/*4427DE*/ PUSH ECX /*4427DF*/ PUSH 0 /*4427E1*/ PUSH 0 /*4427E3*/ CALL /*4427E8*/ MOV DWORD PTR DS:[4C98A8], EAX /*4427ED*/ PUSH 0 /*4427EF*/ LEA EAX, DWORD PTR DS:[ESI+2A3] /*4427F5*/ PUSH EAX /*4427F6*/ CALL /*4427FB*/ MOV EDI, EAX /*4427FD*/ PUSH 0 /*4427FF*/ PUSH [ARG.1] /*442802*/ PUSH 0 /*442804*/ PUSH 0 /*442806*/ PUSH 80000000 /*44280B*/ PUSH 80000000 /*442810*/ PUSH 80000000 /*442815*/ PUSH 80000000 /*44281A*/ PUSH 6CF0000 /*44281F*/ LEA EAX, DWORD PTR DS:[ESI+2B0] /*442825*/ PUSH EAX /*442826*/ LEA EDX, DWORD PTR DS:[ESI+2A3] ; ASCII "WinRAR" - NO Evaluation, Not Decided Yet? /*44282C*/ PUSH EDX /*44282D*/ PUSH 10 /*44282F*/ CALL ;Create the window - Title is WinRAR ^ /*442834*/ MOV DWORD PTR DS:[4C6EEC], EAX ;Save the HWND handle in 4C6EEC /*442839*/ CMP DWORD PTR DS:[4C6EEC], 0 ;ERROR? /*442840*/ JNZ SHORT WinRAR.00442865 ;NO Carry on! :D /*442842*/ XOR EAX, EAX ;clear EAX - Mov eax, 0 /*442844*/ MOV EDX, 2 ;EDX == 2 /*442849*/ PUSH EAX ;Push 0 /*44284A*/ LEA EAX, [LOCAL.2] /*44284D*/ DEC [LOCAL.4] /*442850*/ CALL WinRAR.00465788 /*442855*/ POP EAX /*442856*/ MOV EDX, [LOCAL.11] /*442859*/ MOV DWORD PTR FS:[0], EDX /*442860*/ JMP WinRAR.0044338E ; EXIT HERE I SUPPOSE /*442865*/ MOV EAX, WinRAR.004B41B0 ; The JNZ lands here! /*44286A*/ MOV EDX, DWORD PTR DS:[4C6EEC] /*442870*/ CALL WinRAR.0042952C /*442875*/ XOR EAX, EAX /*442877*/ CALL WinRAR.004436F0 /*44287C*/ CALL WinRAR.0043F4DF /*442881*/ CMP BYTE PTR SS:[EBP-2D], 0 /*442885*/ JE SHORT WinRAR.00442894 /*442887*/ MOV DL, 1 /*442889*/ XOR EAX, EAX /*44288B*/ CALL WinRAR.00472F54 /*442890*/ TEST AL, AL /*442892*/ JE SHORT WinRAR.00442898 /*442894*/ XOR EDX, EDX /*442896*/ JMP SHORT WinRAR.0044289D /*442898*/ MOV EDX, 1 /*44289D*/ MOV BYTE PTR SS:[EBP-2E], DL /*4428A0*/ PUSH 110 /*4428A5*/ PUSH 0 /*4428A7*/ PUSH WinRAR.004CA0B0 /*4428AC*/ CALL WinRAR.00498CFC /*4428B1*/ ADD ESP, 0C /*4428B4*/ MOV EAX, EBX /*4428B6*/ CALL WinRAR.00441358 // I Suppose the Evaluation is made inbetween these parts