Function at 0x43cac0
Capabilities:
Delete file
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e818
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c6150]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x24], 0
je 0x43cb03
push 0x5c080c
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0x80800000
push eax
call fcn.004da58d
mov eax, dword [edi + 4]
test eax, eax
jne 0x43cb3b
mov ecx, dword [ebp + 8]
call fcn.00450c80
push str.m_pMainFrame_is_null
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov al, byte [eax + 0x6f8]
test al, al
je 0x43cd15
cmp dword [0x5d1f0c], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
je 0x43cb90
push str.Local_sgim_evt_reinstall
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 1
push 0x800c
push dword [0x5d1f0c]
mov esi, eax
call ebx
test esi, esi
je 0x43cb90
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x24], 0
jne 0x43caee
mov esi, dword [edi + 4]
add esi, 0x6b4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x10], 0
je 0x43ccf5
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov ecx, dword [edi + 4]
call fcn.00417c70
mov eax, dword [0x5c6ad0]
mov ecx, 0x593394
mov dword [ebp + 0x14], eax
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x43cbf0
movzx eax, cx
lea ecx, [ebp + 0x14]
push eax
call fcn.00413df0
jmp 0x43cc22
push 0x593394
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x43cc22
push esi
lea ecx, [ebp + 0x14]
call fcn.00413af0
test eax, eax
je 0x43cc22
lea eax, [esi + esi]
push eax
push 0x593394
push dword [ebp + 0x14]
call fcn.004d9a60
add esp, 0xc
mov dword [ebp - 4], 0
call fcn.00419360
push eax
lea ecx, [ebp + 0x18]
call fcn.00413cb0
push 0
push 0
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 1
mov esi, dword [ebp + 0x10]
mov ecx, esi
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042b2c0
lea ecx, [ebp + 0x18]
mov bl, al
call fcn.00413c80
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00413c80
test bl, bl
jne 0x43cc9e
mov ecx, dword [edi + 4]
call fcn.00417cb0
xor ecx, ecx
call fcn.004192d0
push ecx
mov ecx, dword [edi + 4]
push 0xf060
push 0x112
add ecx, 4
call fcn.004150d0
jmp 0x43caee
mov eax, dword [edi + 4]
test eax, eax
je 0x43cce9
cmp dword [eax + 4], 0
je 0x43cce9
mov ecx, dword [eax + 0x7c8]
test ecx, ecx
je 0x43ccc2
movss xmm1, dword [0x5af500]
call fcn.0043a4a0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00424940
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 0x10]
call fcn.00413c80
mov ecx, edi
call fcn.0043bea0
jmp 0x43d0c0
mov eax, dword [0x5d1f0c]
test eax, eax
je 0x43d0c0
push 0
push 2
push 0x800c
push eax
call ebx
push 0
call fcn.004e3198
mov eax, dword [ebp + 0x18]
mov ecx, 0x5d58dc
push 0x5da558
mov dword [eax], 1
call fcn.0047aa00
cmp eax, 1
jne 0x43cfa1
mov eax, dword [edi + 4]
push 0
push 0
push 0x50a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call fcn.00423ae0
mov eax, dword [edi + 4]
cmp byte [eax + 0x7ec], 0
je 0x43cf96
cmp dword [ebp + 0x10], 0
je 0x43d0c0
mov eax, dword [0x5c6ad0]
mov esi, 0x5920ac
mov ebx, esi
mov dword [ebp - 0x10], eax
shr ebx, 0x10
test bx, bx
jne 0x43cd91
movzx eax, si
lea ecx, [ebp - 0x10]
push eax
call fcn.00413df0
jmp 0x43cdc6
push 0x5920ac
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 0x18], eax
test eax, eax
je 0x43cdc6
push eax
lea ecx, [ebp - 0x10]
call fcn.00413af0
test eax, eax
je 0x43cdc6
mov eax, dword [ebp + 0x18]
add eax, eax
push eax
push 0x5920ac
push dword [ebp - 0x10]
call fcn.004d9a60
add esp, 0xc
mov dword [ebp - 4], 2
mov eax, dword [0x5c6ad0]
mov dword [ebp + 0x18], eax
test bx, bx
jne 0x43cde8
movzx eax, si
lea ecx, [ebp + 0x18]
push eax
call fcn.00413df0
jmp 0x43ce1a
push 0x5920ac
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x43ce1a
push esi
lea ecx, [ebp + 0x18]
call fcn.00413af0
test eax, eax
je 0x43ce1a
lea eax, [esi + esi]
push eax
push 0x5920ac
push dword [ebp + 0x18]
call fcn.004d9a60
add esp, 0xc
push 0
push 5
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 0x10]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042b2c0
lea ecx, [ebp + 0x18]
mov bl, al
call fcn.00413c80
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00413c80
mov eax, dword [ebp + 0x14]
test bl, bl
jne 0x43d0bd
mov byte [eax], 1
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x43cf73
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [eax + 0x94]
call ebx
mov eax, dword [0x5c6ad0]
mov ecx, 0x59565c
mov dword [ebp + 0x10], eax
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x43cea0
movzx eax, cx
lea ecx, [ebp + 0x10]
push eax
call fcn.00413df0
jmp 0x43ced2
push 0x59565c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x43ced2
push esi
lea ecx, [ebp + 0x10]
call fcn.00413af0
test eax, eax
je 0x43ced2
lea eax, [esi + esi]
push eax
push 0x59565c
push dword [ebp + 0x10]
call fcn.004d9a60
add esp, 0xc
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 4
mov ecx, dword [edi + 4]
push eax
call fcn.00417150
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00413c80
mov ecx, dword [edi + 4]
call fcn.00417100
mov eax, dword [edi + 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43cf73
push str.quitevent
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [edi + 4]
mov esi, eax
push esi
call fcn.00417cf0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 4]
push 0
push dword [ecx + 4]
call ebx
mov eax, dword [edi]
push esi
cmp eax, vtable.UpWorkerThread.0
jne 0x43cf6e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push 0x5957cc
call fcn.00412090
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp + 8]
push 0x5957cc
call fcn.00412090
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
jmp 0x43d0c0
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x43d0c0
mov eax, dword [0x5c6ad0]
mov esi, 0x5920ac
mov edi, esi
mov dword [ebp + 0x18], eax
shr edi, 0x10
test di, di
jne 0x43cfd1
movzx eax, si
lea ecx, [ebp + 0x18]
push eax
call fcn.00413df0
jmp 0x43d006
push 0x5920ac
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
test ebx, ebx
je 0x43d003
push ebx
lea ecx, [ebp + 0x18]
call fcn.00413af0
test eax, eax
je 0x43d003
lea eax, [ebx + ebx]
push eax
push 0x5920ac
push dword [ebp + 0x18]
call fcn.004d9a60
add esp, 0xc
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], 5
mov eax, dword [0x5c6ad0]
mov dword [ebp + 0x10], eax
test di, di
jne 0x43d028
movzx eax, si
lea ecx, [ebp + 0x10]
push eax
call fcn.00413df0
jmp 0x43d05a
push 0x5920ac
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x43d05a
push esi
lea ecx, [ebp + 0x10]
call fcn.00413af0
test eax, eax
je 0x43d05a
lea eax, [esi + esi]
push eax
push 0x5920ac
push dword [ebp + 0x10]
call fcn.004d9a60
add esp, 0xc
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x18]
push 0
push 5
push eax
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 6
push eax
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.0042b2c0
lea ecx, [ebp + 0x10]
mov bl, al
call fcn.00413c80
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00413c80
mov eax, dword [ebp + 0x14]
test bl, bl
jne 0x43d0bd
push 0x5957cc
mov ecx, esi
mov byte [eax], 1
call fcn.00412090
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov byte [eax], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14