Function at 0x408410
Capabilities:
Create process on windows
Delete file
Read .ini file
Set registry value

Disassembly:
sub esp, 0x858
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [esp + 0x86c]
push ebp
movzx eax, bx
cmp eax, 0x64
jg 0x40844c
je 0x40857b
cmp eax, 1
je 0x40847d
cmp eax, 2
je 0x40929c
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x858
ret
cmp eax, 0x78
jg 0x408462
je 0x408a2f
cmp eax, 0x6e
je 0x408cd6
jmp case.0x408476.211
sub eax, 0xc8
cmp eax, 0xc8
ja case.0x408476.211
xor ecx, ecx
mov cl, byte [eax + 0x409354]
jmp dword [ecx*4 + 0x409324]
cmp dword [0x410358], 0
je 0x40929c
cmp byte [0x40e9e0], 0
je 0x409288
mov edi, dword [esp + 0x86c]
push 1
push edi
call fcn.00403250
add esp, 8
test eax, eax
je 0x409314
push 0x40e9e0
push 0
push str.ThemeColorBPP
push str.MasterThemeSelector
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esp + 0x568], eax
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push 0xc
push ebp
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 0xe
push ebp
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul esi, eax
push ebp
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, 1
cmp esi, dword [esp + 0x568]
jl 0x408509
xor eax, eax
mov dword [0x40e9d0], eax
test eax, eax
je 0x4090ce
cmp dword [0x40e7c4], 0
jne 0x4090ce
push 0x154
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push edi
call esi
test eax, eax
jne 0x408545
push 0x15e
push edi
call esi
test eax, eax
je 0x4090ce
push 0
mov eax, dword [0x40e488]
push 0x409640
mov ecx, dword [0x40e1d0]
push eax
mov ebp, dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x14
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x4090c5
push 0xf
call fcn.00405740
add esp, 4
jmp 0x409314
shr ebx, 0x10
movzx eax, bx
dec eax
cmp eax, 9
ja case.0x408593.5
xor ecx, ecx
mov cl, byte [eax + 0x409434]
jmp dword [ecx*4 + 0x409420]
mov eax, dword [esp + 0x874]
push 0
push 0
and eax, 0xffff
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x4103dc], 1
mov dword [0x4103d8], eax
jne case.0x408593.5
cmp dword [0x4103e0], 0
jne case.0x408593.5
mov esi, 1
jmp case.0x408593.5
mov dword [0x4103d8], 0xffffffff
xor esi, esi
mov dword [0x4103dc], esi
mov dword [0x4103e0], esi
jmp case.0x408593.5
mov dword [0x4103dc], 1
cmp dword [0x4103d8], 0xffffffff
je case.0x408593.5
mov ecx, dword [0x40ed64]
cmp dword [0x4103d8], ecx
je case.0x408593.5
mov esi, 1
jmp case.0x408593.5
xor esi, esi
mov eax, dword [0x40ed64]
push esi
mov dword [0x4103dc], esi
mov dword [0x4103e0], 1
push eax
push 0x14e
mov eax, dword [esp + 0x880]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x408a22
mov ebp, dword [0x4103d8]
mov ebx, dword [0x40ed64]
push 0x7f02
mov dword [0x40ed64], ebp
mov dword [0x410358], 1
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
test ebp, ebp
jne 0x4086be
push 0x410328
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e9e0
call esi
push 0x40e1e0
push 0x40ed70
call esi
push 0x40e9e0
call fcn.00409d10
call fcn.00409440
call fcn.004095f0
jmp 0x409300
cmp ebp, 1
jne 0x4086f5
cmp dword [0x41035c], 0
je 0x4086f5
push 0x40ebb0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e9e0
call esi
push 0x40e560
push 0x40e9e0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40e4a0
jmp 0x40869e
mov eax, dword [0x40e234]
sub eax, ebp
cmp eax, 1
jne 0x4088db
cmp byte [0x40e9e0], 0
je 0x408713
call fcn.004010e0
mov edi, dword [esp + 0x86c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebp, ebp
lea eax, [esp + 0x364]
push 0x410468
push eax
call esi
lea eax, [esp + 0x364]
push 0x40e500
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x364]
push 0x40e500
mov dword [esp + 0x164], 0x4c
mov dword [esp + 0x168], edi
mov dword [esp + 0x170], 0x40eb50
mov dword [esp + 0x174], ebp
mov dword [esp + 0x178], ebp
mov dword [esp + 0x17c], 1
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], 0x100
mov dword [esp + 0x188], ebp
mov dword [esp + 0x18c], ebp
mov dword [esp + 0x190], 0x40e8d0
mov dword [esp + 0x194], 0x40e240
mov dword [esp + 0x198], 0x1804
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x19c], eax
lea eax, [esp + 0x160]
push eax
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x40888c
lea eax, [esp + 0x364]
push eax
call fcn.004059e0
add esp, 4
test eax, eax
jne 0x408850
lea eax, [esp + 0x568]
push 0x200
push eax
mov ecx, dword [0x40e1d0]
push 0x11
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x364]
lea edx, [esp + 0x568]
push ecx
push edx
push 0x40e5c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x40e488]
push 0x10
push 0x40e430
push 0x40e5c0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x364]
push eax
call fcn.004059e0
add esp, 4
test eax, eax
je 0x408722
lea eax, [esp + 0x364]
push eax
call fcn.00408300
add esp, 4
test eax, eax
jne 0x4086a5
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x409314
call sub.comdlg32.dll_CommDlgExtendedError
cmp eax, 2
je 0x4088a0
cmp eax, 9
je 0x4088a0
cmp eax, 0xa
jne 0x4088aa
push 0xd
call fcn.00405740
add esp, 4
mov eax, dword [esp + 0x874]
push 0
push ebx
and eax, 0xffff
push 0x14e
mov dword [0x40ed64], ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x858
ret
mov edi, dword [esp + 0x874]
push 0x40ed70
and edi, 0xffff
push ebp
push 0x148
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x40e8d0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e9e0
call esi
push 0x40ed70
push 0x40e9e0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40e500
push 0x40e9e0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40e9e0
call fcn.004059e0
add esp, 4
test eax, eax
jne 0x4086a5
lea eax, [esp + 0x568]
push 0x200
push eax
mov ecx, dword [0x40e1d0]
push 0x10
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x568]
push 0x40e9e0
push ecx
push 0x40e5c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x40e488]
push 0x10
push 0x40e430
push 0x40e5c0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push ebp
push 0x144
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x146
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x40e234], eax
mov dword [0x40ed64], ebx
cmp ebx, ebp
jle 0x4089c6
dec ebx
mov dword [0x40ed64], ebx
push 0x40e8d0
push 0x40e9e0
call esi
push 0x40e9e0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebp
add eax, 0x40e9e0
mov ecx, dword [0x40ed64]
push eax
push ecx
push 0x148
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x40e500
push 0x40e9e0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
mov ecx, dword [0x40ed64]
push ecx
push 0x14e
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x409300
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x858
ret
lea eax, [esp + 0x568]
push 0x200
push eax
mov ecx, dword [0x40e1d0]
push 0x20
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x568]
push 0x40ed70
push ecx
push 0x40e5c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x40e488]
push 0x24
push 0x40e430
push 0x40e5c0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x409314
push 0x40e9e0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x408b0a
push 0x64
mov eax, dword [0x40e488]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0
mov eax, dword [0x40ed64]
push eax
push 0x144
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x146
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov dword [0x40e234], eax
push 0
push 0x14e
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
movzx eax, si
push eax
mov ecx, dword [0x40e488]
mov dword [0x40ed64], 0
push 0x90064
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x409314
lea eax, [esp + 0x568]
push 0x200
push eax
mov ecx, dword [0x40e1d0]
push 0x12
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x568]
push 0x40ed70
push ecx
push 0x40e5c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x40e488]
push 0x10
push 0x40e430
push 0x40e5c0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x409314
mov dword [esp + 0x364], 0
cmp byte [0x40e9e0], 0
je 0x408bb3
lea eax, [esp + 0x568]
push 0x40e9e0
push 0x200
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x410328
push str.SCRNSAVE.EXE
push str.boot
call esi
cmp byte [esp + 0x568], 0
je 0x408bcd
mov dword [esp + 0x364], 1
jmp 0x408bcd
lea eax, [esp + 0x364]
push 0
push eax
push 0
push 0x10
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [esp + 0x364], 0
je 0x409314
cmp byte [0x40e9e0], 0
je 0x408c27
push 0x40e9e0
push 0x200
push 0x40e5c0
push 0x410328
push str.SCRNSAVE.EXE
push str.boot
call esi
push 0x200
push 0x40e5c0
call fcn.00402ed0
add esp, 8
push 1
push 0x40e5c0
call fcn.00402f80
add esp, 8
jmp 0x408c47
push str.SYSTEM.INI
push 0x200
push 0x40e5c0
push 0x410328
push str.SCRNSAVE.EXE
push str.boot
call esi
push 0x40e5c0
push str._s__s
push 0x40ddc0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
push 0x40ddc0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x409314
mov edi, dword [esp + 0x86c]
push edi
call fcn.004033f0
add esp, 4
test eax, eax
jne 0x409314
push 0xe
call fcn.00405740
add esp, 4
jmp 0x409314
call fcn.004010e0
push 0x40e9e0
call fcn.00409d10
call fcn.00401150
push eax
push 0x190
mov eax, dword [0x40e488]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
call ebp
mov dword [0x410358], 1
jmp 0x409314
mov edi, dword [esp + 0x86c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x60]
push 0x40e3a0
mov dword [esp + 0x14], 1
push eax
call esi
lea eax, [esp + 0x60]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0x4c
mov dword [esp + 0x20], 0x40eb50
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
push 0x40e500
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x40e8d0
mov dword [esp + 0x48], 0x40ed10
mov dword [esp + 0x4c], 6
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x14]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
test eax, eax
je 0x408f2a
lea eax, [esp + 0x60]
push eax
call ebp
mov ebx, eax
push 0x40e500
call ebp
sub ebx, eax
push 0x40e500
lea ebx, [esp + ebx + 0x64]
call ebp
push eax
push 0x40e500
push 0x40e500
call ebp
push eax
push ebx
push 0x20001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x408e7f
lea eax, [esp + 0x60]
push eax
call fcn.004057d0
lea eax, [esp + 0x64]
add esp, 4
push 0x40e500
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x60]
push eax
call fcn.004098a0
add esp, 4
test eax, eax
je 0x408e7f
lea eax, [esp + 0x160]
push 0x200
push eax
mov ecx, dword [0x40e1d0]
push 0x22
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x60]
lea edx, [esp + 0x568]
push ecx
push edx
call esi
lea ecx, [esp + 0x364]
push 0x200
push ecx
mov edx, dword [0x40e1d0]
push 0x25
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x364]
lea edx, [esp + 0x568]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x160]
push 0x134
lea edx, [esp + 0x56c]
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x408e7f
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], 0
je 0x408ce9
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [esp + 0x60]
push eax
call fcn.004018b0
add esp, 4
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x40e1c4], 0
jne 0x408f58
lea eax, [esp + 0x568]
push 0x200
push eax
mov ecx, dword [0x40e1d0]
push 0x14
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x60]
push ecx
call fcn.00405790
lea ecx, [esp + 0x56c]
add esp, 4
push eax
push ecx
push 0x40e5c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x40e488]
push 0x10
push 0x40e430
push 0x40e5c0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x409314
call sub.comdlg32.dll_CommDlgExtendedError
cmp eax, 2
je 0x408f3e
cmp eax, 9
je 0x408f3e
cmp eax, 0xa
jne 0x408f48
push 0xc
call fcn.00405740
add esp, 4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x858
ret
lea eax, [esp + 0x60]
push eax
push 0x40e5c0
call esi
push 0x40e5c0
call fcn.00405790
add esp, 4
mov byte [eax], 0
push 0x40e8d0
push 0x40e5c0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
lea eax, [esp + 0x60]
push eax
jne 0x40909b
call fcn.00405790
add esp, 4
push eax
push 0x40e5c0
call esi
push 0x40e5c0
call fcn.004057d0
add esp, 4
mov eax, dword [0x40e488]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x40e5c0
push 0xffffffffffffffff
push 0x158
push 0x64
push eax
call edi
cmp eax, 0xffffffff
je 0x40900b
cmp eax, 1
jne 0x408fdd
cmp dword [0x41035c], 0
jne 0x40900b
test eax, eax
je 0x40900b
push 0
push eax
push 0x144
mov eax, dword [0x40e488]
push 0x64
push eax
call edi
push 0
mov eax, dword [0x40e488]
push 0
push 0x146
push 0x64
push eax
call edi
mov dword [0x40e234], eax
push 0x40e5c0
mov eax, dword [0x40e234]
dec eax
mov ecx, dword [0x40e488]
push eax
push 0x14a
push 0x64
push ecx
call edi
cmp eax, 0xfffffffe
je 0x409314
push 0
mov eax, dword [0x40e488]
push 0
push 0x146
push 0x64
push eax
call edi
push 0
mov dword [0x40e234], eax
sub eax, 2
mov ecx, dword [0x40e488]
push eax
mov dword [0x40ed64], eax
push 0x14e
push 0x64
push ecx
call edi
lea ecx, [esp + 0x60]
push ecx
push 0x40e9e0
call esi
push 0x40e9e0
call fcn.00405790
add esp, 4
push eax
push 0x40ed70
call esi
push 0x40ed70
call fcn.004057d0
add esp, 4
call fcn.00409440
jmp 0x409314
call fcn.00408300
add esp, 4
test eax, eax
jne 0x409314
cmp byte [0x40e9e0], 0
je 0x4090b9
call fcn.004010e0
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x409314
cmp eax, 2
je 0x409314
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x40e9d0], 0
je 0x4090f8
cmp dword [0x40e484], 3
je 0x409314
call fcn.004010e0
xor eax, eax
cmp dword [0x40e9d0], eax
je 0x409124
cmp dword [0x40e484], 2
jne 0x409124
mov dword [0x40e418], eax
mov dword [0x40e420], eax
mov dword [0x40e424], eax
call fcn.00401110
cmp dword [0x41035c], 0
jne 0x4091b2
lea eax, [esp + 0x568]
push 0x40ebb0
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
lea ecx, [esp + 0x568]
push 0x40e560
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x568]
push eax
call fcn.004018b0
add esp, 4
cmp dword [0x40e1c4], 0
je 0x4091b8
push 0x40e4a0
push 1
push 0x14a
push 0x64
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
call edi
cmp eax, 0xfffffffe
je 0x4091b8
push 0
mov eax, dword [0x40e488]
mov dword [0x41035c], 1
push 0
push 0x146
push 0x64
push eax
call edi
mov dword [0x40e234], eax
jmp 0x4091b8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e9e0
call fcn.00401e40
add esp, 4
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x40ed64], 1
jne 0x4091ef
cmp dword [0x41035c], 0
jne 0x40927c
lea eax, [esp + 0x364]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 2
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push Ordinal_2
call ebp
test eax, eax
je 0x409244
lea eax, [esp + 0x568]
lea ecx, [esp + 0x364]
push eax
push ecx
push 0
push 2
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x410328
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push Ordinal_2
call ebp
test eax, eax
jne 0x40927c
push 0x40e9e0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebp
inc eax
mov ecx, dword [esp + 0x364]
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x40e9e0
push 1
push 0
push 0
push ecx
call ebp
mov ecx, dword [esp + 0x364]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x410358], 0
jmp 0x40928e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00401720
cmp bx, 0x190
je 0x409314
jmp 0x4092a2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0x40e488]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x41035c], 0
je 0x4092fb
lea eax, [esp + 0x568]
push 0x40ebb0
push eax
call esi
lea eax, [esp + 0x568]
push 0x40e560
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x568]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00401700
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x858
ret