Function at 0x433d00
Capabilities:
Accept command line arguments
Create thread
Delete file
Find taskbar
Persist via run registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e597b
mov eax, dword fs:[0]
push eax
sub esp, 0xd9c
mov eax, dword [0x50e5d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd60], ecx
mov ecx, dword [ebp - 0xd60]
call fcn.004ab824
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jge 0x433d5b
xor eax, eax
jmp 0x434833
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x120]
call fcn.004018b0
mov dword [ebp - 4], 0
push 0
push 0x4f3618
lea ecx, [ebp - 0x120]
call fcn.00401560
cmp eax, 0xffffffff
je 0x433d96
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004015f0
push eax
call dword [sym.imp.ui_d.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetInstance_struct_HINSTANCE____]
add esp, 4
lea eax, [ebp - 0xcf8]
push eax
call dword [sym.imp.ui_d.dll_public:_static_class_DuiLib::CDuiString___cdecl_DuiLib::CPaintManagerUI::GetInstancePath_void_]
add esp, 4
mov dword [ebp - 0xd64], eax
mov ecx, dword [ebp - 0xd64]
mov dword [ebp - 0xd68], ecx
mov byte [ebp - 4], 1
push 0x4f3620
lea edx, [ebp - 0xd3c]
push edx
mov ecx, dword [ebp - 0xd68]
call dword [sym.imp.ui_d.dll_public:_class_DuiLib::CDuiString___thiscall_DuiLib::CDuiString::operator_char_const__]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xd70]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CDuiString::operator_char_const__void_const]
push eax
call dword [sym.imp.ui_d.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourcePath_char_const__]
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd3c]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcf8]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac40
push eax
mov ecx, dword [ebp - 0xd60]
add ecx, 0x74
call dword [sym.imp.ui_d.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Subclass_struct_HWND____]
mov ecx, dword [ebp - 0xd60]
add ecx, 0x74
call fcn.00419710
mov ecx, dword [ebp - 0xd60]
add ecx, 0x74
call fcn.0041b700
push str.GlobalDFEREQG_T7_0000
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x51a1b4], eax
push str.GlobalDFEREQG_T7_1111
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x51a1b8], eax
push str.GlobalDRAW_T7_0000
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x51a1bc], eax
mov ecx, 0x51ab04
call fcn.0043b0d0
test eax, eax
je 0x433ec2
mov dword [0x514e70], 1
jmp 0x433ecc
mov dword [0x514e70], 0
call fcn.004325a0
mov dword [ebp - 0x230], eax
mov cl, byte [0x4eef43]
mov byte [ebp - 0x44c], cl
push 0x103
push 0
lea edx, [ebp - 0x44b]
push edx
call fcn.004c36d0
add esp, 0xc
mov al, byte [0x4eef97]
mov byte [ebp - 0x33c], al
push 0x103
push 0
lea ecx, [ebp - 0x33b]
push ecx
call fcn.004c36d0
add esp, 0xc
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x104
lea edx, [ebp - 0x44c]
push edx
push 0x4ef239
push 0x4f3674
push 0x4f367c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x433f8a
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x4f3684
push 0x4f3688
push 0x4f3690
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x4f3698
push 0x4f36b0
push 0x4f36b8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x104
lea eax, [ebp - 0x33c]
push eax
push 0x4ef23a
push 0x4f36c0
push 0x4f36c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x433fda
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x4f36d0
push 0x4f36e8
push 0x4f36f0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call dword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
je 0x434006
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push str.16777215
push 0x4f3704
push 0x4f3710
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x434026
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push str._2147483630
push str.ForeColor
push 0x4f3730
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 0xd60]
add ecx, 0x74
call fcn.0041af30
lea ecx, [ebp - 0x770]
call fcn.004a2b40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x770]
call fcn.004a2b90
test eax, eax
je 0x43409a
lea ecx, [ebp - 0xd40]
push ecx
lea ecx, [ebp - 0x770]
call fcn.004a2d80
mov dword [ebp - 0xd74], eax
mov edx, dword [ebp - 0xd74]
mov dword [ebp - 0xd78], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xd78]
push eax
mov ecx, 0x51aa2c
call fcn.0042f3b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd40]
call fcn.00426070
push 0x22
lea ecx, [ebp - 0x120]
call fcn.00424ff0
mov cl, byte [0x4ef23b]
mov byte [ebp - 0x764], cl
push 0x103
push 0
lea edx, [ebp - 0x763]
push edx
call fcn.004c36d0
add esp, 0xc
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x104
lea eax, [ebp - 0x764]
push eax
push 0x4ef243
push 0x4f3738
push 0x4f3740
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
ja 0x43411e
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x4f3748
push 0x4f374c
push 0x4f3754
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x434360
lea ecx, [ebp - 0x764]
push ecx
call fcn.004bf820
add esp, 4
cmp eax, 1
jne 0x434351
lea ecx, [ebp - 0x894]
call fcn.004429e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x888]
call fcn.00403be0
mov byte [ebp - 4], 6
push 0x400
lea edx, [ebp - 0xc94]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x88c], eax
lea eax, [ebp - 0xc94]
add eax, 0xffffffff
mov dword [ebp - 0xd7c], eax
mov ecx, dword [ebp - 0xd7c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0xd7d], dl
add dword [ebp - 0xd7c], 1
cmp byte [ebp - 0xd7d], 0
jne 0x43417d
mov edi, dword [ebp - 0xd7c]
mov eax, dword [0x4f375c]
mov dword [edi], eax
mov cx, word [0x4f3760]
mov word [edi + 4], cx
push 0x2001f
push ecx
mov ecx, esp
mov dword [ebp - 0xd44], esp
push 0x4f3764
call fcn.004018b0
mov dword [ebp - 0xd84], eax
push SysReAllocString
lea ecx, [ebp - 0x894]
call fcn.00442a30
mov dword [ebp - 0xd88], eax
cmp dword [ebp - 0xd88], 0
je 0x434331
lea edx, [ebp - 0x888]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0xd48], esp
push 0x4f3794
call fcn.004018b0
mov dword [ebp - 0xd8c], eax
lea ecx, [ebp - 0x894]
call fcn.00442a80
mov dword [ebp - 0xd90], eax
cmp dword [ebp - 0xd90], 0
je 0x4342de
push 0x22
lea ecx, [ebp - 0x888]
call fcn.00424ff0
push 0x4ef24b
push 0x4f379c
lea ecx, [ebp - 0x888]
call fcn.004029f0
push 0
push 0
lea ecx, [ebp - 0x888]
call fcn.00401c40
push eax
call fcn.004dfe61
add esp, 8
test eax, eax
jne 0x434289
lea eax, [ebp - 0xc94]
push eax
lea ecx, [ebp - 0x888]
call fcn.00424f00
test eax, eax
jne 0x434289
jmp 0x4342dc
push ecx
mov ecx, esp
mov dword [ebp - 0xd4c], esp
lea edx, [ebp - 0xc94]
push edx
call fcn.004018b0
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xd98], eax
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0xd50], esp
push 0x4f37a4
call fcn.004018b0
mov dword [ebp - 0xd9c], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x894]
call fcn.00442b90
jmp 0x434331
push ecx
mov ecx, esp
mov dword [ebp - 0xd54], esp
lea edx, [ebp - 0xc94]
push edx
call fcn.004018b0
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0xda4], eax
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0xd58], esp
push 0x4f37ac
call fcn.004018b0
mov dword [ebp - 0xda8], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x894]
call fcn.00442b90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x888]
call fcn.00426070
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x894]
call fcn.00442a10
jmp 0x434360
lea ecx, [ebp - 0x764]
push ecx
call fcn.004bf820
add esp, 4
push 0x51a9c4
lea ecx, [ebp - 0x778]
call fcn.004031f0
mov byte [ebp - 4], 9
push 0x4f37b4
lea ecx, [ebp - 0x778]
call fcn.004029d0
mov dl, byte [0x4ef253]
mov byte [ebp - 0x11c], dl
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.004c36d0
add esp, 0xc
lea ecx, [ebp - 0x778]
call fcn.00401600
push eax
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
push 0x4ef4d2
push 0x4f37c8
push 0x4f37d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
ja 0x4343f2
mov dword [0x51a158], 1
mov ecx, 0x51aa0c
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x340]
call fcn.00403be0
mov byte [ebp - 4], 0xa
mov dl, byte [0x4ef4d3]
mov byte [ebp - 0x65c], dl
push 0x103
push 0
lea eax, [ebp - 0x65b]
push eax
call fcn.004c36d0
add esp, 0xc
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x104
lea ecx, [ebp - 0x65c]
push ecx
push 0x4ef4f6
push str.InstDt
push 0x4f37e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x65c]
push edx
lea ecx, [ebp - 0x340]
call fcn.00401e60
mov al, byte [0x4ef4f7]
mov byte [ebp - 0x554], al
push 0x103
push 0
lea ecx, [ebp - 0x553]
push ecx
call fcn.004c36d0
add esp, 0xc
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x104
lea edx, [ebp - 0x554]
push edx
push 0x4ef50d
push str.xmagic
push 0x4f37f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x554]
push eax
mov ecx, 0x51ab00
call fcn.00401e60
mov cl, byte [0x4ef50e]
mov byte [ebp - 0x884], cl
push 0x103
push 0
lea edx, [ebp - 0x883]
push edx
call fcn.004c36d0
add esp, 0xc
push 0
push 0
mov ecx, 0x51a9d0
call fcn.00401c40
push eax
call fcn.004dfe61
add esp, 8
test eax, eax
jne 0x434538
mov ecx, 0x51a9d0
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x434536
mov ecx, 0x51aa0c
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x51a248], 1
mov dword [0x51a15c], 1
jmp 0x434549
mov ecx, 0x51a9d0
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x51a158], 0
jne 0x43455b
cmp dword [0x51a15c], 0
je 0x43456f
push 0
push 0x5dc
push 0x10
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac10
push 0
call fcn.00439510
add esp, 4
push 0
mov eax, dword [0x51a168]
mov edx, dword [eax]
mov ecx, dword [0x51a168]
mov eax, dword [edx + 0xcc]
call eax
push 0
mov ecx, dword [0x51a164]
mov edx, dword [ecx]
mov ecx, dword [0x51a164]
mov eax, dword [edx + 0xcc]
call eax
mov cl, byte [0x4ef50f]
mov byte [ebp - 0x22c], cl
push 0x103
push 0
lea edx, [ebp - 0x22b]
push edx
call fcn.004c36d0
add esp, 0xc
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x104
lea eax, [ebp - 0x22c]
push eax
push 0x4ef53e
push 0x4f37f8
push 0x4f3800
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x43460b
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, 0x51ab08
call fcn.00401e60
mov ecx, 0x51ab08
call fcn.00402bb0
push 0
push 0x4f3808
lea ecx, [ebp - 0x120]
call fcn.00401560
cmp eax, 0xffffffff
jne 0x434635
cmp dword [0x51a248], 0
je 0x4346a0
push 0
push 0x4f3810
lea ecx, [ebp - 0x120]
call fcn.00401560
cmp eax, 0xffffffff
je 0x434656
mov dword [0x51a238], 1
push 1
push 0
mov edx, dword [ebp - 0xd60]
mov ecx, dword [edx + 0x88]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CWindowWnd::ShowWindow_bool__bool_]
push 0x41
push 0
push 0
push 0
push 0xfffffe9e
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xd60]
add ecx, 0x74
call dword [sym.imp.ui_d.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [0x51a24c], 1
jmp 0x43473d
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0xc9c], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0xc98], eax
push 0
push 0x4f381c
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xca4], eax
lea ecx, [ebp - 0xcb4]
call fcn.004d8e90
lea eax, [ebp - 0xcb4]
push eax
mov ecx, dword [ebp - 0xca4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0xca8]
sub edx, dword [ebp - 0xcb0]
mov dword [ebp - 0xca0], edx
push 0x41
push 0
push 0
mov eax, dword [ebp - 0xc98]
sub eax, 0x257
sub eax, dword [ebp - 0xca0]
push eax
mov ecx, dword [ebp - 0xc9c]
sub ecx, 0x165
push ecx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xd60]
add ecx, 0x74
call dword [sym.imp.ui_d.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0x4b0
push 4
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac10
push 0
push 0x2710
push 1
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac10
push 0
push 0x9c4
push 7
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac10
push 0
push 0x493e0
push 9
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac10
cmp dword [0x514e70], 0
jne 0x4347aa
push 0
push 0x2710
push 0xe
mov ecx, dword [ebp - 0xd60]
call fcn.0043ac10
push 0
push 0
mov edx, dword [ebp - 0xd60]
push edx
push 0x4399c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x774], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x774]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xd60]
call fcn.004339f0
mov dword [ebp - 0xd5c], 1
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x340]
call fcn.00426070
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x778]
call fcn.00426070
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x770]
call fcn.004a2b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00426070
mov eax, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee8a
mov esp, ebp
pop ebp
ret