Function at 0x403ea0
Capabilities:
Create process on windows
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.windowinit
mov ecx, edi
call fcn.00411e7e
test al, al
je 0x403ee4
add esi, 0xffffffe0
call fcn.00403e40
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
push str.click
mov ecx, edi
call fcn.00411e7e
test al, al
je 0x404103
mov eax, dword [edi + 0x108]
cmp eax, dword [esi + 0x4a0]
jne 0x403f2c
push 0
push 0xf020
push 0x112
lea ecx, [esi - 0x20]
call fcn.0040d569
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [esi + 0x4a4]
je 0x4040fb
cmp eax, dword [esi + 0x4ac]
je 0x4040fb
cmp eax, dword [esi + 0x4c0]
jne 0x403fec
cmp byte [0x474ad2], 0
je 0x404103
mov eax, dword [esi + 0x708]
test eax, eax
js 0x403fc4
cmp eax, 8
jge 0x403fc4
push str.._update.local
lea edx, [ebp - 0x20c]
call fcn.004096f0
add esp, 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
add esi, 0xffffffe0
push esi
push 0x404f00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x404103
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi - 0x1c]
push 0x40
push 0x468bd4
push 0x468c40
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [esi + 0x4a8]
jne 0x404057
mov eax, dword [esi + 0x708]
test eax, eax
js 0x40402f
cmp eax, 8
jge 0x40402f
mov ecx, dword [esi + 0x4a8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
push 0
call eax
lea ecx, [esi - 0x20]
call fcn.004041b0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi - 0x1c]
push 0x40
push 0x468bd4
push 0x468c60
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [edx + 0xc0]
call eax
mov ecx, dword [edi + 0x108]
mov edx, dword [ecx]
cmp eax, 0xffff0001
jne 0x4040c9
mov eax, dword [edx + 0xb8]
push 0x46872c
call eax
mov ecx, eax
call fcn.00411e8f
test al, al
je 0x404103
mov ecx, dword [edi + 0x108]
mov edx, dword [ecx]
mov eax, dword [edx + 0xb8]
call eax
mov ecx, eax
call fcn.00411bf7
mov ecx, dword [esi - 0x1c]
push 1
push 0
push 0
push eax
push str.OPEN
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edx + 0xc0]
call eax
cmp eax, 0xffff0002
jne 0x404103
push ebx
mov ebx, dword [edi + 0x108]
add esi, 0xffffffe0
push esi
call fcn.00404120
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043db8a
mov esp, ebp
pop ebp
ret 4