Function at 0x403700
Capabilities:
Acquire debug privileges
Check os version
Enumerate gui resources
Get common file path
Get disk information
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43ca1c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20fc
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, esp
mov dword [esp + 0x20f8], eax
push ebx
push esi
push edi
mov eax, dword [0x44e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x2110]
mov dword fs:[0], eax
mov eax, dword [0x45dcc0]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x452960
push eax
push str.bFakeName
push 0x44fa30
mov dword [esp + 0x3c], ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x45dcc0], eax
test eax, eax
je 0x40378d
call ebx
push eax
call fcn.0042559c
add esp, 4
push 0
push 0x403480
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x45ac94], 0
je 0x4037c1
push 0x10000000
push 1
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov dword [0x459a8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [0x459a90], eax
cmp dword [0x45dcb8], 0
mov dword [esp + 0x30], 0
jne 0x4037f2
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45dcb8], eax
test eax, eax
je 0x403804
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x45dcb8]
mov edx, dword [esp + 0x30]
push 0x452960
push 0
push str.bFixedName
push 0x44fa30
mov dword [0x45dcbc], edx
call esi
push 0x443dd0
push 0
mov dword [0x453960], eax
call fcn.00425994
add esp, 8
push 0x1000
push 0x458a88
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x458a88
call fcn.00425d75
add esp, 4
push 0x5c
push 0x458a88
call fcn.004256f6
add esp, 8
test eax, eax
je 0x40386c
xor ecx, ecx
mov word [eax], cx
call fcn.00402a40
xor eax, eax
jmp 0x403880
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x457a88], cx
add eax, 2
test cx, cx
jne 0x403880
mov edi, 0x457a88
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4038a0
mov edx, dword [0x443f70]
mov eax, 0x457a88
mov dword [edi], edx
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4038c0
mov ecx, dword [str.modz]
mov dword [eax], ecx
mov ecx, dword [0x4443c4]
mov dword [eax + 4], ecx
mov cx, word [0x4443c8]
mov word [eax + 8], cx
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x455a88], cx
add eax, 2
test cx, cx
jne 0x4038f0
mov edi, 0x455a88
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403910
mov eax, 0x455a88
mov dword [edi], edx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403926
mov edx, dword [str.usvc]
mov ecx, dword [0x4443d0]
mov dword [eax], edx
mov dx, word [0x4443d4]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
call ebx
inc eax
push eax
call fcn.0042559c
add esp, 4
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x454a88], cx
add eax, 2
test cx, cx
jne 0x403960
mov edi, 0x454a88
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403980
mov eax, dword [0x443f70]
mov dword [edi], eax
xor eax, eax
jmp 0x4039a0
movzx ecx, word [eax + 0x454a88]
mov word [eax + 0x453a88], cx
add eax, 2
test cx, cx
jne 0x4039a0
cmp dword [0x453960], 0
je 0x4039d7
xor eax, eax
movzx ecx, word [eax + str.uvsstd]
mov word [esp + eax + 0x3c], cx
add eax, 2
test cx, cx
jne 0x4039c1
jmp 0x403a02
xor esi, esi
lea esp, [esp]
call fcn.004255ae
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add edx, 0x61
cmp esi, 6
mov word [esp + esi*2 + 0x3a], dx
jl 0x4039e0
xor edx, edx
mov word [esp + 0x48], dx
lea eax, [esp + 0x3c]
mov edx, eax
jmp 0x403a10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403a10
mov edi, 0x454a88
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403a25
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [0x453960], 0
rep movsb byte es:[edi], byte [esi]
je 0x403a66
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.uvssvc]
mov word [esp + eax + 0x3c], cx
add eax, 2
test cx, cx
jne 0x403a50
jmp 0x403a8a
xor esi, esi
call fcn.004255ae
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add edx, 0x61
cmp esi, 6
mov word [esp + esi*2 + 0x3a], dx
jl 0x403a68
xor edx, edx
mov word [esp + 0x48], dx
lea eax, [esp + 0x3c]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403a90
mov edi, 0x453a88
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403aa5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004031e0
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.00408aff
cmp dword [0x45dcc0], 0
mov ecx, esi
je 0x403ae3
push 0x45dcc8
jmp 0x403ae8
push 0x4443f8
call fcn.0040f8e3
mov edi, esi
mov eax, dword [edi + 0x20]
mov dword [0x45dcb0], eax
call fcn.00403380
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test bl, 1
je 0x403b1b
mov ecx, dword [edi + 0xec]
push 0
push 1
push 0xf1
push ecx
call esi
test bl, 2
je 0x403b32
mov edx, dword [edi + 0x98]
push 0
push 1
push 0xf1
push edx
call esi
test ebx, 0x100
je 0x403b4c
mov eax, dword [edi + 0x394]
push 0
push 1
push 0xf1
push eax
call esi
test ebx, 0x200
je 0x403b66
mov ecx, dword [edi + 0x3ec]
push 0
push 1
push 0xf1
push ecx
call esi
test bl, 0x10
je 0x403b72
push 0x41e
jmp 0x403b83
test bl, 0x20
je 0x403b7e
push 0x41f
jmp 0x403b83
push 0x41d
push 0x41f
push 0x41d
mov ecx, edi
call fcn.0040f7d4
lea edx, [esp + 0x18]
push edx
push 0x28
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403e25
lea eax, [esp + 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, 1
lea ebx, [edi + 1]
test eax, eax
je 0x403c08
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call esi
lea edx, [esp + 0x10]
push edx
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403c4a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call esi
lea ecx, [esp + 0x10]
push ecx
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403c8c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call esi
lea eax, [esp + 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403cce
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call esi
lea edx, [esp + 0x10]
push edx
push str.SeTcbPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403d10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call esi
lea ecx, [esp + 0x10]
push ecx
push str.SeImpersonatePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403d52
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call esi
lea eax, [esp + 0x10]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403d94
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call esi
lea edx, [esp + 0x10]
push edx
push str.SeCreateTokenPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403dd6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call esi
lea ecx, [esp + 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403e18
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e2f
mov ebx, 2
mov edi, 1
push 0x453968
mov dword [0x45dcb4], edi
mov dword [0x453968], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x453a7c
push 0x453970
push 0x45396c
call fcn.00403010
xor eax, eax
add esp, 0xc
cmp dword [0x45dcbc], eax
je 0x403f7f
cmp dword [0x45396c], 6
jb 0x403f00
lea esp, [esp]
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x456a88], cx
add eax, ebx
test cx, cx
jne 0x403e80
mov edi, 0x456a88
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403ea0
mov ecx, dword [0x443f70]
mov eax, 0x456a88
mov dword [edi], ecx
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403ec0
mov edx, dword [str.uvsv.x64]
mov ecx, dword [0x444580]
mov dword [eax], edx
mov edx, dword [0x444584]
mov dword [eax + 4], ecx
mov ecx, dword [0x444588]
mov dword [eax + 8], edx
mov dx, word [0x44458c]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
jmp 0x404068
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x456a88], cx
add eax, ebx
test cx, cx
jne 0x403f00
mov edi, 0x456a88
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403f20
mov eax, dword [0x443f70]
mov dword [edi], eax
mov eax, 0x456a88
add eax, 0xfffffffe
jmp 0x403f40
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403f40
mov ecx, dword [str.uvsz.x64]
mov edx, dword [0x444594]
mov dword [eax], ecx
mov ecx, dword [0x444598]
mov dword [eax + 4], edx
mov edx, dword [0x44459c]
mov dword [eax + 8], ecx
mov cx, word [0x4445a0]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
jmp 0x404068
cmp dword [0x45396c], 6
jb 0x404000
jmp 0x403f90
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x456a88], cx
add eax, ebx
test cx, cx
jne 0x403f90
mov edi, 0x456a88
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403fb0
mov edx, dword [0x443f70]
mov eax, 0x456a88
mov dword [edi], edx
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403fd0
mov ecx, dword [str.uvsv]
mov edx, dword [0x4445a8]
mov dword [eax], ecx
mov cx, word [0x4445ac]
jmp 0x404061
movzx ecx, word [eax + 0x458a88]
mov word [eax + 0x456a88], cx
add eax, ebx
test cx, cx
jne 0x404000
mov edi, 0x456a88
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404020
mov edx, dword [0x443f70]
mov eax, 0x456a88
mov dword [edi], edx
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x404040
mov ecx, dword [str.uvsz]
mov edx, dword [0x4445b4]
mov dword [eax], ecx
mov cx, word [0x4445b8]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x45dca0
mov edx, 0x454a88
mov ecx, 0x456a88
call fcn.00402870
add esp, 4
or ebx, 0xffffffff
test eax, eax
jne 0x4040fd
lea edx, [esp + 0x34]
push edx
mov edi, 0x302
call fcn.00402390
add esp, 4
mov esi, dword [esp + 0x2c]
push pe_nt_image_headers32
mov dword [esp + 0x211c], 0
mov eax, dword [eax]
push 0x454a88
push eax
mov ecx, esi
call fcn.0040b057
mov dword [esp + 0x2118], ebx
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x20]
push 0
push 2
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [0x45dcb4], 0
jmp 0x404101
mov esi, dword [esp + 0x2c]
push 0x45dca4
mov edx, 0x453a88
mov ecx, 0x455a88
call fcn.00402870
add esp, 4
test eax, eax
jne 0x404190
lea edx, [esp + 0x34]
push edx
mov edi, 0x303
call fcn.00402390
add esp, 4
push pe_nt_image_headers32
mov dword [esp + 0x211c], 1
mov eax, dword [eax]
push 0x453a88
push eax
mov ecx, esi
call fcn.0040b057
mov dword [esp + 0x2118], ebx
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x40416e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x20]
push 0
push 2
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [0x45dcb4], 0
jmp 0x4044e1
cmp dword [0x45dcb4], 0
je 0x4044e1
mov eax, dword [0x45396c]
cmp eax, 6
ja 0x4041b6
jne 0x4041b2
cmp dword [0x453970], 2
jae 0x4041b6
push 0
jmp 0x4041b8
push 1
lea ecx, [esi + 0x420]
mov dword [esp + 0x38], ecx
call fcn.0040f9c7
mov esi, dword [esp + 0x2c]
lea ebx, [esi + 0x174]
mov ecx, ebx
call fcn.0040f9ee
cmp dword [0x459a90], 0
je 0x40424d
lea edx, [esp + 0x30]
push edx
mov edi, 0x304
call fcn.00402390
add esp, 4
mov dword [esp + 0x2118], 2
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.0040f8e3
mov dword [esp + 0x2118], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404233
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
lea ecx, [esi + 0x21c]
call fcn.0040f9c7
push 0
lea ecx, [esi + 0x31c]
call fcn.0040f9c7
push 0x800
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x104]
xor edx, edx
push eax
mov word [esp + 0x10c], dx
call fcn.00425d75
add esp, 4
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esp + 0x30], 1
cmp eax, 5
je 0x40431c
cmp word [esp + 0x104], 0x58
je 0x40431c
cmp dword [0x45396c], 6
jb 0x4042b6
call fcn.00403410
test eax, eax
jne 0x4042c2
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4042fd
push 0
lea ecx, [esi + 0x120]
call fcn.0040f9c7
mov ecx, ebx
call fcn.0040f9ee
mov edx, dword [esi + 0x20]
push 0
push 0x413
push 0x401
push edx
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
jmp 0x404427
mov eax, dword [esi + 0x20]
push 0
push 0x413
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
jmp 0x404427
mov ecx, dword [esp + 0x34]
push 0
call fcn.0040f9c7
mov edi, dword [esp + 0x2c]
lea ecx, [edi + 0x1c8]
call fcn.0040f9ee
push 0
lea ecx, [edi + 0x120]
call fcn.0040f9c7
lea esi, [esp + 0x1104]
mov dword [esp + 0x30], 0
call fcn.00403650
test eax, eax
jle 0x40440f
xor eax, eax
movzx ecx, word [esp + eax + 0x1104]
mov word [eax + 0x45cca0], cx
add eax, 2
test cx, cx
jne 0x404361
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x30b
call fcn.00402390
add esp, 4
push 0x45cca0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x211c], 3
call fcn.00406ad0
push 0x4445bc
lea ecx, [esp + 0x3c]
call fcn.00406ad0
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
push edx
lea ecx, [esi + 0x1c8]
call fcn.0040f8e3
mov eax, dword [esi + 0x20]
push 0
push 0x413
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.0040f9ee
mov dword [esp + 0x2118], 0xffffffff
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404427
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404427
mov ecx, dword [edi + 0x20]
push 0
push 0x416
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, edi
mov eax, dword [0x45cc98]
test eax, eax
jle 0x404435
cmp eax, 4
jne 0x404445
cmp dword [0x45cc9c], 0
je 0x4044b6
cmp dword [esp + 0x30], 0
je 0x4044b6
push 0
mov ecx, esi
call fcn.0040f985
cmp dword [0x45cc9c], 0
je 0x404484
cmp dword [0x45cc98], 0
jne 0x40446a
mov edx, dword [esp + 0x30]
mov dword [0x45cc98], edx
push 0x452960
push 0x4445c0
push 0x4445c4
push 0x44fa30
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [0x45cc98]
cmp eax, 1
jne 0x404497
mov ecx, esi
call fcn.004045c0
jmp 0x4044b1
cmp eax, 2
jne 0x4044a5
mov ecx, esi
call fcn.00404c00
jmp 0x4044b1
cmp eax, 3
jne 0x4044b6
mov ecx, esi
call fcn.00405050
mov eax, dword [0x45cc98]
cmp eax, 4
jne 0x4044c2
mov ecx, esi
call fcn.00406170
cmp dword [0x45ac94], 0
je 0x4044e1
cmp dword [0x45396c], 6
jb 0x4044e1
push 0
lea ecx, [esi + 0x120]
call fcn.0040f9c7
xor eax, eax
mov ecx, dword [esp + 0x2110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20f8]
xor ecx, esp
call fcn.00425324
mov esp, ebp
pop ebp
ret