Function at 0x41e690
Capabilities:
Create directory
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60093e
mov eax, dword fs:[0]
push eax
sub esp, 0x7f4
mov eax, dword [0x69ee98]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x578], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x580], eax
call fcn.00485933
mov edi, eax
test edi, edi
je 0x41efe6
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x590], eax
push 0xe72f
lea ecx, [ebp - 0x590]
mov dword [ebp - 4], 0
call fcn.004030c0
lea ecx, [ebp - 0x57c]
call fcn.00402dc0
mov edi, dword [ebp - 0x590]
test edi, edi
je 0x41eff0
push edi
push dword [eax]
call fcn.005e343b
mov ecx, dword [ebp - 0x57c]
add esp, 8
test eax, eax
sete byte [ebp - 0x585]
or ebx, 0xffffffff
add ecx, 0xfffffff0
mov eax, ebx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41e772
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
cmp byte [ebp - 0x585], 0
je 0x41eb6a
lea eax, [ebp - 0x36c]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x41ef9d
call fcn.00485933
mov dword [ebp - 0x578], eax
test eax, eax
je 0x41effa
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x578]
call esi
add eax, 0x10
mov dword [ebp - 0x57c], eax
lea eax, [ebp - 0x36c]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x41e7ef
movzx eax, ax
lea ecx, [ebp - 0x57c]
push eax
call fcn.004030c0
jmp 0x41e814
lea ecx, [ebp - 0x36c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e7f8
sub ecx, edx
lea eax, [ebp - 0x36c]
push ecx
push eax
lea ecx, [ebp - 0x57c]
call fcn.004038a0
push 0xe72d
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 2
call fcn.004030c0
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x580]
push eax
call fcn.00403fe0
add esp, 0xc
mov byte [ebp - 4], 3
mov edx, dword [eax]
mov esi, dword [ebp - 0x57c]
lea eax, [edx - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x58c], ecx
cmp eax, ecx
je 0x41e8d8
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x41e8c3
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x41e8c3
push dword [ebp - 0x578]
call fcn.00403750
add esp, 4
mov dword [ebp - 0x578], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x41e8b8
mov ecx, dword [ebp - 0x58c]
push ecx
mov ebx, dword [ecx]
mov edx, dword [ebx]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x578]
or ebx, 0xffffffff
lea esi, [eax + 0x10]
mov dword [ebp - 0x57c], esi
jmp 0x41e8d8
push dword [edx - 0xc]
lea ecx, [ebp - 0x57c]
push edx
call fcn.004038a0
mov esi, dword [ebp - 0x57c]
mov byte [ebp - 4], 2
mov eax, ebx
mov ecx, dword [ebp - 0x580]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41e912
mov eax, dword [ecx]
mov dword [ebp - 0x58c], eax
push ecx
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x613aec]
mov ecx, dword [ebp - 0x58c]
call ebx
or ebx, 0xffffffff
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41e930
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41eb39
call fcn.00485933
mov dword [ebp - 0x580], eax
test eax, eax
je 0x41f004
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x613aec]
mov ecx, dword [ebp - 0x580]
call edi
add eax, 0x10
mov dword [ebp - 0x578], eax
push 0xe72e
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 4
call fcn.004030c0
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x584]
push eax
call fcn.004069a0
add esp, 0xc
mov byte [ebp - 4], 5
mov edx, dword [eax]
mov edi, dword [ebp - 0x578]
lea eax, [edx - 0x10]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x580], eax
mov dword [ebp - 0x58c], ecx
cmp eax, ecx
je 0x41ea25
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x41ea10
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x41ea10
push dword [ebp - 0x580]
call fcn.00403750
add esp, 4
mov dword [ebp - 0x580], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x41ea05
mov ecx, dword [ebp - 0x58c]
push ecx
mov ebx, dword [ecx]
mov edx, dword [ebx]
mov edi, dword [edx + 4]
mov ecx, edi
call dword [0x613aec]
mov ecx, ebx
call edi
mov eax, dword [ebp - 0x580]
or ebx, 0xffffffff
lea edi, [eax + 0x10]
mov dword [ebp - 0x578], edi
jmp 0x41ea25
push dword [edx - 0xc]
lea ecx, [ebp - 0x578]
push edx
call fcn.004038a0
mov edi, dword [ebp - 0x578]
mov byte [ebp - 4], 4
mov eax, ebx
mov ecx, dword [ebp - 0x584]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ea5f
mov eax, dword [ecx]
mov dword [ebp - 0x580], eax
push ecx
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x613aec]
mov ecx, dword [ebp - 0x580]
call ebx
or ebx, 0xffffffff
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5c0], 0
push eax
mov dword [ebp - 0x5b8], 0
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x5a4], 0
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x5cc], 0x3c
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c8], 0x40
mov dword [ebp - 0x5b0], 1
mov dword [ebp - 0x5bc], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0xffffffffffffffff
push dword [ebp - 0x594]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41eb33
mov ebx, dword [edi]
push edi
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x613aec]
mov ecx, ebx
call edi
mov edi, dword [ebp - 0x590]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41ef9d
mov ebx, dword [esi]
push esi
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
jmp 0x41ef9d
push dword [ebp - 0x584]
call fcn.0048d47c
push eax
push 0x83
lea ecx, [ebp - 0x800]
call fcn.00493490
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x740]
mov dword [ebp - method.CDialog.virtual_0], vtable.CConfigDialog.0
call fcn.00418a90
mov byte [ebp - 4], 7
call fcn.00485933
mov dword [ebp - 0x584], eax
test eax, eax
je 0x41f00e
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x584]
call esi
add eax, 0x10
mov dword [ebp - 0x600], eax
push 0
push 0x674642
lea ecx, [ebp - 0x600]
mov byte [ebp - 4], 8
call fcn.004038a0
mov dword [ebp - 0x5f4], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x578]
cmp dword [ecx + 0x104], 0
je 0x41ec96
mov edx, dword [ecx + 0xd4]
mov esi, dword [ebp - 0x600]
add esi, 0xfffffff0
lea eax, [edx - 0x10]
mov dword [ebp - 0x584], eax
lea eax, [edx - 0x10]
cmp eax, esi
je 0x41ec96
cmp dword [esi + 0xc], 0
jl 0x41ec81
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x41ec81
mov eax, dword [ebp - 0x584]
push eax
call fcn.00403750
add esp, 4
mov dword [ebp - 0x584], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ec76
mov ebx, dword [esi]
push esi
mov edx, dword [ebx]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x584]
or ebx, 0xffffffff
add eax, 0x10
mov dword [ebp - 0x600], eax
jmp 0x41ec90
push dword [edx - 0xc]
lea ecx, [ebp - 0x600]
push edx
call fcn.004038a0
mov ecx, dword [ebp - 0x578]
lea eax, [ecx + 0x100]
mov dword [ebp - 0x758], eax
lea eax, [ecx + 0xcc]
mov dword [ebp - 0x754], eax
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x750]
push eax
call fcn.0041e200
mov ecx, dword [ebp - 0x578]
mov eax, dword [ecx + 0xe8]
cmp dword [eax - 0xc], 0
je 0x41ece0
dec dword [ebp - 0x750]
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0
call fcn.0049a239
push 0x12c
lea eax, [ebp - 0x13c]
mov byte [ebp - 4], 0xa
push 0
push eax
call fcn.005d7470
add esp, 0xc
lea eax, [ebp - 0x268]
push 0x12c
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [ebp - 0x580]
push 0x5c
push dword [esi]
call fcn.005d6d40
push eax
lea eax, [ebp - 0x268]
push 0x12c
push eax
call fcn.005e4447
add esp, 0x14
lea eax, [ebp - 0x13c]
push 0x12c
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ed71
sub ecx, edx
jne 0x41ed97
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x13c]
push 0x12c
push eax
call fcn.005e33e1
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
push dword [esi]
call fcn.005e343b
add esp, 8
test eax, eax
jne 0x41edc0
mov dword [ebp - 0x5fc], 1
mov dword [ebp - 0x5f8], 1
push 0x12c
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
test eax, eax
jne 0x41ede8
push 0x12c
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5c
push dword [esi]
call fcn.005d6d40
push eax
lea eax, [ebp - 0x268]
push 0x12c
push eax
call fcn.005e4447
push 0x12c
lea eax, [ebp - 0x13c]
push 0
push eax
call fcn.005d7470
add esp, 0x20
lea eax, [ebp - 0x13c]
push 0x12c
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 1]
jmp 0x41ee40
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ee40
sub ecx, edx
jne 0x41ee66
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x13c]
push 0x12c
push eax
call fcn.005e33e1
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
push dword [esi]
call fcn.005e343b
add esp, 8
test eax, eax
jne 0x41ee8f
mov dword [ebp - 0x5fc], 1
mov dword [ebp - 0x5f8], 1
push str.system.ini
push 0x104
lea eax, [ebp - 0x470]
push eax
push 0x674642
push str.SCRNSAVE.EXE
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x470]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41eec0
sub ecx, edx
je 0x41ef19
push 0x104
lea eax, [ebp - 0x574]
push 0
push eax
call fcn.005d7470
add esp, 0xc
lea eax, [ebp - 0x574]
push 0x104
push eax
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push dword [esi]
lea eax, [ebp - 0x574]
push eax
call fcn.005e343b
add esp, 8
test eax, eax
jne 0x41ef19
mov dword [ebp - 0x5fc], 1
lea ecx, [ebp - 0x800]
call fcn.00493ab0
lea ecx, [ebp - 0x5e8]
call fcn.0049a268
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - method.CDialog.virtual_0], vtable.CConfigDialog.0
test eax, eax
je 0x41ef5e
mov eax, dword [eax]
push 1
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x5f4]
call esi
mov ecx, dword [ebp - 0x600]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ef87
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x740]
call fcn.00418bb0
lea ecx, [ebp - 0x800]
call fcn.004934ef
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41efc8
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
int3