV ESI,dword ptr [PTR_SetEnvironmentVariableW_00408070]
0040361657PUSH EDI
0040361768 90 a2 40 00PUSH u_TEMP_0040a290; "TEMP"
0040361cff d6CALL ESI
0040361e57PUSH EDI
0040361f68 88 a2 40 00PUSH PTR_DAT_0040a288
00403624ff d6CALL ESI
00403626e8 33 fd ff ffCALL FUN_0040335e; FUN_0040335e: CharNextW, CharPrevW, CreateDirectoryW, GetLastError +2
0040362b85 c0TEST EAX,EAX
0040362d0f 84 cb 00 00 00JZ LAB_004036fe
LAB_00403633:
0040363368 00 b0 4d 00PUSH DAT_004db000
00403638ff 15 40 81 40 00CALL dword ptr [PTR_DeleteFileW_00408140]
0040363eff 74 24 1cPUSH dword ptr [ESP + 0x1c]
00403642e8 96 f8 ff ffCALL FUN_00402edd; FUN_00402edd: GetTickCount, GetModuleFileNameW, GetFileSize, GlobalAlloc +1
004036473b c3CMP EAX,EBX
0040364989 44 24 10MOV dword ptr [ESP + 0x10],EAX
0040364d0f 85 ab 00 00 00JNZ LAB_004036fe
0040365339 1d 00 af 47 00CMP dword ptr [DAT_0047af00],EBX
004036590f 84 8f 00 00 00JZ LAB_004036ee
0040365f53PUSH EBX
0040366055PUSH EBP
00403661e8 56 25 00 00CALL FUN_00405bbc; FUN_00405bbc: CharNextW
004036668b f0MOV ESI,EAX
004036683b f5CMP ESI,EBP
0040366a72 4cJC LAB_004036b8
0040366c0f b7 05 82 a2 40 00MOVZX EAX,word ptr [DAT_0040a282]
0040367399CDQ
004036740f a4 c2 10SHLD EDX,EAX,0x10
00403678c1 e0 10SHL EAX,0x10
0040367b8b d8MOV EBX,EAX
0040367d0f b7 05 80 a2 40 00MOVZX EAX,word ptr [DAT_0040a280]
004036840f b7 0d 7c a2 40 00MOVZX ECX,word ptr [DAT_0040a27c]
0040368b99CDQ
0040368c0b d8OR EBX,EAX
0040368e0f b7 05 7e a2 40 00MOVZX EAX,word ptr [DAT_0040a27e]
00403695c1 e0 10SHL EAX,0x10
004036980b c1OR EAX,ECX
0040369a33 c9XOR ECX,ECX
0040369c99CDQ
0040369d0b c8OR ECX,EAX
0040369f8b c3MOV EAX,EBX
004036a10b c2OR EAX,EDX
LAB_004036a3:
004036a38b 16MOV EDX,dword ptr [ESI]
004036a53b d1CMP EDX,ECX
004036a775 07JNZ LAB_004036b0
004036a98b 56 04MOV EDX,dword ptr [ESI + 0x4]
004036ac3b d0CMP EDX,EAX
004036ae74 06JZ LAB_004036b6
LAB_004036b0:
004036b04eDEC ESI
004036b14eDEC ESI
004036b23b f5CMP ESI,EBP
004036b473 edJNC LAB_004036a3
LAB_004036b6:
004036b633 dbXOR EBX,EBX
LAB_004036b8:
004036b83b f5CMP ESI,EBP
004036bac7 44 24 10 e8 a1 40 00MOV dword ptr [ESP + 0x10],u_Error_launching_installer_0040a1e8; "Error launching installer"
004036c272 66JC LAB_0040372a
004036c466 89 1eMOV word ptr [ESI],BX
004036c783 c6 08ADD ESI,0x8
004036ca56PUSH ESI
004036cbe8 c7 25 00 00CALL FUN_00405c97; FUN_00405c97: GetFileAttributesW
004036d085 c0TEST EAX,EAX
004036d274 2aJZ LAB_004036fe
004036d456PUSH ESI
004036d568 00 f0 4c 00PUSH DAT_004cf000
004036dae8 db 2b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
004036df56PUSH ESI
004036e068 00 30 4d 00PUSH DAT_004d3000
004036e5e8 d0 2b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
004036ea89 5c 24 10MOV dword ptr [ESP + 0x10],EBX
LAB_004036ee:
004036ee83 0d ac af 47 00 ffOR dword ptr [DAT_0047afac],0xffffffff
004036f5e8 b0 02 00 00CALL FUN_004039aa; FUN_004039aa: lstrcmpiW, GetFileAttributesW, LoadImageW, RegisterClassW +5
004036fa89 44 24 14MOV dword ptr [ESP + 0x14],EAX
LAB_004036fe:
004036fee8 cd 01 00 00CALL FUN_004038d0; FUN_004038d0: CloseHandle
00403703ff 15 9c 82 40 00CALL dword ptr [PTR_OleUninitialize_0040829c]
0040370939 5c 24 10CMP dword ptr [ESP + 0x10],EBX
0040370d5dPOP EBP
0040370e0f 84 20 01 00 00JZ LAB_00403834
0040371468 10 00 20 00PUSH 0x200010
00403719ff 74 24 10PUSH dword ptr [ESP + 0x10]
0040371de8 fe 21 00 00CALL FUN_00405920; FUN_00405920: MessageBoxIndirectW
004037226a 02PUSH 0x2
00403724ff 15 b8 80 40 00CALL dword ptr [PTR_ExitProcess_004080b8]
LAB_0040372a:
0040372ae8 5c 21 00 00CALL FUN_0040588b; FUN_0040588b: GetModuleHandleA, GetProcAddress
0040372f68 70 a2 40 00PUSH u_~nsu_0040a270; "~nsu"
0040373457PUSH EDI
004037358b f0MOV ESI,EAX
00403737e8 9a 2b 00 00CALL lstrcatW
0040373c3b f3CMP ESI,EBX
0040373e74 0bJZ LAB_0040374b
0040374068 6c a2 40 00PUSH DAT_0040a26c
0040374557PUSH EDI
00403746e8 8b 2b 00 00CALL lstrcatW
LAB_0040374b:
0040374b68 60 a2 40 00PUSH u_.tmp_0040a260; ".tmp"
0040375057PUSH EDI
00403751e8 80 2b 00 00CALL lstrcatW
00403756bd 00 70 4d 00MOV EBP,DAT_004d7000
0040375b55PUSH EBP
0040375c57PUSH EDI
0040375dff 15 04 81 40 00CALL dword ptr [PTR_lstrcmpiW_00408104]
0040376385 c0TEST EAX,EAX
0040376574 97JZ LAB_004036fe
004037673b f3CMP ESI,EBX
0040376957PUSH EDI
0040376a74 07JZ LAB_00403773
0040376ce8 80 20 00 00CALL FUN_004057f1; FUN_004057f1: CreateDirectoryW, GetLastError, SetFileSecurityW
00403771eb 05JMP LAB_00403778
LAB_00403773:
00403773e8 f6 20 00 00CALL FUN_0040586e; FUN_0040586e: CreateDirectoryW, GetLastError
LAB_00403778:
0040377857PUSH EDI
00403779ff 15 90 80 40 00CALL dword ptr [PTR_SetCurrentDirectoryW_00408090]
0040377f66 39 1d 00 f0 4c 00CMP word ptr [DAT_004cf000],BX
0040378675 0bJNZ LAB_00403793
0040378855PUSH EBP
0040378968 00 f0 4c 00PUSH DAT_004cf000
0040378ee8 27 2b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
LAB_00403793:
00403793ff 74 24 18PUSH dword ptr [ESP + 0x18]
0040379768 00 b0 47 00PUSH DAT_0047b000
0040379ce8 19 2b 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
004037a10f b7 05 5a a2 40 00MOVZX EAX,word ptr [DAT_0040a25a]
004037a80f b7 0d 58 a2 40 00MOVZX ECX,word ptr [DAT_0040a258]
004037afc1 e0 10SHL EAX,0x10
004037b20b c1OR EAX,ECX
004037b46a 1aPUSH 0x1a
004037b6a3 00 f0 47 00MOV [DAT_0047f000],EAX
004037bb5dPOP EBP
004037bcbe 08 c2 43 00MOV ESI,DAT_0043c208
LAB_004037c1:
004037c1a1 f4 ae 47 00MOV EAX,[DAT_0047aef4]
004037c6ff b0 20 01 00 00PUSH dword ptr [EAX + 0x120]
004037cc56PUSH ESI
004037cde8 0a 2b 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004037d256PUSH ESI
004037d3ff 15 40 81 40 00CALL dword ptr [PTR_DeleteFileW_00408140]
004037d939 5c 24 10CMP dword ptr [ESP + 0x10],EBX
004037dd74 3fJZ LAB_0040381e
004037df6a 01PUSH 0x1
004037e156PUSH ESI
004037e268 00 70 4e 00PUSH DAT_004e7000
004037e7ff 15 8c 80 40 00CALL dword ptr [PTR_CopyFileW_0040808c]
004037ed85 c0TEST EAX,EAX
004037ef74 2dJZ LAB_0040381e
004037f153PUSH EBX
004037f256PUSH ESI
004037f3e8 88 28 00 00CALL FUN_00406080; FUN_00406080: MoveFileExW
004037f8a1 f4 ae 47 00MOV EAX,[DAT_0047aef4]
004037fdff b0 24 01 00 00PUSH dword ptr [EAX + 0x124]
0040380356PUSH ESI
00403804e8 d3 2a 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
0040380956PUSH ESI
0040380ae8 94 20 00 00CALL FUN_004058a3; FUN_004058a3: CreateProcessW, CloseHandle
0040380f3b c3CMP EAX,EBX
0040381174 0bJZ LAB_0040381e
0040381350PUSH EAX
00403814ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
0040381a89 5c 24 10MOV dword ptr [ESP + 0x10],EBX
LAB_0040381e:
0040381e66 ff 05 00 f0 47 00INC word ptr [DAT_0047f000]
004038254dDEC EBP
0040382675 99JNZ LAB_004037c1
0040382853PUSH EBX
0040382957PUSH EDI
0040382ae8 51 28 00 00CALL FUN_00406080; FUN_00406080: MoveFileExW
0040382fe9 ca fe ff ffJMP LAB_004036fe
LAB_00403834:
0040383439 1d 94 af 47 00CMP dword ptr [DAT_0047af94],EBX
0040383a74 7cJZ LAB_004038b8
0040383c8d 44 24 14LEA EAX,[ESP + 0x14]
0040384050PUSH EAX
004038416a 28PUSH 0x28
00403843ff 15 88 80 40 00CALL dword ptr [PTR_GetCurrentProcess_00408088]
0040384950PUSH EAX
0040384aff 15 10 80 40 00CALL dword ptr [PTR_OpenProcessToken_00408010]
0040385085 c0TEST EAX,EAX
0040385274 34JZ LAB_00403888
004038548d 44 24 20LEA EAX,[ESP + 0x20]
0040385850PUSH EAX
0040385968 30 a2 40 00PUSH u_SeShutdownPrivilege_0040a230; "SeShutdownPrivilege"
0040385e53PUSH EBX
0040385fff 15 14 80 40 00CALL dword ptr [PTR_LookupPrivilegeValueW_00408014]
0040386553PUSH EBX
0040386653PUSH EBX
004038678d 44 24 24LEA EAX,[ESP + 0x24]
0040386b53PUSH EBX
0040386c50PUSH EAX
0040386d53PUSH EBX
0040386eff 74 24 28PUSH dword ptr [ESP + 0x28]
00403872c7 44 24 34 01 00 00 00MOV dword ptr [ESP + 0x34],0x1
0040387ac7 44 24 40 02 00 00 00MOV dword ptr [ESP + 0x40],0x2
00403882ff 15 00 80 40 00CALL dword ptr [PTR_AdjustTokenPrivileges_00408000]
LAB_00403888:
004038886a 04PUSH 0x4
0040388ae8 05 2e 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
0040388f3b c3CMP EAX,EBX
00403891be 02 00 04 80MOV ESI,0x80040002
0040389674 0cJZ LAB_004038a4
0040389856PUSH ESI
004038996a 25PUSH 0x25
0040389b53PUSH EBX
0040389c53PUSH EBX
0040389d53PUSH EBX
0040389eff d0CALL EAX
004038a085 c0TEST EAX,EAX
004038a274 0dJZ LAB_004038b1
LAB_004038a4:
004038a456PUSH ESI
004038a56a 02PUSH 0x2
004038a7ff 15 4c 82 40 00CALL dword ptr [PTR_ExitWindowsEx_0040824c]
004038ad85 c0TEST EAX,EAX
004038af75 07JNZ LAB_004038b8
LAB_004038b1:
004038b16a 09PUSH 0x9
004038b3e8 53 db ff ffCALL FUN_0040140b; FUN_0040140b: MulDiv, SendMessageW
LAB_004038b8:
004038b8a1 ac af 47 00MOV EAX,[DAT_0047afac]
004038bd83 f8 ffCMP EAX,-0x1
004038c074 04JZ LAB_004038c6
004038c289 44 24 10MOV dword ptr [ESP + 0x10],EAX
LAB_004038c6:
004038c6ff 74 24 10PUSH dword ptr [ESP + 0x10]
004038caff 15 b8 80 40 00CALL dword ptr [PTR_ExitProcess_004080b8]

installer UI creation

0x4039aa726 bytes
INT_PTR FUN_004039aa(void)

installer UI creation: registers window class, creates dialog, shows installer window, calls path resolver

Cited as
E12
Behaviours
B12
Called from
entry
Calls
GetFileAttributesW lstrcmpiW RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW ShowWindow FUN_0040140b, FUN_004038fa, FUN_00403c80, FUN_004053f5, FUN_00405b8f, FUN_00405bbc, FUN_00405bdb, FUN_00405c97, FUN_00406188, FUN_00406201, FUN_004062ba, lstrlenW, lstrcatW, FUN_004062dc, FUN_00406624, FUN_00406694
Decompiled C · 126 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

INT_PTR FUN_004039aa(void)

{
  bool bVar1;
  ATOM AVar2;
  FARPROC pFVar3;
  uint uVar4;
  undefined3 extraout_var;
  undefined2 *puVar5;
  int iVar6;
  DWORD DVar7;
  LPCWSTR pWVar8;
  undefined3 extraout_var_00;
  int iVar9;
  BOOL BVar10;
  INT_PTR IVar11;
  short *lpString;
  int iStack_10;
  int iStack_c;
  int iStack_8;
  int iStack_4;
  
  iVar9 = DAT_0047aef4;
  pFVar3 = FUN_00406694(2);
  if (pFVar3 == (FARPROC)0x0) {
    _DAT_004db000 = 0x30;
    _DAT_004db002 = 0x78;
    _DAT_004db004 = 0;
    FUN_00406188(0x80000001,L"Control Panel\\Desktop\\ResourceLocale",(LPCWSTR)0x0,
                 (LPBYTE)&DAT_00450248,(HKEY)0x0);
    if (DAT_00450248 == 0) {
      FUN_00406188(0x80000003,L".DEFAULT\\Control Panel\\International",L"Locale",
                   (LPBYTE)&DAT_00450248,(HKEY)0x0);
    }
    lstrcatW((LPWSTR)&DAT_004db000,&DAT_00450248);
  }
  else {
    uVar4 = (*pFVar3)();
    FUN_00406201((LPWSTR)&DAT_004db000,uVar4 & 0xffff);
  }
  FUN_00403c80();
  DAT_0047af80 = DAT_0047aefc & 0x20;
  _DAT_0047af9c = 0x10000;
  bVar1 = FUN_00405c97(&DAT_004cf000);
  if ((CONCAT31(extraout_var,bVar1) == 0) && (*(int *)(iVar9 + 0x48) != 0)) {
    lpString = &DAT_0046ae80;
    FUN_00406188(*(uint *)(iVar9 + 0x44),(LPCWSTR)(DAT_0047af38 + *(int *)(iVar9 + 0x48) * 2),
                 (LPCWSTR)(DAT_0047af38 + *(int *)(iVar9 + 0x4c) * 2),(LPBYTE)&DAT_0046ae80,
                 (HKEY)0x0);
    if (DAT_0046ae80 != 0) {
      if (DAT_0046ae80 == 0x22) {
        lpString = (short *)&DAT_0046ae82;
        puVar5 = (undefined2 *)FUN_00405bbc((LPCWSTR)&DAT_0046ae82,L'\"');
        *puVar5 = 0;
      }
      iVar6 = lstrlenW(lpString);
      if (((lpString < lpString + iVar6 + -4) &&
          (iVar6 = lstrcmpiW(lpString + iVar6 + -4,u__exe_0040a388), iVar6 == 0)) &&
         ((DVar7 = GetFileAttributesW(lpString), DVar7 == 0xffffffff || ((DVar7 & 0x10) == 0)))) {
        FUN_00405bdb(lpString);
      }
      pWVar8 = FUN_00405b8f(lpString);
      FUN_004062ba(&DAT_004cf000,pWVar8);
    }
  }
  bVar1 = FUN_00405c97(&DAT_004cf000);
  if (CONCAT31(extraout_var_00,bVar1) == 0) {
    FUN_004062dc(&DAT_004cf000,*(int *)(iVar9 + 0x118));
  }
  DAT_00472ec8 = LoadImageW(DAT_0047aee0,(LPCWSTR)0x67,1,0,0,0x8040);
  if (*(int *)(iVar9 + 0x50) == -1) {
LAB_00403ba7:
    iVar9 = FUN_0040140b(0);
    if (iVar9 == 0) {
      FUN_00403c80();
      if (DAT_0047afa0 == 0) {
        ShowWindow(DAT_00450228,5);
        iVar9 = FUN_00406624("RichEd20");
        if (iVar9 == 0) {
          FUN_00406624("RichEd32");
        }
        BVar10 = GetClassInfoW((HINSTANCE)0x0,L"RichEdit20W",(LPWNDCLASSW)&DAT_00472e80);
        if (BVar10 == 0) {
          GetClassInfoW((HINSTANCE)0x0,L"RichEdit",(LPWNDCLASSW)&DAT_00472e80);
          _DAT_00472ea4 = (undefined **)0x408318;
          RegisterClassW((WNDCLASSW *)&DAT_00472e80);
        }
        IVar11 = DialogBoxParamW(DAT_0047aee0,(LPCWSTR)(DAT_00472ec0 + 0x69U & 0xffff),(HWND)0x0,
                                 (DLGPROC)&LAB_00403d58,0);
        FUN_0040140b(5);
        FUN_004038fa(1);
        return IVar11;
      }
      iVar9 = FUN_004053f5((HWND)0x0);
      if (iVar9 == 0) {
        FUN_0040140b(1);
        goto LAB_00403c76;
      }
      if (DAT_00472eac == 0) {
        FUN_0040140b(2);
      }
    }
    IVar11 = 2;
  }
  else {
    _DAT_00472e84 = FUN_00401000;
    _DAT_00472e90 = DAT_0047aee0;
    _DAT_00472ea4 = &PTR_DAT_0040a380;
    _DAT_00472e94 = DAT_00472ec8;
    AVar2 = RegisterClassW((WNDCLASSW *)&DAT_00472e80);
    if (AVar2 != 0) {
      SystemParametersInfoW(0x30,0,&iStack_10,0);
      DAT_00450228 = CreateWindowExW(0x80,(LPCWSTR)&PTR_DAT_0040a380,(LPCWSTR)0x0,0x80000000,
                                     iStack_10,iStack_c,iStack_8 - iStack_10,iStack_4 - iStack_c,
                                     (HWND)0x0,(HMENU)0x0,DAT_0047aee0,(LPVOID)0x0);
      goto LAB_00403ba7;
    }
LAB_00403c76:
    IVar11 = 0;
  }
  return IVar11;
}
Assembly · 215 instructions, 29 annotated
AddressBytesInstructionComment
004039aa83 ec 10SUB ESP,0x10
004039ad53PUSH EBX
004039ae55PUSH EBP
004039af56PUSH ESI
004039b08b 35 f4 ae 47 00MOV ESI,dword ptr [DAT_0047aef4]
004039b657PUSH EDI
004039b76a 02PUSH 0x2
004039b9e8 d6 2c 00 00CALL FUN_00406694; FUN_00406694: GetModuleHandleA, GetProcAddress
004039be33 ffXOR EDI,EDI
004039c03b c7CMP EAX,EDI
004039c274 12JZ LAB_004039d6
004039c4ff d0CALL EAX
004039c60f b7 c0MOVZX EAX,AX
004039c950PUSH EAX
004039ca68 00 b0 4d 00PUSH DAT_004db000
004039cfe8 2d 28 00 00CALL FUN_00406201; FUN_00406201: wsprintfW
004039d4eb 5aJMP LAB_00403a30
LAB_004039d6:
004039d6bb 48 02 45 00MOV EBX,DAT_00450248
004039db57PUSH EDI
004039dc53PUSH EBX
004039dd57PUSH EDI
004039de68 98 83 40 00PUSH u_Control_Panel\Desktop\ResourceLo_00408398; "Control Panel\\Desktop\\ResourceLocale"
004039e368 01 00 00 80PUSH 0x80000001
004039e866 c7 05 00 b0 4d 00 30 …MOV word ptr [DAT_004db000],0x30
004039f166 c7 05 02 b0 4d 00 78 …MOV word ptr [DAT_004db002],0x78
004039fa66 89 3d 04 b0 4d 00MOV word ptr [DAT_004db004],DI
00403a01e8 82 27 00 00CALL FUN_00406188; FUN_00406188: RegQueryValueExW, RegCloseKey
00403a0666 39 3d 48 02 45 00CMP word ptr [DAT_00450248],DI
00403a0d75 16JNZ LAB_00403a25
00403a0f57PUSH EDI
00403a1053PUSH EBX
00403a1168 d4 83 40 00PUSH u_Locale_00408398+0x3c
00403a1668 48 83 40 00PUSH u_.DEFAULT\Control_Panel\Internati_00408348; ".DEFAULT\\Control Panel\\International"
00403a1b68 03 00 00 80PUSH 0x80000003
00403a20e8 63 27 00 00CALL FUN_00406188; FUN_00406188: RegQueryValueExW, RegCloseKey
LAB_00403a25:
00403a2553PUSH EBX
00403a2668 00 b0 4d 00PUSH DAT_004db000
00403a2be8 a6 28 00 00CALL lstrcatW
LAB_00403a30:
00403a30e8 4b 02 00 00CALL FUN_00403c80; FUN_00403c80: wsprintfW, SetWindowTextW, GetSystemDirectoryW, GetWindowsDirectoryW +3
00403a35a1 fc ae 47 00MOV EAX,[DAT_0047aefc]
00403a3abd 00 f0 4c 00MOV EBP,DAT_004cf000
00403a3f83 e0 20AND EAX,0x20
00403a4255PUSH EBP
00403a43a3 80 af 47 00MOV [DAT_0047af80],EAX
00403a48c7 05 9c af 47 00 00 00 …MOV dword ptr [DAT_0047af9c],0x10000
00403a52e8 40 22 00 00CALL FUN_00405c97; FUN_00405c97: GetFileAttributesW
00403a5785 c0TEST EAX,EAX
00403a590f 85 8c 00 00 00JNZ LAB_00403aeb
00403a5f8b 4e 48MOV ECX,dword ptr [ESI + 0x48]
00403a623b cfCMP ECX,EDI
00403a640f 84 81 00 00 00JZ LAB_00403aeb
00403a6a8b 56 4cMOV EDX,dword ptr [ESI + 0x4c]
00403a6da1 38 af 47 00MOV EAX,[DAT_0047af38]
00403a72bb 80 ae 46 00MOV EBX,DAT_0046ae80
00403a7757PUSH EDI
00403a788d 14 50LEA EDX,[EAX + EDX*0x2]
00403a7b53PUSH EBX
00403a7c8d 04 48LEA EAX,[EAX + ECX*0x2]
00403a7f52PUSH EDX
00403a8050PUSH EAX
00403a81ff 76 44PUSH dword ptr [ESI + 0x44]
00403a84e8 ff 26 00 00CALL FUN_00406188; FUN_00406188: RegQueryValueExW, RegCloseKey
00403a8966 a1 80 ae 46 00MOV AX,[DAT_0046ae80]
00403a8f66 3b c7CMP AX,DI
00403a9274 57JZ LAB_00403aeb
00403a9466 3d 22 00CMP AX,0x22
00403a9875 10JNZ LAB_00403aaa
00403a9abb 82 ae 46 00MOV EBX,DAT_0046ae82
00403a9f6a 22PUSH 0x22
00403aa153PUSH EBX
00403aa2e8 15 21 00 00CALL FUN_00405bbc; FUN_00405bbc: CharNextW
00403aa766 89 38MOV word ptr [EAX],DI
LAB_00403aaa:
00403aaa53PUSH EBX
00403aabe8 20 28 00 00CALL lstrlenW
00403ab08d 44 43 f8LEA EAX,[EBX + EAX*0x2 + -0x8]
00403ab43b c3CMP EAX,EBX
00403ab676 26JBE LAB_00403ade
00403ab868 88 a3 40 00PUSH u_.exe_0040a388; ".exe"
00403abd50PUSH EAX
00403abeff 15 04 81 40 00CALL dword ptr [PTR_lstrcmpiW_00408104]
00403ac485 c0TEST EAX,EAX
00403ac675 16JNZ LAB_00403ade
00403ac853PUSH EBX
00403ac9ff 15 94 80 40 00CALL dword ptr [PTR_GetFileAttributesW_00408094]
00403acf83 f8 ffCMP EAX,-0x1
00403ad274 04JZ LAB_00403ad8
00403ad4a8 10TEST AL,0x10
00403ad675 06JNZ LAB_00403ade
LAB_00403ad8:
00403ad853PUSH EBX
00403ad9e8 fd 20 00 00CALL FUN_00405bdb; FUN_00405bdb: CharPrevW
LAB_00403ade:
00403ade53PUSH EBX
00403adfe8 ab 20 00 00CALL FUN_00405b8f; FUN_00405b8f: CharPrevW
00403ae450PUSH EAX
00403ae555PUSH EBP
00403ae6e8 cf 27 00 00CALL FUN_004062ba; FUN_004062ba: lstrcpynW
LAB_00403aeb:
00403aeb55PUSH EBP
00403aece8 a6 21 00 00CALL FUN_00405c97; FUN_00405c97: GetFileAttributesW
00403af185 c0TEST EAX,EAX
00403af375 0cJNZ LAB_00403b01
00403af5ff b6 18 01 00 00PUSH dword ptr [ESI + 0x118]
00403afb55PUSH EBP
00403afce8 db 27 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
LAB_00403b01:
00403b0168 40 80 00 00PUSH 0x8040
00403b0657PUSH EDI
00403b0757PUSH EDI
00403b086a 01PUSH 0x1
00403b0a6a 67PUSH 0x67
00403b0cff 35 e0 ae 47 00PUSH dword ptr [DAT_0047aee0]
00403b12ff 15 60 82 40 00CALL dword ptr [PTR_LoadImageW_00408260]
00403b18a3 c8 2e 47 00MOV [DAT_00472ec8],EAX
00403b1d83 7e 50 ffCMP dword ptr [ESI + 0x50],-0x1
00403b21bb 80 2e 47 00MOV EBX,DAT_00472e80
00403b2674 7fJZ LAB_00403ba7
00403b288b 0d e0 ae 47 00MOV ECX,dword ptr [DAT_0047aee0]
00403b2ebe 80 a3 40 00MOV ESI,PTR_DAT_0040a380
00403b3353PUSH EBX
00403b34c7 05 84 2e 47 00 00 10 …MOV dword ptr [DAT_00472e84],FUN_00401000
00403b3e89 0d 90 2e 47 00MOV dword ptr [DAT_00472e90],ECX
00403b44a3 94 2e 47 00MOV [DAT_00472e94],EAX
00403b4989 35 a4 2e 47 00MOV dword ptr [DAT_00472ea4],ESI
00403b4fff 15 34 82 40 00CALL dword ptr [PTR_RegisterClassW_00408234]
00403b5566 85 c0TEST AX,AX
00403b580f 84 18 01 00 00JZ LAB_00403c76
00403b5e8d 44 24 10LEA EAX,[ESP + 0x10]
00403b6257PUSH EDI
00403b6350PUSH EAX
00403b6457PUSH EDI
00403b656a 30PUSH 0x30
00403b67ff 15 38 82 40 00CALL dword ptr [PTR_SystemParametersInfoW_00408238]
00403b6d57PUSH EDI
00403b6eff 35 e0 ae 47 00PUSH dword ptr [DAT_0047aee0]
00403b748b 44 24 24MOV EAX,dword ptr [ESP + 0x24]
00403b782b 44 24 1cSUB EAX,dword ptr [ESP + 0x1c]
00403b7c57PUSH EDI
00403b7d57PUSH EDI
00403b7e50PUSH EAX
00403b7f8b 44 24 2cMOV EAX,dword ptr [ESP + 0x2c]
00403b832b 44 24 24SUB EAX,dword ptr [ESP + 0x24]
00403b8750PUSH EAX
00403b88ff 74 24 2cPUSH dword ptr [ESP + 0x2c]
00403b8cff 74 24 2cPUSH dword ptr [ESP + 0x2c]
00403b9068 00 00 00 80PUSH 0x80000000
00403b9557PUSH EDI
00403b9656PUSH ESI
00403b9768 80 00 00 00PUSH 0x80
00403b9cff 15 3c 82 40 00CALL dword ptr [PTR_CreateWindowExW_0040823c]
00403ba2a3 28 02 45 00MOV [DAT_00450228],EAX
LAB_00403ba7:
00403ba757PUSH EDI
00403ba8e8 5e d8 ff ffCALL FUN_0040140b; FUN_0040140b: MulDiv, SendMessageW
00403bad85 c0TEST EAX,EAX
00403baf74 08JZ LAB_00403bb9
LAB_00403bb1:
00403bb16a 02PUSH 0x2
00403bb358POP EAX
00403bb4e9 bf 00 00 00JMP LAB_00403c78
LAB_00403bb9:
00403bb9e8 c2 00 00 00CALL FUN_00403c80; FUN_00403c80: wsprintfW, SetWindowTextW, GetSystemDirectoryW, GetWindowsDirectoryW +3
00403bbe39 3d a0 af 47 00CMP dword ptr [DAT_0047afa0],EDI
00403bc40f 85 83 00 00 00JNZ LAB_00403c4d
00403bca6a 05PUSH 0x5
00403bccff 35 28 02 45 00PUSH dword ptr [DAT_00450228]
00403bd2ff 15 68 82 40 00CALL dword ptr [PTR_ShowWindow_00408268]
00403bd868 3c 83 40 00PUSH s_RichEd20_0040833c; "RichEd20"
00403bdde8 42 2a 00 00CALL FUN_00406624; FUN_00406624: GetSystemDirectoryW, wsprintfW, LoadLibraryExW
00403be285 c0TEST EAX,EAX
00403be475 0aJNZ LAB_00403bf0
00403be668 30 83 40 00PUSH s_RichEd32_00408330; "RichEd32"
00403bebe8 34 2a 00 00CALL FUN_00406624; FUN_00406624: GetSystemDirectoryW, wsprintfW, LoadLibraryExW
LAB_00403bf0:
00403bf08b 35 40 82 40 00MOV ESI,dword ptr [PTR_GetClassInfoW_00408240]
00403bf6bd 18 83 40 00MOV EBP,u_RichEdit20W_00408318; "RichEdit20W"
00403bfb53PUSH EBX
00403bfc55PUSH EBP; "RichEdit20W"
00403bfd57PUSH EDI
00403bfeff d6CALL ESI
00403c0085 c0TEST EAX,EAX
00403c0275 16JNZ LAB_00403c1a
00403c0453PUSH EBX
00403c0568 04 83 40 00PUSH u_RichEdit_00408304; "RichEdit"
00403c0a57PUSH EDI
00403c0bff d6CALL ESI
00403c0d53PUSH EBX
00403c0e89 2d a4 2e 47 00MOV dword ptr [DAT_00472ea4],EBP
00403c14ff 15 34 82 40 00CALL dword ptr [PTR_RegisterClassW_00408234]
LAB_00403c1a:
00403c1aa1 c0 2e 47 00MOV EAX,[DAT_00472ec0]
00403c1f57PUSH EDI
00403c2083 c0 69ADD EAX,0x69
00403c2368 58 3d 40 00PUSH LAB_00403d58
00403c280f b7 c0MOVZX EAX,AX
00403c2b57PUSH EDI
00403c2c50PUSH EAX
00403c2dff 35 e0 ae 47 00PUSH dword ptr [DAT_0047aee0]
00403c33ff 15 44 82 40 00CALL dword ptr [PTR_DialogBoxParamW_00408244]
00403c396a 05PUSH 0x5
00403c3b8b f0MOV ESI,EAX
00403c3de8 c9 d7 ff ffCALL FUN_0040140b; FUN_0040140b: MulDiv, SendMessageW
00403c426a 01PUSH 0x1
00403c44e8 b1 fc ff ffCALL FUN_004038fa
00403c498b c6MOV EAX,ESI
00403c4beb 2bJMP LAB_00403c78
LAB_00403c4d:
00403c4d57PUSH EDI
00403c4ee8 a2 17 00 00CALL FUN_004053f5; FUN_004053f5: OleInitialize, OleUninitialize
00403c5385 c0TEST EAX,EAX
00403c5574 18JZ LAB_00403c6f
00403c5739 3d ac 2e 47 00CMP dword ptr [DAT_00472eac],EDI
00403c5d0f 85 4e ff ff ffJNZ LAB_00403bb1
00403c636a 02PUSH 0x2
00403c65e8 a1 d7 ff ffCALL FUN_0040140b; FUN_0040140b: MulDiv, SendMessageW
00403c6ae9 42 ff ff ffJMP LAB_00403bb1
LAB_00403c6f:
00403c6f6a 01PUSH 0x1
00403c71e8 95 d7 ff ffCALL FUN_0040140b; FUN_0040140b: MulDiv, SendMessageW
LAB_00403c76:
00403c7633 c0XOR EAX,EAX
LAB_00403c78:
00403c785fPOP EDI
00403c795ePOP ESI
00403c7a5dPOP EBP
00403c7b5bPOP EBX
00403c7c83 c4 10ADD ESP,0x10
00403c7fc3RET

NSIS installer page dialog

0x405461912 bytes
COLORREF FUN_00405461(HWND param_1, int param_2, HDC param_3, HWND param_4)

NSIS installer page dialog: handles WM_INITDIALOG with list view setup, creates a thread to run installer sections, manages progress

Cited as
E13
Behaviours
B13
Called from
none found
Calls
CreateThread CloseHandle GlobalLock GlobalUnlock GlobalAlloc CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetWindowRect GetDlgItem GetSystemMetrics SendMessageW GetClientRect ShowWindow TrackPopupMenu AppendMenuW CreatePopupMenu FUN_0040420a, FUN_00404231, FUN_00404266, FUN_00404298, FUN_00404bbf, FUN_00405322, FUN_004062dc
Decompiled C · 169 lines
COLORREF FUN_00405461(HWND param_1,int param_2,HDC param_3,HWND param_4)

{
  HWND pHVar1;
  HWND lpParameter;
  HANDLE hObject;
  HMENU hMenu;
  LPCWSTR lpNewItem;
  int iVar2;
  BOOL BVar3;
  LRESULT LVar4;
  HGLOBAL hMem;
  undefined2 *puVar5;
  COLORREF CVar6;
  int y;
  WPARAM wParam;
  int iVar7;
  DWORD dwCreationFlags;
  DWORD *lpThreadId;
  undefined1 local_44 [8];
  undefined4 local_3c;
  undefined4 local_38;
  int local_34;
  undefined2 *local_30;
  undefined4 local_2c;
  undefined4 local_28;
  undefined4 local_24;
  undefined4 uStack_20;
  tagRECT local_1c;
  DWORD local_c;
  HWND local_8;
  
  pHVar1 = DAT_00472ec4;
  wParam = 0;
  local_8 = DAT_00472ec4;
  if (param_2 == 0x110) {
    local_34 = 0xffffffff;
    local_28 = 0xffffffff;
    local_3c = 2;
    local_38 = 0;
    local_30 = (undefined2 *)0x0;
    local_2c = 0;
    local_24 = 0;
    uStack_20 = 0;
    iVar7 = *(int *)(DAT_0047aef4 + 0x5c);
    iVar2 = *(int *)(DAT_0047aef4 + 0x60);
    DAT_00472eb0 = GetDlgItem(param_1,0x403);
    DAT_00472ea8 = GetDlgItem(param_1,0x3ee);
    DAT_00472ec4 = GetDlgItem(param_1,0x3f8);
    local_8 = DAT_00472ec4;
    FUN_00404266((WPARAM)DAT_00472eb0);
    DAT_00472eb4 = FUN_00404bbf(4);
    DAT_00472ecc = 0;
    GetClientRect(local_8,&local_1c);
    local_34 = GetSystemMetrics(2);
    local_34 = local_1c.right - local_34;
    SendMessageW(local_8,0x1061,0,(LPARAM)&local_3c);
    SendMessageW(local_8,0x1036,0x4000,0x4000);
    if (-1 < iVar7) {
      SendMessageW(local_8,0x1001,0,iVar7);
      SendMessageW(local_8,0x1026,0,iVar7);
    }
    if (-1 < iVar2) {
      SendMessageW(local_8,0x1024,0,iVar2);
    }
    FUN_00404231(param_1,0x1b,param_4[0xc].unused);
    if (((byte)DAT_0047aefc & 3) != 0) {
      ShowWindow(DAT_00472eb0,0);
      if (((byte)DAT_0047aefc & 2) == 0) {
        ShowWindow(local_8,8);
      }
      else {
        DAT_00472eb0 = (HWND)0x0;
      }
      FUN_00404266((WPARAM)DAT_00472ea8);
    }
    pHVar1 = GetDlgItem(param_1,0x3ec);
    SendMessageW(pHVar1,0x401,0,0x75300000);
    if (((byte)DAT_0047aefc & 4) != 0) {
      SendMessageW(pHVar1,0x409,0,iVar2);
      SendMessageW(pHVar1,0x2001,0,iVar7);
    }
LAB_004057ea:
    CVar6 = 0;
  }
  else {
    if (param_2 == 0x405) {
      lpThreadId = &local_c;
      dwCreationFlags = 0;
      lpParameter = GetDlgItem(param_1,0x3ec);
      hObject = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,FUN_004053f5,lpParameter,dwCreationFlags,
                             lpThreadId);
      CloseHandle(hObject);
    }
    if (param_2 == 0x111) {
      if ((short)param_3 == 0x403) {
        ShowWindow(DAT_00472eb0,0);
        ShowWindow(pHVar1,8);
        FUN_00404266((WPARAM)pHVar1);
        goto LAB_00405667;
      }
    }
    else {
LAB_00405667:
      iVar7 = 1;
      if (param_2 == 0x404) {
        if (DAT_00472eac != 0) {
          DAT_00444218 = 2;
          FUN_0040420a(0x78);
          goto LAB_0040568c;
        }
        ShowWindow(DAT_0047aee8,8);
        if (DAT_0047af8c == 0) {
          FUN_00405322(*(int *)(DAT_00448220 + 0x34),(LPCWSTR)0x0);
        }
        FUN_0040420a(1);
      }
      if ((param_2 == 0x7b) && (param_3 == (HDC)local_8)) {
        pHVar1 = (HWND)SendMessageW(local_8,0x1004,0,0);
        if (0 < (int)pHVar1) {
          hMenu = CreatePopupMenu();
          lpNewItem = (LPCWSTR)FUN_004062dc((LPWSTR)0x0,-0x1f);
          AppendMenuW(hMenu,0,1,lpNewItem);
          iVar2 = (int)(short)param_4;
          y = (int)(short)((uint)param_4 >> 0x10);
          if (param_4 == (HWND)0xffffffff) {
            GetWindowRect(local_8,&local_1c);
            iVar2 = local_1c.left;
            y = local_1c.top;
          }
          BVar3 = TrackPopupMenu(hMenu,0x180,iVar2,y,0,param_1,(RECT *)0x0);
          if (BVar3 == 1) {
            local_3c = 0;
            local_30 = &DAT_00450248;
            local_2c = 0x8000;
            param_1 = pHVar1;
            do {
              param_1 = (HWND)((int)&param_1[-1].unused + 3);
              LVar4 = SendMessageW(local_8,0x1073,(WPARAM)param_1,(LPARAM)local_44);
              iVar7 = iVar7 + 2 + LVar4;
            } while (param_1 != (HWND)0x0);
            OpenClipboard((HWND)0x0);
            EmptyClipboard();
            hMem = GlobalAlloc(0x42,iVar7 * 2);
            puVar5 = GlobalLock(hMem);
            do {
              local_30 = puVar5;
              LVar4 = SendMessageW(local_8,0x1073,wParam,(LPARAM)local_44);
              puVar5 = puVar5 + LVar4;
              *puVar5 = 0xd;
              puVar5[1] = 10;
              puVar5 = puVar5 + 2;
              wParam = wParam + 1;
            } while ((int)wParam < (int)pHVar1);
            GlobalUnlock(hMem);
            SetClipboardData(0xd,hMem);
            CloseClipboard();
          }
        }
        goto LAB_004057ea;
      }
    }
LAB_0040568c:
    CVar6 = FUN_00404298(param_2,param_3,param_4);
  }
  return CVar6;
}
Assembly · 284 instructions, 9 annotated
AddressBytesInstructionComment
0040546155PUSH EBP
004054628b ecMOV EBP,ESP
0040546483 ec 40SUB ESP,0x40
0040546753PUSH EBX
0040546856PUSH ESI
004054698b 35 c4 2e 47 00MOV ESI,dword ptr [DAT_00472ec4]
0040546f33 dbXOR EBX,EBX
0040547181 7d 0c 10 01 00 00CMP dword ptr [EBP + param_2],0x110
0040547857PUSH EDI
0040547989 75 fcMOV dword ptr [EBP + local_8],ESI
0040547c0f 85 89 01 00 00JNZ LAB_0040560b
0040548283 4d d0 ffOR dword ptr [EBP + local_34],0xffffffff
0040548683 4d dc ffOR dword ptr [EBP + local_28],0xffffffff
0040548a6a 02PUSH 0x2
0040548c33 c0XOR EAX,EAX
0040548e5ePOP ESI
0040548f8d 7d e0LEA EDI,[EBP + -0x20]
0040549289 75 c8MOV dword ptr [EBP + local_3c],ESI
0040549589 5d ccMOV dword ptr [EBP + local_38],EBX
0040549889 5d d4MOV dword ptr [EBP + local_30],EBX
0040549b89 5d d8MOV dword ptr [EBP + local_2c],EBX
0040549eabSTOSD ES:EDI
0040549fabSTOSD ES:EDI
004054a0a1 f4 ae 47 00MOV EAX,[DAT_0047aef4]
004054a58b 3d e4 81 40 00MOV EDI,dword ptr [PTR_GetDlgItem_004081e4]
004054ab68 03 04 00 00PUSH 0x403
004054b08b 48 5cMOV ECX,dword ptr [EAX + 0x5c]
004054b38b 40 60MOV EAX,dword ptr [EAX + 0x60]
004054b6ff 75 08PUSH dword ptr [EBP + param_1]
004054b989 4d 0cMOV dword ptr [EBP + param_2],ECX
004054bc89 45 10MOV dword ptr [EBP + param_3],EAX
004054bfff d7CALL EDI
004054c168 ee 03 00 00PUSH 0x3ee
004054c6a3 b0 2e 47 00MOV [DAT_00472eb0],EAX
004054cbff 75 08PUSH dword ptr [EBP + param_1]
004054ceff d7CALL EDI
004054d068 f8 03 00 00PUSH 0x3f8
004054d5a3 a8 2e 47 00MOV [DAT_00472ea8],EAX
004054daff 75 08PUSH dword ptr [EBP + param_1]
004054ddff d7CALL EDI
004054dfff 35 b0 2e 47 00PUSH dword ptr [DAT_00472eb0]
004054e5a3 c4 2e 47 00MOV [DAT_00472ec4],EAX
004054ea89 45 fcMOV dword ptr [EBP + local_8],EAX
004054ede8 74 ed ff ffCALL FUN_00404266; FUN_00404266: SendMessageW
004054f26a 04PUSH 0x4
004054f4e8 c6 f6 ff ffCALL FUN_00404bbf
004054f9a3 b4 2e 47 00MOV [DAT_00472eb4],EAX
004054fe8d 45 e8LEA EAX,[EBP + -0x18]
0040550150PUSH EAX
0040550289 1d cc 2e 47 00MOV dword ptr [DAT_00472ecc],EBX
00405508ff 75 fcPUSH dword ptr [EBP + local_8]
0040550bff 15 24 82 40 00CALL dword ptr [PTR_GetClientRect_00408224]
0040551156PUSH ESI
00405512ff 15 e8 81 40 00CALL dword ptr [PTR_GetSystemMetrics_004081e8]
004055188b 4d f0MOV ECX,dword ptr [EBP + local_14]
0040551b8b 35 18 82 40 00MOV ESI,dword ptr [PTR_SendMessageW_00408218]
004055212b c8SUB ECX,EAX
004055238d 45 c8LEA EAX,[EBP + -0x38]
0040552650PUSH EAX
0040552753PUSH EBX
0040552868 61 10 00 00PUSH 0x1061
0040552d89 4d d0MOV dword ptr [EBP + local_34],ECX
00405530ff 75 fcPUSH dword ptr [EBP + local_8]
00405533ff d6CALL ESI
00405535b8 00 40 00 00MOV EAX,0x4000
0040553a50PUSH EAX
0040553b50PUSH EAX
0040553c68 36 10 00 00PUSH 0x1036
00405541ff 75 fcPUSH dword ptr [EBP + local_8]
00405544ff d6CALL ESI
0040554639 5d 0cCMP dword ptr [EBP + param_2],EBX
004055497c 1cJL LAB_00405567
0040554bff 75 0cPUSH dword ptr [EBP + param_2]
0040554e53PUSH EBX
0040554f68 01 10 00 00PUSH 0x1001
00405554ff 75 fcPUSH dword ptr [EBP + local_8]
00405557ff d6CALL ESI
00405559ff 75 0cPUSH dword ptr [EBP + param_2]
0040555c53PUSH EBX
0040555d68 26 10 00 00PUSH 0x1026
00405562ff 75 fcPUSH dword ptr [EBP + local_8]
00405565ff d6CALL ESI
LAB_00405567:
0040556739 5d 10CMP dword ptr [EBP + param_3],EBX
0040556a7c 0eJL LAB_0040557a
0040556cff 75 10PUSH dword ptr [EBP + param_3]
0040556f53PUSH EBX
0040557068 24 10 00 00PUSH 0x1024
00405575ff 75 fcPUSH dword ptr [EBP + local_8]
00405578ff d6CALL ESI
LAB_0040557a:
0040557a8b 45 14MOV EAX,dword ptr [EBP + param_4]
0040557dff 70 30PUSH dword ptr [EAX + 0x30]
004055806a 1bPUSH 0x1b
00405582ff 75 08PUSH dword ptr [EBP + param_1]
00405585e8 a7 ec ff ffCALL FUN_00404231; FUN_00404231: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +2
0040558af6 05 fc ae 47 00 03TEST byte ptr [DAT_0047aefc],0x3
0040559174 34JZ LAB_004055c7
0040559353PUSH EBX
00405594ff 35 b0 2e 47 00PUSH dword ptr [DAT_00472eb0]
0040559aff 15 68 82 40 00CALL dword ptr [PTR_ShowWindow_00408268]
004055a0f6 05 fc ae 47 00 02TEST byte ptr [DAT_0047aefc],0x2
004055a775 0dJNZ LAB_004055b6
004055a96a 08PUSH 0x8
004055abff 75 fcPUSH dword ptr [EBP + local_8]
004055aeff 15 68 82 40 00CALL dword ptr [PTR_ShowWindow_00408268]
004055b4eb 06JMP LAB_004055bc
LAB_004055b6:
004055b689 1d b0 2e 47 00MOV dword ptr [DAT_00472eb0],EBX
LAB_004055bc:
004055bcff 35 a8 2e 47 00PUSH dword ptr [DAT_00472ea8]
004055c2e8 9f ec ff ffCALL FUN_00404266; FUN_00404266: SendMessageW
LAB_004055c7:
004055c768 ec 03 00 00PUSH 0x3ec
004055ccff 75 08PUSH dword ptr [EBP + param_1]
004055cfff d7CALL EDI
004055d168 00 00 30 75PUSH 0x75300000
004055d68b f8MOV EDI,EAX
004055d853PUSH EBX
004055d968 01 04 00 00PUSH 0x401
004055de57PUSH EDI
004055dfff d6CALL ESI
004055e1f6 05 fc ae 47 00 04TEST byte ptr [DAT_0047aefc],0x4
004055e80f 84 fc 01 00 00JZ LAB_004057ea
004055eeff 75 10PUSH dword ptr [EBP + param_3]
004055f153PUSH EBX
004055f268 09 04 00 00PUSH 0x409
004055f757PUSH EDI
004055f8ff d6CALL ESI
004055faff 75 0cPUSH dword ptr [EBP + param_2]
004055fd53PUSH EBX
004055fe68 01 20 00 00PUSH 0x2001
0040560357PUSH EDI
00405604ff d6CALL ESI
00405606e9 df 01 00 00JMP LAB_004057ea
LAB_0040560b:
0040560b81 7d 0c 05 04 00 00CMP dword ptr [EBP + param_2],0x405
0040561275 28JNZ LAB_0040563c
004056148d 45 f8LEA EAX,[EBP + -0x8]
0040561750PUSH EAX
0040561853PUSH EBX
0040561968 ec 03 00 00PUSH 0x3ec
0040561eff 75 08PUSH dword ptr [EBP + param_1]
00405621ff 15 e4 81 40 00CALL dword ptr [PTR_GetDlgItem_004081e4]
0040562750PUSH EAX
0040562868 f5 53 40 00PUSH FUN_004053f5
0040562d53PUSH EBX
0040562e53PUSH EBX
0040562fff 15 c0 80 40 00CALL dword ptr [PTR_CreateThread_004080c0]
0040563550PUSH EAX
00405636ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
LAB_0040563c:
0040563c81 7d 0c 11 01 00 00CMP dword ptr [EBP + param_2],0x111
004056438b 3d 68 82 40 00MOV EDI,dword ptr [PTR_ShowWindow_00408268]
0040564975 1cJNZ LAB_00405667
0040564b66 81 7d 10 03 04CMP word ptr [EBP + param_3],0x403
0040565175 39JNZ LAB_0040568c
0040565353PUSH EBX
00405654ff 35 b0 2e 47 00PUSH dword ptr [DAT_00472eb0]
0040565aff d7CALL EDI
0040565c6a 08PUSH 0x8
0040565e56PUSH ESI
0040565fff d7CALL EDI
0040566156PUSH ESI
00405662e8 ff eb ff ffCALL FUN_00404266; FUN_00404266: SendMessageW
LAB_00405667:
0040566733 f6XOR ESI,ESI
0040566946INC ESI
0040566a81 7d 0c 04 04 00 00CMP dword ptr [EBP + param_2],0x404
0040567175 54JNZ LAB_004056c7
0040567339 1d ac 2e 47 00CMP dword ptr [DAT_00472eac],EBX
0040567974 26JZ LAB_004056a1
0040567b6a 78PUSH 0x78
0040567dc7 05 18 42 44 00 02 00 …MOV dword ptr [DAT_00444218],0x2
00405687e8 7e eb ff ffCALL FUN_0040420a; FUN_0040420a: SendMessageW
LAB_0040568c:
0040568cff 75 14PUSH dword ptr [EBP + param_4]
0040568fff 75 10PUSH dword ptr [EBP + param_3]
00405692ff 75 0cPUSH dword ptr [EBP + param_2]
00405695e8 fe eb ff ffCALL FUN_00404298; FUN_00404298: GetWindowLongW, GetSysColor, SetTextColor, SetBkMode +3
LAB_0040569a:
0040569a5fPOP EDI
0040569b5ePOP ESI
0040569c5bPOP EBX
0040569dc9LEAVE
0040569ec2 10 00RET 0x10
LAB_004056a1:
004056a16a 08PUSH 0x8
004056a3ff 35 e8 ae 47 00PUSH dword ptr [DAT_0047aee8]
004056a9ff d7CALL EDI
004056ab39 1d 8c af 47 00CMP dword ptr [DAT_0047af8c],EBX
004056b175 0eJNZ LAB_004056c1
004056b3a1 20 82 44 00MOV EAX,[DAT_00448220]
004056b853PUSH EBX
004056b9ff 70 34PUSH dword ptr [EAX + 0x34]
004056bce8 61 fc ff ffCALL FUN_00405322; FUN_00405322: SetWindowTextW, SendMessageW
LAB_004056c1:
004056c156PUSH ESI
004056c2e8 43 eb ff ffCALL FUN_0040420a; FUN_0040420a: SendMessageW
LAB_004056c7:
004056c783 7d 0c 7bCMP dword ptr [EBP + param_2],0x7b
004056cb75 bfJNZ LAB_0040568c
004056cd8b 45 fcMOV EAX,dword ptr [EBP + local_8]
004056d039 45 10CMP dword ptr [EBP + param_3],EAX
004056d375 b7JNZ LAB_0040568c
004056d553PUSH EBX
004056d653PUSH EBX
004056d768 04 10 00 00PUSH 0x1004
004056dc50PUSH EAX
004056ddff 15 18 82 40 00CALL dword ptr [PTR_SendMessageW_00408218]
004056e33b c3CMP EAX,EBX
004056e589 45 0cMOV dword ptr [EBP + param_2],EAX
004056e80f 8e fc 00 00 00JLE LAB_004057ea
004056eeff 15 80 82 40 00CALL dword ptr [PTR_CreatePopupMenu_00408280]
004056f46a e1PUSH -0x1f
004056f653PUSH EBX
004056f78b f8MOV EDI,EAX
004056f9e8 de 0b 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
004056fe50PUSH EAX
004056ff56PUSH ESI
0040570053PUSH EBX
0040570157PUSH EDI
00405702ff 15 7c 82 40 00CALL dword ptr [PTR_AppendMenuW_0040827c]
004057088b 4d 14MOV ECX,dword ptr [EBP + param_4]
0040570b0f bf 45 14MOVSX EAX,word ptr [EBP + param_4]
0040570fc1 e9 10SHR ECX,0x10
0040571283 7d 14 ffCMP dword ptr [EBP + param_4],-0x1
004057160f bf c9MOVSX ECX,CX
0040571975 13JNZ LAB_0040572e
0040571b8d 45 e8LEA EAX,[EBP + -0x18]
0040571e50PUSH EAX
0040571fff 75 fcPUSH dword ptr [EBP + local_8]
00405722ff 15 e0 81 40 00CALL dword ptr [PTR_GetWindowRect_004081e0]
004057288b 45 e8MOV EAX,dword ptr [EBP + local_1c]
0040572b8b 4d ecMOV ECX,dword ptr [EBP + local_18]
LAB_0040572e:
0040572e53PUSH EBX
0040572fff 75 08PUSH dword ptr [EBP + param_1]
0040573253PUSH EBX
0040573351PUSH ECX
0040573450PUSH EAX
0040573568 80 01 00 00PUSH 0x180
0040573a57PUSH EDI
0040573bff 15 78 82 40 00CALL dword ptr [PTR_TrackPopupMenu_00408278]
004057413b c6CMP EAX,ESI
004057430f 85 a1 00 00 00JNZ LAB_004057ea
004057498b 45 0cMOV EAX,dword ptr [EBP + param_2]
0040574c89 5d c8MOV dword ptr [EBP + local_3c],EBX
0040574fc7 45 d4 48 02 45 00MOV dword ptr [EBP + local_30],DAT_00450248
00405756c7 45 d8 00 80 00 00MOV dword ptr [EBP + local_2c],0x8000
0040575d89 45 08MOV dword ptr [EBP + param_1],EAX
00405760bf 73 10 00 00MOV EDI,0x1073
LAB_00405765:
00405765ff 4d 08DEC dword ptr [EBP + param_1]
004057688d 45 c0LEA EAX,[EBP + -0x40]
0040576b50PUSH EAX
0040576cff 75 08PUSH dword ptr [EBP + param_1]
0040576f57PUSH EDI
00405770ff 75 fcPUSH dword ptr [EBP + local_8]
00405773ff 15 18 82 40 00CALL dword ptr [PTR_SendMessageW_00408218]
0040577939 5d 08CMP dword ptr [EBP + param_1],EBX
0040577c8d 74 06 02LEA ESI,[ESI + EAX*0x1 + 0x2]
0040578075 e3JNZ LAB_00405765
0040578253PUSH EBX
00405783ff 15 d8 81 40 00CALL dword ptr [PTR_OpenClipboard_004081d8]
00405789ff 15 d4 81 40 00CALL dword ptr [PTR_EmptyClipboard_004081d4]
0040578f8d 04 36LEA EAX,[ESI + ESI*0x1]
0040579250PUSH EAX
004057936a 42PUSH 0x42
00405795ff 15 34 81 40 00CALL dword ptr [PTR_GlobalAlloc_00408134]
0040579b50PUSH EAX
0040579c89 45 08MOV dword ptr [EBP + param_1],EAX
0040579fff 15 2c 81 40 00CALL dword ptr [PTR_GlobalLock_0040812c]
004057a58b f0MOV ESI,EAX
LAB_004057a7:
004057a78d 45 c0LEA EAX,[EBP + -0x40]
004057aa89 75 d4MOV dword ptr [EBP + local_30],ESI
004057ad50PUSH EAX
004057ae53PUSH EBX
004057af57PUSH EDI
004057b0ff 75 fcPUSH dword ptr [EBP + local_8]
004057b3ff 15 18 82 40 00CALL dword ptr [PTR_SendMessageW_00408218]
004057b98d 34 46LEA ESI,[ESI + EAX*0x2]
004057bc66 c7 06 0d 00MOV word ptr [ESI],0xd
004057c146INC ESI
004057c246INC ESI
004057c366 c7 06 0a 00MOV word ptr [ESI],0xa
004057c846INC ESI
004057c946INC ESI
004057ca43INC EBX
004057cb3b 5d 0cCMP EBX,dword ptr [EBP + param_2]
004057ce7c d7JL LAB_004057a7
004057d0ff 75 08PUSH dword ptr [EBP + param_1]
004057d3ff 15 30 81 40 00CALL dword ptr [PTR_GlobalUnlock_00408130]
004057d9ff 75 08PUSH dword ptr [EBP + param_1]
004057dc6a 0dPUSH 0xd
004057deff 15 d0 81 40 00CALL dword ptr [PTR_SetClipboardData_004081d0]
004057e4ff 15 cc 81 40 00CALL dword ptr [PTR_CloseClipboard_004081cc]
LAB_004057ea:
004057ea33 c0XOR EAX,EAX
004057ece9 a9 fe ff ffJMP LAB_0040569a

createProcessW wrapper with…

0x4058a367 bytes
HANDLE FUN_004058a3(LPWSTR param_1)

CreateProcessW wrapper with CREATE_NO_WINDOW (0x4000000) flag for launching dropped payloads silently

Cited as
E11, E30
Behaviours
B11
Called from
FUN_00401434, entry
Calls
CreateProcessW CloseHandle
Decompiled C · 22 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

HANDLE FUN_004058a3(LPWSTR param_1)

{
  BOOL BVar1;
  HANDLE pvVar2;
  _PROCESS_INFORMATION local_14;
  
  _DAT_00468250 = 0x44;
  BVar1 = CreateProcessW((LPCWSTR)0x0,param_1,(LPSECURITY_ATTRIBUTES)0x0,(LPSECURITY_ATTRIBUTES)0x0,
                         0,0x4000000,(LPVOID)0x0,(LPCWSTR)0x0,(LPSTARTUPINFOW)&DAT_00468250,
                         &local_14);
  pvVar2 = (HANDLE)0x0;
  if (BVar1 != 0) {
    CloseHandle(local_14.hThread);
    pvVar2 = local_14.hProcess;
  }
  return pvVar2;
}
Assembly · 24 instructions, 0 annotated
AddressBytesInstructionComment
004058a355PUSH EBP
004058a48b ecMOV EBP,ESP
004058a683 ec 10SUB ESP,0x10
004058a98d 45 f0LEA EAX,[EBP + -0x10]
004058acc7 05 50 82 46 00 44 00 …MOV dword ptr [DAT_00468250],0x44
004058b650PUSH EAX
004058b733 c0XOR EAX,EAX
004058b968 50 82 46 00PUSH DAT_00468250
004058be50PUSH EAX
004058bf50PUSH EAX
004058c068 00 00 00 04PUSH 0x4000000
004058c550PUSH EAX
004058c650PUSH EAX
004058c750PUSH EAX
004058c8ff 75 08PUSH dword ptr [EBP + param_1]
004058cb50PUSH EAX
004058ccff 15 cc 80 40 00CALL dword ptr [PTR_CreateProcessW_004080cc]
004058d285 c0TEST EAX,EAX
004058d474 0cJZ LAB_004058e2
004058d6ff 75 f4PUSH dword ptr [EBP + local_10]
004058d9ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
004058df8b 45 f0MOV EAX,dword ptr [EBP + local_14]
LAB_004058e2:
004058e2c9LEAVE
004058e3c2 04 00RET 0x4

shellExecuteExW wrapper for launching…

0x4058e624 bytes
undefined FUN_004058e6(SHELLEXECUTEINFOW * param_1)

ShellExecuteExW wrapper for launching files via the shell

Behaviours
B11
Called from
FUN_00401434, FUN_0040469f
Calls
ShellExecuteExW
Decompiled C · 10 lines
void FUN_004058e6(SHELLEXECUTEINFOW *param_1)

{
  param_1->lpIDList = (void *)0x0;
  param_1->cbSize = 0x3c;
  ShellExecuteExW(param_1);
  return;
}
Assembly · 6 instructions, 0 annotated
AddressBytesInstructionComment
004058e68b 44 24 04MOV EAX,dword ptr [ESP + param_1]
004058ea50PUSH EAX
004058eb83 60 24 00AND dword ptr [EAX + 0x24],0x0
004058efc7 00 3c 00 00 00MOV dword ptr [EAX],0x3c
004058f5ff 15 7c 81 40 00CALL dword ptr [PTR_ShellExecuteExW_0040817c]
004058fbc2 04 00RET 0x4

writes uninstaller registration entry…

0x405f06378 bytes
undefined FUN_00405f06(LPCWSTR param_1, LPCWSTR param_2)

writes uninstaller registration entry to file

Cited as
E14
Behaviours
B14
Called from
FUN_00406080
Calls
GetFileSize GetShortPathNameW lstrcpyA CloseHandle GlobalFree GlobalAlloc SetFilePointer wsprintfA FUN_00405d15, FUN_00405d6b, FUN_00405db0, FUN_00405e33, FUN_00405e62, FUN_004062dc
Decompiled C · 69 lines
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void __cdecl FUN_00405f06(LPCWSTR param_1,LPCWSTR param_2)

{
  HANDLE pvVar1;
  DWORD DVar2;
  int iVar3;
  LPCSTR pCVar4;
  LPSTR hMem;
  int iVar5;
  LPCSTR pCVar6;
  LPCSTR pCVar7;
  CHAR *pCVar8;
  LPSTR pCVar9;
  
  _DAT_004688e8 = 0x55004e;
  _DAT_004688ec = 0x4c;
  if (param_2 != (LPCWSTR)0x0) {
    pvVar1 = (HANDLE)FUN_00405db0(param_2,0,1);
    CloseHandle(pvVar1);
    DVar2 = GetShortPathNameW(param_2,(LPWSTR)&DAT_004688e8,0x400);
    if (DVar2 == 0) {
      return;
    }
    if (0x400 < (int)DVar2) {
      return;
    }
  }
  DVar2 = GetShortPathNameW(param_1,(LPWSTR)&DAT_004690e8,0x400);
  if ((DVar2 != 0) && ((int)DVar2 < 0x401)) {
    iVar3 = wsprintfA(&DAT_004684e8,s__ls__ls_0040a570,&DAT_004688e8,&DAT_004690e8);
    FUN_004062dc((LPWSTR)&DAT_004690e8,*(int *)(DAT_0047aef4 + 0x128));
    pvVar1 = (HANDLE)FUN_00405db0((LPCWSTR)&DAT_004690e8,0xc0000000,4);
    if (pvVar1 != (HANDLE)0xffffffff) {
      pCVar4 = (LPCSTR)GetFileSize(pvVar1,(LPDWORD)0x0);
      hMem = GlobalAlloc(0x40,(SIZE_T)(pCVar4 + iVar3 + 10));
      if ((hMem != (LPSTR)0x0) && (iVar5 = FUN_00405e33(pvVar1,hMem,(DWORD)pCVar4), iVar5 != 0)) {
        pCVar6 = FUN_00405d15(hMem,s__Rename__0040a564);
        if (pCVar6 == (LPCSTR)0x0) {
          lstrcpyA(hMem + (int)pCVar4,s__Rename__0040a564);
          pCVar4 = pCVar4 + 10;
          pCVar6 = pCVar4;
        }
        else {
          pCVar7 = FUN_00405d15(pCVar6 + 10,&DAT_0040a560);
          pCVar6 = pCVar4;
          if (pCVar7 != (LPCSTR)0x0) {
            pCVar9 = hMem + (int)pCVar4;
            pCVar8 = pCVar9 + iVar3;
            for (; pCVar7 < pCVar9; pCVar9 = pCVar9 + -1) {
              *pCVar8 = *pCVar9;
              pCVar8 = pCVar8 + -1;
            }
            pCVar6 = pCVar7 + (1 - (int)hMem);
          }
        }
        FUN_00405d6b(hMem + (int)pCVar6,0x4684e8,iVar3);
        SetFilePointer(pvVar1,0,(PLONG)0x0,0);
        FUN_00405e62(pvVar1,hMem,(DWORD)(pCVar4 + iVar3));
        GlobalFree(hMem);
      }
      CloseHandle(pvVar1);
    }
  }
  return;
}
Assembly · 130 instructions, 10 annotated
AddressBytesInstructionComment
00405f0653PUSH EBX
00405f078b 1d bc 80 40 00MOV EBX,dword ptr [PTR_GetShortPathNameW_004080bc]
00405f0d55PUSH EBP
00405f0e56PUSH ESI
00405f0f8b 74 24 14MOV ESI,dword ptr [ESP + param_2]
00405f1357PUSH EDI
00405f1485 f6TEST ESI,ESI
00405f16c7 05 e8 88 46 00 4e 00 …MOV dword ptr [DAT_004688e8],0x55004e
00405f20c7 05 ec 88 46 00 4c 00 …MOV dword ptr [DAT_004688ec],0x4c
00405f2abf 00 04 00 00MOV EDI,0x400
00405f2fbd e8 88 46 00MOV EBP,DAT_004688e8
00405f3474 26JZ LAB_00405f5c
00405f366a 01PUSH 0x1
00405f386a 00PUSH 0x0
00405f3a56PUSH ESI
00405f3be8 70 fe ff ffCALL FUN_00405db0; FUN_00405db0: GetFileAttributesW, CreateFileW
00405f4050PUSH EAX
00405f41ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
00405f4757PUSH EDI
00405f4855PUSH EBP
00405f4956PUSH ESI
00405f4aff d3CALL EBX
00405f4c85 c0TEST EAX,EAX
00405f4e0f 84 27 01 00 00JZ LAB_0040607b
00405f543b c7CMP EAX,EDI
00405f560f 8f 1f 01 00 00JG LAB_0040607b
LAB_00405f5c:
00405f5cbe e8 90 46 00MOV ESI,DAT_004690e8
00405f6157PUSH EDI
00405f6256PUSH ESI
00405f63ff 74 24 1cPUSH dword ptr [ESP + param_1]
00405f67ff d3CALL EBX
00405f6985 c0TEST EAX,EAX
00405f6b0f 84 0a 01 00 00JZ LAB_0040607b
00405f713b c7CMP EAX,EDI
00405f730f 8f 02 01 00 00JG LAB_0040607b
00405f7956PUSH ESI
00405f7a55PUSH EBP
00405f7b68 70 a5 40 00PUSH s_%ls=%ls_0040a570; "%ls=%ls\r\n"
00405f8068 e8 84 46 00PUSH DAT_004684e8
00405f85ff 15 00 82 40 00CALL dword ptr [PTR_wsprintfA_00408200]
00405f8b8b d8MOV EBX,EAX
00405f8da1 f4 ae 47 00MOV EAX,[DAT_0047aef4]
00405f9283 c4 10ADD ESP,0x10
00405f95ff b0 28 01 00 00PUSH dword ptr [EAX + 0x128]
00405f9b56PUSH ESI
00405f9ce8 3b 03 00 00CALL FUN_004062dc; FUN_004062dc: GetSystemDirectoryW, GetWindowsDirectoryW, SHGetSpecialFolderLocation, SHGetPathFromIDListW +1
00405fa16a 04PUSH 0x4
00405fa368 00 00 00 c0PUSH 0xc0000000
00405fa856PUSH ESI
00405fa9e8 02 fe ff ffCALL FUN_00405db0; FUN_00405db0: GetFileAttributesW, CreateFileW
00405fae8b e8MOV EBP,EAX
00405fb083 fd ffCMP EBP,-0x1
00405fb389 6c 24 18MOV dword ptr [ESP + param_2],EBP
00405fb70f 84 be 00 00 00JZ LAB_0040607b
00405fbd6a 00PUSH 0x0
00405fbf55PUSH EBP
00405fc0ff 15 80 80 40 00CALL dword ptr [PTR_GetFileSize_00408080]
00405fc68b f8MOV EDI,EAX
00405fc88d 44 1f 0aLEA EAX,[EDI + EBX*0x1 + 0xa]
00405fcc50PUSH EAX
00405fcd6a 40PUSH 0x40
00405fcfff 15 34 81 40 00CALL dword ptr [PTR_GlobalAlloc_00408134]
00405fd58b f0MOV ESI,EAX
00405fd785 f6TEST ESI,ESI
00405fd90f 84 95 00 00 00JZ LAB_00406074
00405fdf57PUSH EDI
00405fe056PUSH ESI
00405fe155PUSH EBP
00405fe2e8 4c fe ff ffCALL FUN_00405e33; FUN_00405e33: ReadFile
00405fe785 c0TEST EAX,EAX
00405fe90f 84 85 00 00 00JZ LAB_00406074
00405fef68 64 a5 40 00PUSH s_[Rename]_0040a564; "[Rename]\r\n"
00405ff456PUSH ESI
00405ff5e8 1b fd ff ffCALL FUN_00405d15; FUN_00405d15: lstrlenA, lstrcmpiA, CharNextA
00405ffa85 c0TEST EAX,EAX
00405ffc75 14JNZ LAB_00406012
00405ffe8d 04 3eLEA EAX,[ESI + EDI*0x1]
0040600168 64 a5 40 00PUSH s_[Rename]_0040a564; "[Rename]\r\n"
0040600650PUSH EAX
00406007ff 15 e4 80 40 00CALL dword ptr [PTR_lstrcpyA_004080e4]
0040600d83 c7 0aADD EDI,0xa
00406010eb 35JMP LAB_00406047
LAB_00406012:
0040601283 c0 0aADD EAX,0xa
0040601568 60 a5 40 00PUSH DAT_0040a560
0040601a50PUSH EAX
0040601be8 f5 fc ff ffCALL FUN_00405d15; FUN_00405d15: lstrlenA, lstrcmpiA, CharNextA
004060208b e8MOV EBP,EAX
0040602285 edTEST EBP,EBP
0040602474 1dJZ LAB_00406043
004060268d 0c 3eLEA ECX,[ESI + EDI*0x1]
004060298d 04 19LEA EAX,[ECX + EBX*0x1]
0040602ceb 06JMP LAB_00406034
LAB_0040602e:
0040602e8a 11MOV DL,byte ptr [ECX]
0040603088 10MOV byte ptr [EAX],DL
0040603248DEC EAX
0040603349DEC ECX
LAB_00406034:
004060343b cdCMP ECX,EBP
0040603677 f6JA LAB_0040602e
004060382b eeSUB EBP,ESI
0040603a45INC EBP
0040603b8b c5MOV EAX,EBP
0040603d8b 6c 24 18MOV EBP,dword ptr [ESP + param_2]
00406041eb 06JMP LAB_00406049
LAB_00406043:
004060438b 6c 24 18MOV EBP,dword ptr [ESP + param_2]
LAB_00406047:
004060478b c7MOV EAX,EDI
LAB_00406049:
0040604953PUSH EBX
0040604a03 c6ADD EAX,ESI
0040604c68 e8 84 46 00PUSH DAT_004684e8
0040605150PUSH EAX
00406052e8 14 fd ff ffCALL FUN_00405d6b
0040605733 c0XOR EAX,EAX
0040605950PUSH EAX
0040605a50PUSH EAX
0040605b50PUSH EAX
0040605c55PUSH EBP
0040605dff 15 44 81 40 00CALL dword ptr [PTR_SetFilePointer_00408144]
0040606303 fbADD EDI,EBX
0040606557PUSH EDI
0040606656PUSH ESI
0040606755PUSH EBP
00406068e8 f5 fd ff ffCALL FUN_00405e62; FUN_00405e62: WriteFile
0040606d56PUSH ESI
0040606eff 15 28 81 40 00CALL dword ptr [PTR_GlobalFree_00408128]
LAB_00406074:
0040607455PUSH EBP
00406075ff 15 20 81 40 00CALL dword ptr [PTR_CloseHandle_00408120]
LAB_0040607b:
0040607b5fPOP EDI
0040607c5ePOP ESI
0040607d5dPOP EBP
0040607e5bPOP EBX
0040607fc3RET

registry key creation wrapper

0x40615551 bytes
LSTATUS FUN_00406155(uint param_1, LPCWSTR param_2, REGSAM param_3, PHKEY param_4)

Registry key creation wrapper: calls RegCreateKeyExW through the NSIS registry root resolver

Cited as
E32
Behaviours
B6
Called from
FUN_00402cd1
Calls
RegCreateKeyExW FUN_004060ac
Decompiled C · 18 lines
LSTATUS FUN_00406155(uint param_1,LPCWSTR param_2,REGSAM param_3,PHKEY param_4)

{
  HKEY hKey;
  LSTATUS LVar1;
  
  hKey = (HKEY)FUN_004060ac(param_1,&param_3);
  if (hKey == (HKEY)0x0) {
    LVar1 = 6;
  }
  else {
    LVar1 = RegCreateKeyExW(hKey,param_2,0,(LPWSTR)0x0,0,param_3,(LPSECURITY_ATTRIBUTES)0x0,param_4,
                            (LPDWORD)0x0);
  }
  return LVar1;
}
Assembly · 24 instructions, 0 annotated
AddressBytesInstructionComment
0040615555PUSH EBP
004061568b ecMOV EBP,ESP
004061588d 45 10LEA EAX,[EBP + 0x10]
0040615b50PUSH EAX
0040615cff 75 08PUSH dword ptr [EBP + param_1]
0040615fe8 48 ff ff ffCALL FUN_004060ac
0040616433 c9XOR ECX,ECX
004061663b c1CMP EAX,ECX
0040616875 05JNZ LAB_0040616f
0040616a6a 06PUSH 0x6
0040616c58POP EAX
0040616deb 15JMP LAB_00406184
LAB_0040616f:
0040616f51PUSH ECX
00406170ff 75 14PUSH dword ptr [EBP + param_4]
0040617351PUSH ECX
00406174ff 75 10PUSH dword ptr [EBP + param_3]
0040617751PUSH ECX
0040617851PUSH ECX
0040617951PUSH ECX
0040617aff 75 0cPUSH dword ptr [EBP + param_2]
0040617d50PUSH EAX
0040617eff 15 04 80 40 00CALL dword ptr [PTR_RegCreateKeyExW_00408004]
LAB_00406184:
004061845dPOP EBP
00406185c2 10 00RET 0x10

registry value reader

0x406188121 bytes
undefined FUN_00406188(uint param_1, LPCWSTR param_2, LPCWSTR param_3, LPBYTE param_4, HKEY param_5)

Registry value reader: opens a key, queries a value with RegQueryValueExW, returns the data

Cited as
E33
Behaviours
B6
Called from
FUN_004039aa, FUN_004062dc
Calls
RegCloseKey RegQueryValueExW FUN_00406127
Decompiled C · 30 lines
void FUN_00406188(uint param_1,LPCWSTR param_2,LPCWSTR param_3,LPBYTE param_4,HKEY param_5)

{
  LPBYTE pBVar1;
  LSTATUS LVar2;
  DWORD local_8;
  
  local_8 = 0x4000;
  LVar2 = FUN_00406127(param_1,param_2,-(uint)(param_5 != (HKEY)0x0) & 0x100 | 0x20019,&param_5);
  pBVar1 = param_4;
  if (LVar2 == 0) {
    LVar2 = RegQueryValueExW(param_5,param_3,(LPDWORD)0x0,(LPDWORD)&param_2,param_4,&local_8);
    RegCloseKey(param_5);
    pBVar1[0x3ffe] = '\0';
    pBVar1[0x3fff] = '\0';
    if (LVar2 == 0) {
      if (param_2 == (LPCWSTR)0x1) {
        return;
      }
      if (param_2 == (LPCWSTR)0x2) {
        return;
      }
    }
  }
  pBVar1[0] = '\0';
  pBVar1[1] = '\0';
  return;
}
Assembly · 44 instructions, 1 annotated
AddressBytesInstructionComment
0040618855PUSH EBP
004061898b ecMOV EBP,ESP
0040618b51PUSH ECX
0040618c8d 45 18LEA EAX,[EBP + 0x18]
0040618f56PUSH ESI
0040619050PUSH EAX
004061918b 45 18MOV EAX,dword ptr [EBP + 0x18]
00406194f7 d8NEG EAX
004061961b c0SBB EAX,EAX
00406198c7 45 fc 00 40 00 00MOV dword ptr [EBP + local_8],0x4000
0040619f25 00 01 00 00AND EAX,0x100
004061a40d 19 00 02 00OR EAX,0x20019
004061a950PUSH EAX
004061aaff 75 0cPUSH dword ptr [EBP + param_2]
004061adff 75 08PUSH dword ptr [EBP + param_1]
004061b0e8 72 ff ff ffCALL FUN_00406127; FUN_00406127: RegOpenKeyExW
004061b58b 75 14MOV ESI,dword ptr [EBP + param_4]
004061b885 c0TEST EAX,EAX
004061ba75 3cJNZ LAB_004061f8
004061bc8d 45 fcLEA EAX,[EBP + -0x4]
004061bf57PUSH EDI
004061c050PUSH EAX
004061c18d 45 0cLEA EAX,[EBP + 0xc]
004061c456PUSH ESI
004061c550PUSH EAX
004061c66a 00PUSH 0x0
004061c8ff 75 10PUSH dword ptr [EBP + param_3]
004061cbff 75 18PUSH dword ptr [EBP + param_5]
004061ceff 15 2c 80 40 00CALL dword ptr [PTR_RegQueryValueExW_0040802c]
004061d4ff 75 18PUSH dword ptr [EBP + param_5]
004061d78b f8MOV EDI,EAX
004061d9ff 15 24 80 40 00CALL dword ptr [PTR_RegCloseKey_00408024]
004061df66 83 a6 fe 3f 00 00 00AND word ptr [ESI + 0x3ffe],0x0
004061e785 ffTEST EDI,EDI
004061e95fPOP EDI
004061ea75 0cJNZ LAB_004061f8
004061ec83 7d 0c 01CMP dword ptr [EBP + param_2],0x1
004061f074 0aJZ LAB_004061fc
004061f283 7d 0c 02CMP dword ptr [EBP + param_2],0x2
004061f674 04JZ LAB_004061fc
LAB_004061f8:
004061f866 83 26 00AND word ptr [ESI],0x0
LAB_004061fc:
004061fc5ePOP ESI
004061fdc9LEAVE
004061fec2 14 00RET 0x14

NSIS string variable resolver

0x4062dc626 bytes
undefined FUN_004062dc(LPWSTR param_1, int param_2)

NSIS string variable resolver: expands bytecoded strings with installer paths, environment variables, registry values, and shell folder paths

Cited as
E31
Behaviours
B12
Called from
FUN_00401434, FUN_00402c1f, FUN_00402c41, entry, FUN_004039aa, FUN_00403c80, FUN_00403d39, FUN_00404231, FUN_00404722, FUN_00404ade, FUN_00404c9e, FUN_00405322 +3 more
Calls
GetWindowsDirectoryW GetSystemDirectoryW SHGetSpecialFolderLocation SHGetPathFromIDListW CoTaskMemFree FUN_00406188, FUN_00406201, FUN_004062ba, lstrlenW, lstrcatW, FUN_004062dc, FUN_0040654e
Decompiled C · 135 lines
void FUN_004062dc(LPWSTR param_1,int param_2)

{
  byte bVar1;
  WCHAR WVar2;
  LPWSTR pWVar3;
  int iVar4;
  HRESULT HVar5;
  BOOL BVar6;
  int iVar7;
  WCHAR *pWVar8;
  uint uVar9;
  WCHAR *pWVar10;
  uint uVar11;
  LPWSTR lpBuffer;
  uint local_1c [4];
  LPCITEMIDLIST local_c;
  uint local_8;
  
  pWVar3 = param_1;
  if (param_2 < 0) {
    param_2 = *(int *)(DAT_00472ebc - (param_2 * 4 + 4));
  }
  pWVar10 = (WCHAR *)(DAT_0047af38 + param_2 * 2);
  lpBuffer = &DAT_0046ae80;
  if (((LPWSTR)0x46ae7f < param_1) && ((uint)((int)(param_1 + -0x235740) >> 1) < 0x4000)) {
    param_1 = (LPWSTR)0x0;
    lpBuffer = pWVar3;
  }
  do {
    while( true ) {
      WVar2 = *pWVar10;
      if ((WVar2 == L'\0') || (0x3fff < (int)((uint)(lpBuffer + -0x235740) & 0xfffffffe))) {
        *lpBuffer = L'\0';
        if (param_1 != (LPWSTR)0x0) {
          FUN_004062ba(param_1,&DAT_0046ae80);
        }
        return;
      }
      pWVar8 = pWVar10 + 1;
      if ((ushort)WVar2 < 4) break;
      if (WVar2 == L'\x04') {
        *lpBuffer = *pWVar8;
        lpBuffer = lpBuffer + 1;
        pWVar10 = pWVar10 + 2;
      }
      else {
        *lpBuffer = WVar2;
        lpBuffer = lpBuffer + 1;
        pWVar10 = pWVar8;
      }
    }
    bVar1 = (byte)*pWVar8;
    local_1c[1] = (uint)bVar1;
    uVar9 = (*(byte *)((int)pWVar10 + 3) & 0x7f) << 7 | bVar1 & 0x7f;
    local_1c[0] = local_1c[1] | 0x8000;
    uVar11 = (uint)*(byte *)((int)pWVar10 + 3);
    local_1c[3] = uVar11;
    local_1c[2] = uVar11 | 0x8000;
    if (WVar2 == L'\x02') {
      iVar7 = 2;
      if ((((DAT_0047aeec < 0) && ((short)DAT_0047aeec != 0x5a04)) && (uVar11 != 0x23)) &&
         (uVar11 != 0x2e)) {
        local_8 = 0;
      }
      else {
        local_8 = 1;
      }
      if (DAT_0047af84 != 0) {
        iVar7 = 4;
      }
      if ((char)bVar1 < '\0') {
        FUN_00406188(0x80000002,L"Software\\Microsoft\\Windows\\CurrentVersion",
                     (LPCWSTR)(DAT_0047af38 + (local_1c[1] & 0x3f) * 2),(LPBYTE)lpBuffer,
                     (HKEY)(local_1c[1] & 0x40));
        if (*lpBuffer == L'\0') {
          FUN_004062dc(lpBuffer,uVar11);
          goto LAB_00406497;
        }
LAB_004064a0:
        if (uVar11 == 0x1a) {
          lstrcatW(lpBuffer,L"\\Microsoft\\Internet Explorer\\Quick Launch");
        }
      }
      else {
        if (local_1c[1] == 0x25) {
          GetSystemDirectoryW(lpBuffer,0x2000);
        }
        else {
          if (local_1c[1] == 0x24) {
            GetWindowsDirectoryW(lpBuffer,0x2000);
            iVar7 = 0;
          }
          while ((iVar7 != 0 &&
                 (((iVar7 = iVar7 + -1, DAT_0047aee4 == (code *)0x0 || (local_8 == 0)) ||
                  (iVar4 = (*DAT_0047aee4)(DAT_0047aee8,local_1c[iVar7],0,0,lpBuffer), iVar4 != 0)))
                 )) {
            HVar5 = SHGetSpecialFolderLocation(DAT_0047aee8,local_1c[iVar7],&local_c);
            if (HVar5 == 0) {
              BVar6 = SHGetPathFromIDListW(local_c,lpBuffer);
              CoTaskMemFree(local_c);
              if (BVar6 != 0) break;
            }
            *lpBuffer = L'\0';
          }
        }
LAB_00406497:
        uVar11 = local_1c[3];
        if (*lpBuffer != L'\0') goto LAB_004064a0;
      }
LAB_004064b0:
      FUN_0040654e(lpBuffer);
    }
    else {
      local_8 = uVar9;
      if (WVar2 == L'\x03') {
        if (uVar9 == 0x1d) {
          FUN_00406201(lpBuffer,DAT_0047aee8);
        }
        else {
          FUN_004062ba(lpBuffer,(LPCWSTR)(&DAT_0047b000 + uVar9 * 0x4000));
        }
        if (uVar9 - 0x15 < 7) goto LAB_004064b0;
      }
      else if (WVar2 == L'\x01') {
        FUN_004062dc(lpBuffer,-1 - uVar9);
      }
    }
    iVar7 = lstrlenW(lpBuffer);
    lpBuffer = lpBuffer + iVar7;
    pWVar10 = pWVar10 + 2;
  } while( true );
}
Assembly · 209 instructions, 7 annotated
AddressBytesInstructionComment
004062dc55PUSH EBP
004062dd8b ecMOV EBP,ESP
004062df83 ec 18SUB ESP,0x18
004062e28b 45 0cMOV EAX,dword ptr [EBP + param_2]
004062e585 c0TEST EAX,EAX
004062e77d 11JGE LAB_004062fa
004062e98b 0d bc 2e 47 00MOV ECX,dword ptr [DAT_00472ebc]
004062ef8d 04 85 04 00 00 00LEA EAX,[EAX*0x4 + 0x4]
004062f62b c8SUB ECX,EAX
004062f88b 01MOV EAX,dword ptr [ECX]
LAB_004062fa:
004062fa8b 0d 38 af 47 00MOV ECX,dword ptr [DAT_0047af38]
0040630053PUSH EBX
0040630156PUSH ESI
0040630257PUSH EDI
004063038d 14 41LEA EDX,[ECX + EAX*0x2]
00406306b8 80 ae 46 00MOV EAX,DAT_0046ae80
0040630b39 45 08CMP dword ptr [EBP + param_1],EAX
0040630e8b f0MOV ESI,EAX
004063100f 82 12 02 00 00JC LAB_00406528
004063168b 4d 08MOV ECX,dword ptr [EBP + param_1]
004063192b c8SUB ECX,EAX
0040631bd1 f9SAR ECX,0x1
0040631d81 f9 00 40 00 00CMP ECX,0x4000
004063230f 83 ff 01 00 00JNC LAB_00406528
004063298b 75 08MOV ESI,dword ptr [EBP + param_1]
0040632c83 65 08 00AND dword ptr [EBP + param_1],0x0
00406330e9 f3 01 00 00JMP LAB_00406528
LAB_00406335:
004063358b ceMOV ECX,ESI
004063372b c8SUB ECX,EAX
0040633983 e1 feAND ECX,0xfffffffe
0040633c81 f9 00 40 00 00CMP ECX,0x4000
004063420f 8d ec 01 00 00JGE LAB_00406534
004063486a 02PUSH 0x2
0040634a59POP ECX
0040634b03 d1ADD EDX,ECX
0040634d66 83 ff 04CMP DI,0x4
0040635189 55 0cMOV dword ptr [EBP + param_2],EDX
004063540f 83 bb 01 00 00JNC LAB_00406515
0040635a8a 4a 01MOV CL,byte ptr [EDX + 0x1]
0040635d8a 02MOV AL,byte ptr [EDX]
0040635f8a d1MOV DL,CL
004063618a d8MOV BL,AL
0040636383 e2 7fAND EDX,0x7f
0040636683 e3 7fAND EBX,0x7f
00406369c1 e2 07SHL EDX,0x7
0040636c0f b6 c0MOVZX EAX,AL
0040636f0b d3OR EDX,EBX
004063718b d8MOV EBX,EAX
0040637389 55 fcMOV dword ptr [EBP + local_8],EDX
00406376ba 00 80 00 00MOV EDX,0x8000
0040637b0b daOR EBX,EDX
0040637d83 45 0c 02ADD dword ptr [EBP + param_2],0x2
0040638189 5d e8MOV dword ptr [EBP + local_1c],EBX
0040638489 45 ecMOV dword ptr [EBP + local_18],EAX
004063870f b6 d9MOVZX EBX,CL
0040638a8b cbMOV ECX,EBX
0040638c89 5d f4MOV dword ptr [EBP + local_10],EBX
0040638f0b caOR ECX,EDX
0040639166 83 ff 02CMP DI,0x2
0040639589 4d f0MOV dword ptr [EBP + local_14],ECX
004063980f 85 1a 01 00 00JNZ LAB_004064b8
0040639e8b 0d ec ae 47 00MOV ECX,dword ptr [DAT_0047aeec]
004063a46a 02PUSH 0x2
004063a685 c9TEST ECX,ECX
004063a85fPOP EDI
004063a979 17JNS LAB_004063c2
004063ab66 81 f9 04 5aCMP CX,0x5a04
004063b074 10JZ LAB_004063c2
004063b283 fb 23CMP EBX,0x23
004063b574 0bJZ LAB_004063c2
004063b783 fb 2eCMP EBX,0x2e
004063ba74 06JZ LAB_004063c2
004063bc83 65 fc 00AND dword ptr [EBP + local_8],0x0
004063c0eb 07JMP LAB_004063c9
LAB_004063c2:
004063c2c7 45 fc 01 00 00 00MOV dword ptr [EBP + local_8],0x1
LAB_004063c9:
004063c983 3d 84 af 47 00 00CMP dword ptr [DAT_0047af84],0x0
004063d074 03JZ LAB_004063d5
004063d26a 04PUSH 0x4
004063d45fPOP EDI
LAB_004063d5:
004063d584 c0TEST AL,AL
004063d779 39JNS LAB_00406412
004063d98b c8MOV ECX,EAX
004063db83 e0 3fAND EAX,0x3f
004063de83 e1 40AND ECX,0x40
004063e151PUSH ECX
004063e28b 0d 38 af 47 00MOV ECX,dword ptr [DAT_0047af38]
004063e856PUSH ESI
004063e98d 04 41LEA EAX,[ECX + EAX*0x2]
004063ec50PUSH EAX
004063ed68 28 84 40 00PUSH u_Software\Microsoft\Windows\Curre_00408428; "Software\\Microsoft\\Windows\\CurrentVersion"
004063f268 02 00 00 80PUSH 0x80000002
004063f7e8 8c fd ff ffCALL FUN_00406188; FUN_00406188: RegQueryValueExW, RegCloseKey
004063fc66 83 3e 00CMP word ptr [ESI],0x0
004064000f 85 9a 00 00 00JNZ LAB_004064a0
0040640653PUSH EBX
0040640756PUSH ESI
00406408e8 cf fe ff ffCALL FUN_004062dc
0040640de9 85 00 00 00JMP LAB_00406497
LAB_00406412:
0040641283 f8 25CMP EAX,0x25
0040641575 0eJNZ LAB_00406425
0040641768 00 20 00 00PUSH 0x2000
0040641c56PUSH ESI
0040641dff 15 f0 80 40 00CALL dword ptr [PTR_GetSystemDirectoryW_004080f0]
00406423eb 72JMP LAB_00406497
LAB_00406425:
0040642583 f8 24CMP EAX,0x24
0040642875 69JNZ LAB_00406493
0040642a68 00 20 00 00PUSH 0x2000
0040642f56PUSH ESI
00406430ff 15 98 80 40 00CALL dword ptr [PTR_GetWindowsDirectoryW_00408098]
0040643633 ffXOR EDI,EDI
00406438eb 59JMP LAB_00406493
LAB_0040643a:
0040643aa1 e4 ae 47 00MOV EAX,[DAT_0047aee4]
0040643f33 c9XOR ECX,ECX
004064414fDEC EDI
004064423b c1CMP EAX,ECX
0040644474 18JZ LAB_0040645e
0040644639 4d fcCMP dword ptr [EBP + local_8],ECX
0040644974 13JZ LAB_0040645e
0040644b56PUSH ESI
0040644c51PUSH ECX
0040644d51PUSH ECX
0040644eff 74 bd e8PUSH dword ptr [EBP + EDI*0x4 + -0x18]
00406452ff 35 e8 ae 47 00PUSH dword ptr [DAT_0047aee8]
00406458ff d0CALL EAX
0040645a85 c0TEST EAX,EAX
0040645c74 39JZ LAB_00406497
LAB_0040645e:
0040645e8d 45 f8LEA EAX,[EBP + -0x8]
0040646150PUSH EAX
00406462ff 74 bd e8PUSH dword ptr [EBP + EDI*0x4 + -0x18]
00406466ff 35 e8 ae 47 00PUSH dword ptr [DAT_0047aee8]
0040646cff 15 78 81 40 00CALL dword ptr [PTR_SHGetSpecialFolderLocation_00408178]
0040647285 c0TEST EAX,EAX
0040647475 19JNZ LAB_0040648f
0040647656PUSH ESI
00406477ff 75 f8PUSH dword ptr [EBP + local_c]
0040647aff 15 80 81 40 00CALL dword ptr [PTR_SHGetPathFromIDListW_00408180]
00406480ff 75 f8PUSH dword ptr [EBP + local_c]
004064838b d8MOV EBX,EAX
00406485ff 15 a4 82 40 00CALL dword ptr [PTR_CoTaskMemFree_004082a4]
0040648b85 dbTEST EBX,EBX
0040648d75 08JNZ LAB_00406497
LAB_0040648f:
0040648f66 83 26 00AND word ptr [ESI],0x0
LAB_00406493:
0040649385 ffTEST EDI,EDI
0040649575 a3JNZ LAB_0040643a
LAB_00406497:
0040649766 83 3e 00CMP word ptr [ESI],0x0
0040649b74 13JZ LAB_004064b0
0040649d8b 5d f4MOV EBX,dword ptr [EBP + local_10]
LAB_004064a0:
004064a083 fb 1aCMP EBX,0x1a
004064a375 0bJNZ LAB_004064b0
004064a568 80 84 40 00PUSH u_\Microsoft\Internet_Explorer\Qui_00408480; "\\Microsoft\\Internet Explorer\\Quick Launch"
004064aa56PUSH ESI
004064abe8 26 fe ff ffCALL lstrcatW
LAB_004064b0:
004064b056PUSH ESI
004064b1e8 98 00 00 00CALL FUN_0040654e; FUN_0040654e: CharNextW, CharPrevW
004064b6eb 4aJMP LAB_00406502
LAB_004064b8:
004064b866 83 ff 03CMP DI,0x3
004064bc75 31JNZ LAB_004064ef
004064be8b 7d fcMOV EDI,dword ptr [EBP + local_8]
004064c183 ff 1dCMP EDI,0x1d
004064c475 0eJNZ LAB_004064d4
004064c6ff 35 e8 ae 47 00PUSH dword ptr [DAT_0047aee8]
004064cc56PUSH ESI
004064cde8 2f fd ff ffCALL FUN_00406201; FUN_00406201: wsprintfW
004064d2eb 11JMP LAB_004064e5
LAB_004064d4:
004064d48b c7MOV EAX,EDI
004064d6c1 e0 0eSHL EAX,0xe
004064d905 00 b0 47 00ADD EAX,DAT_0047b000
004064de50PUSH EAX
004064df56PUSH ESI
004064e0e8 d5 fd ff ffCALL FUN_004062ba; FUN_004062ba: lstrcpynW
LAB_004064e5:
004064e583 c7 ebADD EDI,-0x15
004064e883 ff 07CMP EDI,0x7
004064eb73 15JNC LAB_00406502
004064edeb c1JMP LAB_004064b0
LAB_004064ef:
004064ef66 83 ff 01CMP DI,0x1
004064f375 0dJNZ LAB_00406502
004064f583 c8 ffOR EAX,0xffffffff
004064f82b 45 fcSUB EAX,dword ptr [EBP + local_8]
004064fb50PUSH EAX
004064fc56PUSH ESI
004064fde8 da fd ff ffCALL FUN_004062dc
LAB_00406502:
0040650256PUSH ESI
00406503e8 c8 fd ff ffCALL lstrlenW
004065088b 55 0cMOV EDX,dword ptr [EBP + param_2]
0040650b8d 34 46LEA ESI,[ESI + EAX*0x2]
0040650eb8 80 ae 46 00MOV EAX,DAT_0046ae80
00406513eb 13JMP LAB_00406528
LAB_00406515:
0040651575 0cJNZ LAB_00406523
0040651766 8b 3aMOV DI,word ptr [EDX]
0040651a66 89 3eMOV word ptr [ESI],DI
0040651d03 f1ADD ESI,ECX
0040651f03 d1ADD EDX,ECX
00406521eb 05JMP LAB_00406528
LAB_00406523:
0040652366 89 3eMOV word ptr [ESI],DI
0040652603 f1ADD ESI,ECX
LAB_00406528:
0040652866 8b 3aMOV DI,word ptr [EDX]
0040652b66 85 ffTEST DI,DI
0040652e0f 85 01 fe ff ffJNZ LAB_00406335
LAB_00406534:
0040653466 83 26 00AND word ptr [ESI],0x0
0040653883 7d 08 00CMP dword ptr [EBP + param_1],0x0
0040653c5fPOP EDI
0040653d5ePOP ESI
0040653e5bPOP EBX
0040653f74 09JZ LAB_0040654a
0040654150PUSH EAX
00406542ff 75 08PUSH dword ptr [EBP + param_1]
00406545e8 70 fd ff ffCALL FUN_004062ba; FUN_004062ba: lstrcpynW
LAB_0040654a:
0040654ac9LEAVE
0040654bc2 08 00RET 0x8

file existence check

0x4065fd39 bytes
undefined * FUN_004065fd(LPCWSTR param_1)

File existence check: FindFirstFileW with immediate FindClose, returns find data pointer or null

Behaviours
B5
Called from
FUN_00401434, FUN_004059cc, FUN_00405c97
Calls
FindFirstFileW FindClose
Decompiled C · 18 lines
undefined * FUN_004065fd(LPCWSTR param_1)

{
  HANDLE hFindFile;
  undefined *puVar1;
  
  hFindFile = FindFirstFileW(param_1,(LPWIN32_FIND_DATAW)&DAT_00468298);
  if (hFindFile == (HANDLE)0xffffffff) {
    puVar1 = (undefined *)0x0;
  }
  else {
    FindClose(hFindFile);
    puVar1 = &DAT_00468298;
  }
  return puVar1;
}
Assembly · 14 instructions, 0 annotated
AddressBytesInstructionComment
004065fd56PUSH ESI
004065febe 98 82 46 00MOV ESI,DAT_00468298
0040660356PUSH ESI
00406604ff 74 24 0cPUSH dword ptr [ESP + param_1]
00406608ff 15 38 81 40 00CALL dword ptr [PTR_FindFirstFileW_00408138]
0040660e83 f8 ffCMP EAX,-0x1
0040661174 0bJZ LAB_0040661e
0040661350PUSH EAX
00406614ff 15 4c 81 40 00CALL dword ptr [PTR_FindClose_0040814c]
0040661a8b c6MOV EAX,ESI
0040661ceb 02JMP LAB_00406620
LAB_0040661e:
0040661e33 c0XOR EAX,EAX
LAB_00406620:
004066205ePOP ESI
00406621c2 04 00RET 0x4

dynamic API resolver

0x40669460 bytes
FARPROC FUN_00406694(int param_1)

Dynamic API resolver: GetModuleHandleA then GetProcAddress from a module/function name table at a fixed address

Cited as
E3, E34
Behaviours
B3
Called from
FUN_00401434, FUN_00402d44, entry, FUN_004039aa, FUN_00404722, FUN_0040588b
Calls
GetProcAddress GetModuleHandleA FUN_00406624
Decompiled C · 18 lines
FARPROC FUN_00406694(int param_1)

{
  LPCSTR lpModuleName;
  HMODULE hModule;
  FARPROC pFVar1;
  
  lpModuleName = (&PTR_s_KERNEL32_0040a3e0)[param_1 * 2];
  hModule = GetModuleHandleA(lpModuleName);
  if ((hModule == (HMODULE)0x0) &&
     (hModule = (HMODULE)FUN_00406624(lpModuleName), hModule == (HMODULE)0x0)) {
    return (FARPROC)0x0;
  }
  pFVar1 = GetProcAddress(hModule,(&PTR_s_SetDefaultDllDirectories_0040a3e4)[param_1 * 2]);
  return pFVar1;
}
Assembly · 22 instructions, 1 annotated
AddressBytesInstructionComment
004066948b 44 24 04MOV EAX,dword ptr [ESP + param_1]
0040669856PUSH ESI
004066998b f0MOV ESI,EAX
0040669b57PUSH EDI
0040669cc1 e6 03SHL ESI,0x3
0040669f8b be e0 a3 40 00MOV EDI,dword ptr [ESI + PTR_s_KERNEL32_0040a3e0]
004066a557PUSH EDI
004066a6ff 15 f8 80 40 00CALL dword ptr [PTR_GetModuleHandleA_004080f8]
004066ac85 c0TEST EAX,EAX
004066ae75 0aJNZ LAB_004066ba
004066b057PUSH EDI
004066b1e8 6e ff ff ffCALL FUN_00406624; FUN_00406624: GetSystemDirectoryW, wsprintfW, LoadLibraryExW
004066b685 c0TEST EAX,EAX
004066b874 0fJZ LAB_004066c9
LAB_004066ba:
004066baff b6 e4 a3 40 00PUSH dword ptr [ESI + PTR_s_SetDefaultDllDirectories_0040a3e4]
004066c050PUSH EAX
004066c1ff 15 f4 80 40 00CALL dword ptr [PTR_GetProcAddress_004080f4]
004066c7eb 02JMP LAB_004066cb
LAB_004066c9:
004066c933 c0XOR EAX,EAX
LAB_004066cb:
004066cb5fPOP EDI
004066cc5ePOP ESI
004066cdc2 04 00RET 0x4

Evidence 34

Every claim in this report rests on one of these items: what was examined, where, how (read from the file, decoded by the analysis, or reported by a tool), and what it shows. "Checked: not present" marks something the analysis looked for and did not find.

E1
read from the file·function
0x40338f

B1

in entry
bytes sha256 290a784cb132f2b747ff3b18b8fafdb0a4a52f673400c804569c6c14da11c739
E2
read from the file·function
0x40338f

B2

in entry
bytes sha256 290a784cb132f2b747ff3b18b8fafdb0a4a52f673400c804569c6c14da11c739
E3
read from the file·function
0x406694

B3

in dynamic API resolver
bytes sha256 c993c210b98566380ed74d3e07d56141aaa1e4102777a2b20035824abe7804c1
E4
read from the file·function
0x40338f

B4

in entry
bytes sha256 290a784cb132f2b747ff3b18b8fafdb0a4a52f673400c804569c6c14da11c739
E5
read from the file·function
0x401434

B5

in NSIS bytecode interpreter
bytes sha256 9029d4c345044b55634eaa18e14dc51cfa2812779cb96d4945b9f67789737858
E6
read from the file·function
0x401434

B6

in NSIS bytecode interpreter
bytes sha256 9029d4c345044b55634eaa18e14dc51cfa2812779cb96d4945b9f67789737858
E7
read from the file·function
0x401434

B7

in NSIS bytecode interpreter
bytes sha256 9029d4c345044b55634eaa18e14dc51cfa2812779cb96d4945b9f67789737858
E8
read from the file·function
0x401434

B8

in NSIS bytecode interpreter
bytes sha256 9029d4c345044b55634eaa18e14dc51cfa2812779cb96d4945b9f67789737858
E9
read from the file·function
0x401434

B9

in NSIS bytecode interpreter
bytes sha256 9029d4c345044b55634eaa18e14dc51cfa2812779cb96d4945b9f67789737858
E10
read from the file·function
0x402edd

B10

in NSIS self-reader
bytes sha256 4c8d16a8435463d7e519c4984fc80e608fce25fd24ec02d66b23080ed532c289
E11
read from the file·function
0x4058a3

B11

in createProcessW wrapper with…
bytes sha256 8e984a718f427b836c29b66de78b9e3326e6eb33649bfd16da5420c2b500e7fe
E12
read from the file·function
0x4039aa

B12

in installer UI creation
bytes sha256 14e3be81523eb9a8c3beabd86b7eb37cf703469cf5920fdd253a9c430f1f7022
E13
read from the file·function
0x405461

B13

in NSIS installer page dialog
bytes sha256 765d43b2620b5f151bb66786065ca5349e6b0b503a946df2ae54ac2cbc950433
E14
read from the file·function
0x405f06

B14

in writes uninstaller registration entry…
bytes sha256 82aa398c2e99aa8936059cc3647bc637a37d8e1bd2c71d79488bec33bf867d70
E15
read from the file·file range
0x83ac

I1

Bytes · 29 at 0x83ac
000083ac  68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6e 00  h.t.t.p.:././.n.
000083bc  73 00 69 00 73 00 2e 00 73 00 66 00 2e           s.i.s...s.f..
bytes sha256 d10bc9b4151c88ea80ecfea414eaa87bb6cb5a145e42918913d08956b38a0bb9
E16
read from the file·file range
0x7028

I2

Bytes · 41 at 0x7028
00007028  53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00  S.o.f.t.w.a.r.e.
00007038  5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00  \.M.i.c.r.o.s.o.
00007048  66 00 74 00 5c 00 57 00 69                       f.t.\.W.i
bytes sha256 2cdf006dcabcea994f357a831120bdfa84b30c1c0e225705048378a982f363d0
E17
read from the file·analysis output
out/L0/version_info.json

A2

bytes sha256 d0d1567d4fc3b4b85f67c4672e40c564e9b140405b624b6d82ac36a6bb774ae8
E18
read from the file·file header
pe_timestamp

A3

E19
read from the file·resource
ICON/1

A4

bytes sha256 c9ea553f8efcd2ffb43f305d29f4c843a85e0c944c72d49f2c18a630d2585805
E20
read from the file·section
overlay

B13

E21
read from the file·analysis output·Unpacked 1
out/L1_extract/resources/app.asar

B14

bytes sha256 6942177c4eae47027e058bdadec8d82afb4826ea4e459ac0e5bc938038f417cc
E22
read from the file·analysis output·Unpacked 1
out/L1_extract/jsc_strings.txt

B14

bytes sha256 ffe89248dac0158b6e652e566c897961a70053a86f4ad48ec81a267f80ae3298
E23
read from the file·analysis output·Unpacked 1
out/L1_extract/resources/app.asar

B15

bytes sha256 6942177c4eae47027e058bdadec8d82afb4826ea4e459ac0e5bc938038f417cc
E24
decoded by the analysis·analysis output·Unpacked 1
out/L1/sample.bin

B16

control {"check": "C2", "passed": true}bytes sha256 6942177c4eae47027e058bdadec8d82afb4826ea4e459ac0e5bc938038f417cc
E25
read from the file·analysis output·Unpacked 2
out/L2/sample.bin

V8 bytecode extracted from unpacked file 1 asar archive (main.jsc)

control {"check": "C1,C2", "passed": true}bytes sha256 3bf8b47b12d4630495baf611033c80ac6d31c27117b8a0409048d52b8e6260f7
E26
read from the file·analysis output·Unpacked 2
out/L1_extract/jsc_strings.txt

V8 bytecode string analysis: 176 strings, 10 API/C2/exfil, 6 file/path, 3 HTTP/network, 2 browser, 2 sysinfo, 1 storage, 1 inject, 1 serviceworker

bytes sha256 ffe89248dac0158b6e652e566c897961a70053a86f4ad48ec81a267f80ae3298
E27
read from the file·file range·Unpacked 2
0x168bc

HTTPS URL embedded in V8 bytecode at offset 92284, 29 bytes

Bytes · 29 at 0x168bc
000168bc  74 6f 72 65 2f 36 38 38 37 00 00 00 49 03 19 04  tore/6887...I...
000168cc  01 18 52 64 aa 63 c6 83 09 00 00 00 2d           ..Rd.c......-
bytes sha256 960a75d2b25f21ac10dc647f7729ffa66598f731e2a0027ac0b029803c814372
E28
read from the file·file range·Unpacked 2
0x168e8

HTTPS URL with upload keyword embedded in V8 bytecode at offset 92328, 29 bytes

Bytes · 29 at 0x168e8
000168e8  36 e3 3e 43 04 00 00 00 61 72 67 76 01 10 52 62  6.>C....argv..Rb
000168f8  5e 80 aa 7e 03 00 00 00 65 6e 76 00 06           ^..~....env..
bytes sha256 9d37072b498f1d91105bbfd0da75f01062a5e30ec721078a3c13c847813216d9
E29
read from the file·function
0x402edd

B10

in NSIS self-reader
bytes sha256 4c8d16a8435463d7e519c4984fc80e608fce25fd24ec02d66b23080ed532c289
E30
read from the file·function
0x4058a3

B11

in createProcessW wrapper with…
bytes sha256 8e984a718f427b836c29b66de78b9e3326e6eb33649bfd16da5420c2b500e7fe
E31
read from the file·function
0x4062dc

B12

in NSIS string variable resolver
bytes sha256 286dfe55947368825084b92600a89af9e7b7f6d46a765eaf21ec76647e7a69ee
E32
read from the file·function
0x406155

B6

in registry key creation wrapper
bytes sha256 895bbabd8f6f9591240f98c676985c66b673d6943de3039bcf9b007d0ccd90d3
E33
read from the file·function
0x406188

B6

in registry value reader
bytes sha256 8743dbd8a2c088a669f7b94149db4743ca1d900c12511274c1def227e6d8a0df
E34
read from the file·function
0x406694

B3

in dynamic API resolver
bytes sha256 c993c210b98566380ed74d3e07d56141aaa1e4102777a2b20035824abe7804c1

Run details

Run

model claude-opus-4-6effort mediumduration s 127 min 26 stokens 663,444tool uses 713

Produced with

skills
research-analysis
0cf735649e42
research-corpus
7defa8d3b7d1
research-ledger
7691f34d9cd1
tools
—
snapshot taken at
2026-10-28T00:00Z

Other sections of the report

Report keys this renderer has no special layout for, shown as written.

created · 2026-10-29T01:12Z2026-10-29T01:12Z
derived artifacts · 2 items
idofpathsha256sizetransformkindevidence
D1Unpacked 1out/L1/sample.bin6942177c…38f417cc201982nsis_extract_then_7z_extractotherE24
D2Unpacked 2out/L2/sample.bin3bf8b47b…8e6260f793416asar_extractotherE25
reachability · 2 items
filegraphrootsinternalreachedunreachedunreached status
Originalghidra_callgraph1048123possibly_reached
Originalnative_callgraph1058718possibly_reached
limits · 1 items
fileroots searchedroots not searchedcomputed sites in reached codeunresolved in reached codepasses rundata ref edgesnot claimed
Originalentrytls_callbacks277FLOSS failed: file size 64MB exceeds 16MB limit, so no decoded strings recovered from emulation. NSIS archive overlay (63.8MB) not extracted: payload contents are unknown. 23 internal functions unreached but possibly_reached due to 27 unresolved computed call sites in reached code.
questions · 5 items
idquestionstatusevidenceunknowns
Q1What is the file?answeredE1, E17, E18, E19, E20, E21none
Q2What does it do?answeredE5, E6, E10, E11, E20, E22, E25, E26, E27, E28U3
Q3What is the configuration and IOCs?answeredE15, E16, E17, E27, E28none
Q4What is the classification?answeredE20, E21, E22, E23none
Q5What are the unknowns and limits?answeredE20none