Function at 0x411650
Capabilities:
Create thread
Delete file
Get common file path
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x42e2be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x64]
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x3c]
call fcn.004221ab
lea ecx, [esp + 0x28]
mov dword [esp + 0x170], 0
call fcn.004221ab
lea ecx, [esp + 0x50]
mov byte [esp + 0x170], 1
call fcn.004221ab
push 0x82
mov ecx, esi
mov byte [esp + 0x174], 2
call fcn.0040a730
mov ecx, esi
call fcn.0040a7f0
mov edi, dword [eax + 0x10]
mov ecx, esi
call fcn.00410740
mov ecx, dword [edi + 0x148]
push 0
push 0
push 0x147
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ebp, [esi + 0x11c]
push 0x104
mov ecx, ebp
mov ebx, eax
call fcn.0042346c
mov edx, dword [edi + 0x148]
push eax
push ebx
push 0x148
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
mov ecx, ebp
call fcn.004234bb
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [edi + 0x60]
call fcn.00407d40
mov ecx, dword [eax]
push 0x439bb8
lea edi, [esi + 0x120]
push ecx
push 0x439bb0
push edi
mov byte [esp + 0x180], 3
call fcn.0042150b
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x170], 2
call fcn.004230ee
lea edx, [esp + 0x64]
push 0x439bb8
lea ebx, [esi + 0x124]
push edx
push 0x43929c
push ebx
call fcn.0042150b
mov al, byte [0x43c930]
add esp, 0x10
test al, al
je 0x411791
push 0x439ba0
mov ecx, ebp
call fcn.0042322b
mov ecx, dword [esi + 0x118]
xor ebp, ebp
cmp ecx, ebp
mov byte [esp + 0x17], 0
je 0x4117af
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x118], ebp
lea ecx, [esp + 0x24]
mov dword [esi + 0x144], ebp
push ecx
push ebp
push esi
push 0x411600
push ebp
push ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
mov dword [esp + 0x20], eax
mov byte [esi + 0x644], 0
call fcn.0040ede0
cmp dword [esi + 0x144], ebp
jne 0x4119d7
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x439b94
call fcn.0042315c
push ecx
mov byte [esp + 0x178], 4
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00422e63
lea edx, [esp + 0x18]
mov ecx, esi
push edx
mov byte [esp + 0x17c], 2
call fcn.0040f100
push eax
mov ecx, edi
mov byte [esp + 0x174], 5
call fcn.004231db
lea ecx, [esp + 0x10]
mov byte [esp + 0x170], 2
call fcn.004230ee
mov eax, dword [edi]
push 0x43c740
push eax
mov dword [esi + 0x170], 1
call fcn.004157d5
add esp, 8
test eax, eax
jne 0x4118cb
push ecx
mov dword [esi + 0x144], ebp
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x439b88
mov dword [esi + 0x170], ebp
call fcn.0042315c
push ecx
mov byte [esp + 0x178], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00422e63
lea eax, [esp + 0x18]
mov ecx, esi
push eax
mov byte [esp + 0x17c], 2
call fcn.0040f100
push eax
mov ecx, edi
mov byte [esp + 0x174], 7
call fcn.004231db
lea ecx, [esp + 0x10]
mov byte [esp + 0x170], 2
call fcn.004230ee
cmp dword [esi + 0x144], ebp
jne 0x4119d7
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0x16c], 1
jmp 0x4118ee
xor ebp, ebp
cmp dword [esi + 0x144], ebp
jne 0x4119d7
mov ecx, dword [edi]
mov dword [esi + 0x16c], ebp
push 0x2f
mov ebp, dword [ecx - 8]
mov ecx, edi
call fcn.004211a8
sub ebp, eax
lea edx, [esp + 0x10]
dec ebp
mov ecx, edi
push ebp
push edx
call fcn.004210b4
mov eax, dword [eax]
lea ecx, [esp + 0x64]
push eax
push ecx
push 0x43929c
push ebx
mov byte [esp + 0x180], 8
call fcn.0042150b
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x170], 2
call fcn.004230ee
mov ecx, esi
call fcn.0040ede0
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x4119a1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00422e63
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.0040f310
push eax
mov ecx, edi
mov byte [esp + 0x174], 9
call fcn.004231db
lea ecx, [esp + 0x18]
mov byte [esp + 0x170], 2
call fcn.004230ee
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x16c]
test eax, eax
jne 0x4118ec
mov eax, dword [esi + 0x144]
xor ebp, ebp
cmp eax, ebp
jne 0x4119d7
mov al, byte [esi + 0x644]
test al, al
je 0x4119d7
mov eax, dword [esi + 0x648]
mov ecx, dword [esi + 0x64c]
cmp eax, ecx
mov bl, 1
ja 0x4119db
mov bl, byte [esp + 0x17]
push 0x81
mov ecx, esi
call fcn.0040a730
mov ecx, dword [esp + 0x20]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esp + 0x50]
mov byte [esp + 0x170], 1
call fcn.004221de
lea ecx, [esp + 0x28]
mov byte [esp + 0x170], 0
call fcn.004221de
lea ecx, [esp + 0x3c]
mov dword [esp + 0x170], 0xffffffff
call fcn.004221de
mov ecx, dword [esp + 0x168]
pop edi
pop esi
mov al, bl
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x164
ret