Function at 0x4301a0
Capabilities:
Create process on windows
Create thread
Get common file path
Get disk size
Hide graphical window
Read .ini file
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x14cc
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x14c4], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2828
jg 0x430451
je 0x4303c9
sub ecx, 0x1b6
je 0x4303bf
sub ecx, 1
je 0x4302d0
sub ecx, 1
jne case.0x4315b4.20373
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push ecx
push 0x4c0a80
push 0x4ae480
call ebp
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
xor esi, esi
push 0x4c4980
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x430243
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x430237
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x430224
push 0x4c4980
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4b10dc
push 0x4ae480
call ebp
push 0x4c4980
xor esi, esi
call ebx
test eax, eax
jle 0x43029f
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x430293
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x430280
push 0x24
push 0x4c4980
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4315b4.20373
lea ecx, [eax - 4]
call fcn.004775f0
jmp case.0x4315b4.20373
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4c0a78
push 0x4ae480
call ebp
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
xor esi, esi
push 0x4c4980
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x43032f
nop dword [eax]
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x430323
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x430310
push 0x4c4980
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4b10dc
push 0x4ae480
call ebp
push 0x4c4980
xor esi, esi
call ebx
test eax, eax
jle 0x43038f
nop dword [eax]
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x430383
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x430370
push 0x24
push 0x4c4980
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4315b4.20373
xor ecx, ecx
call fcn.004775f0
jmp case.0x4315b4.20373
call fcn.00479390
jmp case.0x4315b4.20373
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x2830
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
sub eax, 0
je 0x430413
sub eax, 1
je 0x430407
sub eax, 1
jne 0x43041d
mov dword [0x4d2c80], 0x2999
jmp 0x43041d
mov dword [0x4d2c80], 0x2843
jmp 0x43041d
mov dword [0x4d2c80], 0x2828
call fcn.0046c120
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x34
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x34
jmp 0x431452
cmp ecx, 0x2994
jg 0x430d48
je 0x43061f
add ecx, 0xffffd7d7
cmp ecx, 0xe5
ja case.0x4315b4.20373
movzx eax, byte [ecx + 0x431b9c]
jmp dword [eax*4 + 0x431b20]
push 0x11
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.0x4315b4.20373
call fcn.0043c650
call fcn.0046b870
jmp case.0x4315b4.20373
call fcn.0043c950
call fcn.0046b870
jmp case.0x4315b4.20373
call fcn.0043c3a0
call fcn.0046b870
jmp case.0x4315b4.20373
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x43c0a0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x4315b4.20373
push 0x7fc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x4d4], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x288c
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x4d0]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x1073
push 0x288c
push dword [0x4def88]
mov dword [esp + 0x48], 0x400
call edi
push eax
call esi
mov ecx, 0x288c
call fcn.0043a2f0
call fcn.0046b870
jmp case.0x4315b4.20373
call fcn.00443a50
jmp case.0x4315b4.20373
push 1
push 0
push 0x4b0988
push 0x4b09dc
jmp 0x4315c6
call fcn.00443690
jmp case.0x4315b4.20373
call fcn.004438d0
jmp case.0x4315b4.20373
mov eax, dword [0x4ddea0]
cmp eax, 1
jne 0x4305d5
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.0x4315b4.20373
cmp eax, 0xe9
jl 0x4305e3
cmp eax, 0xeb
jle 0x430601
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
call fcn.0043a460
jmp case.0x4315b4.20373
call fcn.0043a180
jmp case.0x4315b4.20373
mov ecx, 0x290a
call fcn.0043a2f0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x4399a0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x4315b4.20373
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x2876
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
cmp eax, 5
ja case.default.0x430664
jmp dword [eax*4 + 0x431c84]
mov dword [0x4d2c80], 0x2829
jmp case.default.0x430664
mov dword [0x4d2c80], 0x2844
jmp case.default.0x430664
mov dword [0x4d2c80], 0x2846
jmp case.default.0x430664
mov dword [0x4d2c80], 0x2847
jmp case.default.0x430664
mov dword [0x4d2c80], 0x2845
jmp case.default.0x430664
mov dword [0x4d2c80], 0x29ce
call fcn.0046c120
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x66
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x66
jmp 0x431452
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x289a
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x43070d
jmp dword [eax*4 + 0x431c9c]
mov dword [0x4d2c80], 0x282a
jmp case.default.0x43070d
mov dword [0x4d2c80], 0x2848
jmp case.default.0x43070d
mov dword [0x4d2c80], 0x2849
jmp case.default.0x43070d
mov dword [0x4d2c80], 0x284a
jmp case.default.0x43070d
mov dword [0x4d2c80], 0x284b
call fcn.0046c120
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x98
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x98
jmp 0x431452
cmp dword [0x4c5198], 0x12c
jne 0x4307f6
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x29d1
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
sub eax, 0
je 0x4307e5
sub eax, 1
je 0x4307d4
sub eax, 1
jne 0x4307ef
mov dword [0x4d2c80], 0x29d3
call fcn.0046c120
jmp 0x43080b
mov dword [0x4d2c80], 0x29d2
call fcn.0046c120
jmp 0x43080b
mov dword [0x4d2c80], 0x2a34
call fcn.0046c120
jmp 0x43080b
mov dword [0x4d2c80], 0x282b
call fcn.0046c120
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0xca
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0xca
jmp 0x431452
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x289b
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x430865
jmp dword [eax*4 + 0x431cb0]
mov dword [0x4d2c80], 0x282c
jmp case.default.0x430865
mov dword [0x4d2c80], 0x284c
jmp case.default.0x430865
mov dword [0x4d2c80], 0x284d
jmp case.default.0x430865
mov dword [0x4d2c80], 0x284e
jmp case.default.0x430865
mov dword [0x4d2c80], 0x284f
call fcn.0046c120
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0xfc
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0xfc
jmp 0x431452
mov dword [0x4d2c80], 0x282d
call fcn.0046c120
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x12e
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x12e
jmp 0x431452
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad374
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x285e
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SetWindowTextW]
jmp case.0x4315b4.20373
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad370
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x285f
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad378
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2860
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad08c
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2861
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad0a0
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2862
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad0d0
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2863
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad0cc
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2864
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad0dc
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2865
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad0d4
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2866
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad3dc
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2867
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad444
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2868
jmp 0x430976
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
add esp, 0xc
mov edx, 0x4ad480
mov ecx, 0x4ae480
call fcn.004773a0
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.0x4315b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2869
jmp 0x430976
cmp ecx, 0x4f8e
jg 0x4315a5
je 0x431599
add ecx, 0xffffd66b
cmp ecx, 0xac
ja case.0x4315b4.20373
movzx eax, byte [ecx + 0x431cfc]
jmp dword [eax*4 + 0x431cc4]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4b10dc
push 0x4ae480
call ebp
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
xor esi, esi
push 0x4c4980
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x430dd2
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x430dc6
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x430db3
push 0x4c4980
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4b3694
push 0x4ae480
call ebp
push 0x4c4980
xor esi, esi
call ebx
test eax, eax
jle 0x430e2f
nop
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x430e23
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x430e10
push 0x24
lea eax, [esp + 0x2cc]
push eax
push 0x4c4980
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4315b4.20373
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e770
mov ebx, dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0xcc]
add esp, 0xc
push 0x104
push eax
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xc0]
push 0x4b369c
push eax
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0xc0]
push 5
push 0
push 0x4b36d4
push eax
push 0x4af6a8
push dword [0x4def88]
call esi
push 0x104
lea eax, [esp + 0xc4]
push eax
call ebx
push 0x4b36ec
lea eax, [esp + 0xc4]
push eax
call edi
push 5
push 0
push 0x4b36d4
lea eax, [esp + 0xcc]
push eax
push 0x4af6a8
push dword [0x4def88]
call esi
jmp case.0x4315b4.20373
mov edx, 0x4b0894
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, 0x4b089c
call fcn.00444060
jmp case.0x4315b4.20373
mov edx, 0x4b08bc
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, 0x4b08c4
call fcn.00444060
jmp case.0x4315b4.20373
mov edx, 0x4b08dc
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, 0x4b08e4
call fcn.00444060
jmp case.0x4315b4.20373
mov edx, 0x4b08fc
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, 0x4b0904
call fcn.00444060
jmp case.0x4315b4.20373
mov edx, 0x4b091c
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, 0x4b0924
call fcn.00444060
jmp case.0x4315b4.20373
mov edx, 0x4b0944
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, 0x4b094c
call fcn.00444060
jmp case.0x4315b4.20373
push 1
push 0
push 0x4b0968
push 0x4b0978
jmp 0x4315c6
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x43b560
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x4315b4.20373
push 0x7fc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x4d4], 0
push 0
push eax
call fcn.0048e770
add esp, 0xc
mov dword [esp + 0xcd0], 0
lea eax, [esp + 0xcd4]
push 0x7fc
push 0
push eax
call fcn.0048e770
add esp, 0xc
push 0x28c8
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
mov edi, dword [sym.imp.user32.dll_SendMessageW]
mov ebx, eax
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call edi
mov esi, eax
mov dword [esp + 0x70], 5
lea eax, [esp + 0x4d0]
mov dword [esp + 0x80], 0x400
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x68]
push eax
push esi
push 0x1073
push ebx
call edi
lea eax, [esp + 0xcd0]
mov dword [esp + 0x70], 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x68]
push eax
push esi
push 0x1073
push ebx
mov dword [esp + 0x90], 0x400
call edi
cmp word [esp + 0x4d0], 0
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
jne 0x431210
push 0x4ad0a4
push 0x4ae480
call ebp
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
xor esi, esi
push 0x4c4980
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x431194
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x431188
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x431175
push 0x4c4980
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4b10d4
push 0x4ae480
call ebp
push 0x4c4980
xor esi, esi
call ebx
test eax, eax
jle 0x4311f0
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x4311e4
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x4311d1
push 0x30
lea eax, [esp + 0x2cc]
push eax
push 0x4c4980
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
jmp case.0x4315b4.20373
push 0x4aeb88
push 0x4ad9cc
call ebp
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
xor esi, esi
push 0x4c4980
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x431251
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x431245
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x431232
push 0x4c4980
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xcd0]
push eax
lea eax, [esp + 0xc4]
push eax
call esi
push 0x4ae628
lea eax, [esp + 0xc4]
push eax
call esi
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4adcec
push 0x4b0870
call ebp
push 0x4c4980
xor esi, esi
call ebx
test eax, eax
jle 0x4312d4
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x4312c8
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x4312b5
push 0x24
push 0x4c4980
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4315b4.20373
lea eax, [esp + 0x4d0]
push eax
push 0x4b3290
lea eax, [esp + 0xcd8]
push 0x400
push eax
call fcn.0040a370
mov eax, dword [0x4def88]
add esp, 0x10
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
lea eax, [esp + 0xcd0]
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x30], eax
mov eax, dword [InitializeSListHead]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x2c], 0x4af6a8
mov dword [esp + 0x30], 0x4b0574
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
call fcn.0043aa40
jmp case.0x4315b4.20373
lea eax, [esp + 0x10]
push eax
push 0
push 0
push fcn.0043aa40
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x4315b4.20373
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x29f9
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x4313e2
jmp dword [eax*4 + 0x431dac]
mov dword [0x4d2c80], 0x29fa
jmp case.default.0x4313e2
mov dword [0x4d2c80], 0x29fb
jmp case.default.0x4313e2
mov dword [0x4d2c80], 0x29fc
jmp case.default.0x4313e2
mov dword [0x4d2c80], 0x29fd
jmp case.default.0x4313e2
mov dword [0x4d2c80], 0x29fe
call fcn.0046c120
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 2
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 2
mov eax, dword [0x4def8c]
add eax, 0x336
push eax
push 0x4e7e
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.user32.dll_MoveWindow]
push 5
push 0x4e7e
push dword [0x4def88]
call edi
push eax
call esi
call fcn.0046b870
jmp case.0x4315b4.20373
push 0x208
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x68]
push 0x58
push 0
push eax
call fcn.0048e770
mov eax, dword [InitializeSListHead]
add esp, 0xc
mov dword [esp + 0x70], eax
mov eax, dword [0x4def88]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0xc0]
mov dword [esp + 0x84], eax
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x6c], 0x58
mov dword [esp + 0xa0], 0x81824
mov dword [esp + 0x78], 0x4b09f8
mov dword [esp + 0x9c], 0x4b0a2c
mov dword [esp + 0x98], 0x4b0a54
mov dword [esp + 0x8c], 0x104
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0xb0], 0
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
lea eax, [esp + 0xc0]
push eax
push 0x29a6
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.user32.dll_SetWindowTextW]
push 0x10
push 0x78
push 0x78
push 0
lea eax, [esp + 0xd0]
push eax
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_LoadImageW]
push eax
push 0
push 0x172
push 0x29a9
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
jmp case.0x4315b4.20373
push 1
push 0x4b0830
jmp 0x431afb
add ecx, 0xffffb071
cmp ecx, 0x16
ja case.0x4315b4.20373
jmp dword [ecx*4 + 0x431dc0]
push 5
push 0
push 0
push 0x4b0348
push 0x4af6a8
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x4315b4.20373
push 1
push 0x4b03a8
jmp 0x431afb
push 5
push 0
push 0
push 0x4b03d0
jmp 0x4315c6
push 5
push 0
push 0
push 0x4b0430
jmp 0x4315c6
push 5
push 0
push 0
push 0x4b0490
jmp 0x4315c6
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push 0x4b04f0
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
lea eax, [esp + 0xc8]
push eax
push 0x4ade70
jmp 0x4315c6
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push 0x4b0514
jmp 0x431627
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8b0
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b0548
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8b8
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b0580
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8c0
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b05e8
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8e8
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b0650
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8f0
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b06d0
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad95c
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b0750
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad984
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x431af0
push 1
push 0
push 0x4b07e8
push 0x4b0574
jmp 0x4315c6
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad98c
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
mov edi, dword [sym.imp.user32.dll_MessageBoxW]
push eax
push dword [0x4def88]
call edi
cmp eax, 6
jne 0x431af0
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
xor eax, eax
mov word [esp + 0xc6], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
lea eax, [esp + 0xcc]
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
mov eax, dword [InitializeSListHead]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x440
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x4b0844
mov dword [esp + 0x34], 0x4b0858
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x54]
test eax, eax
je 0x431a0f
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 0x54]
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [esp + 0x58]
xorps xmm0, xmm0
push eax
push 0
push 0
lea eax, [esp + 0xcc]
movlpd qword [esp + 0x6c], xmm0
push eax
call esi
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x5c]
cmp ecx, esi
jb 0x431a4b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x58]
ja 0x431a45
cmp eax, edx
jbe 0x431a4b
sub eax, edx
sbb ecx, esi
jmp 0x431a53
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
push ecx
push eax
call fcn.004648f0
add esp, 8
mov edx, 0x4ad99c
mov ecx, 0x4b053c
push eax
call fcn.004773a0
push eax
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.0040a370
add esp, 0x10
mov edx, 0x4aeb40
mov ecx, 0x4b0870
push 0x40
call fcn.004773a0
push eax
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call edi
jmp case.0x4315b4.20373
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad994
push 0x24
push eax
mov ecx, 0x4b053c
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
je 0x431af4
xor eax, eax
jmp 0x431b06
push 1
push 0x4b087c
call dword [sym.imp.kernel32.dll_WinExec]
mov eax, 1
mov ecx, dword [esp + 0x14d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x14cc
ret