Function at 0x402394
Capabilities:
Check os version
Create process on windows
Get common file path
Get system information on windows
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x740
mov eax, dword [0x406028]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0xa0]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x9c
push 0
push eax
mov dword [ebp - 0x718], edi
mov dword [ebp - 0x710], ebx
mov dword [ebp - 0xa4], 0x5c3a20
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x406714], edi
mov esi, 0x104
xor eax, eax
mov dword [ebp - 0x70c], eax
mov byte [0x406c20], al
push esi
push 0x406610
push 0x14
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x402435
push esi
push 0x4063f8
push 0x15
push dword [0x406714]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x402435
push esi
push 0x406508
push 0x16
push dword [0x406714]
call dword [sym.imp.USER32.dll_LoadStringA]
mov al, byte [ebx]
mov esi, ebx
jmp 0x402470
cmp al, 0x2d
je 0x402443
cmp al, 0x2f
jne 0x402465
movsx eax, byte [esi + 1]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
cmp eax, 0x51
jne 0x402465
movsx eax, byte [esi + 2]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
cmp eax, 0x54
je 0x402476
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x40243b
jmp 0x402480
mov dword [0x406728], 1
cmp dword [ebp + 0xc], 0
jne 0x403176
push 0
push str.STUFF_BOOT
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x403176
push 0xa0
lea eax, [ebp - 0x324]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [ebx]
cmp al, 0x2d
je 0x4024c0
cmp al, 0x2f
jne 0x40256c
movsx eax, byte [ebx + 1]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
cmp eax, 0x4d
jne 0x40256c
lea esi, [ebx + 2]
jmp 0x4024db
inc esi
mov bl, byte [esi]
mov byte [ebp - 0x705], bl
cmp bl, 0x20
je 0x4024da
cmp bl, 0x22
jne 0x4024ee
inc esi
mov edi, 0xa0
lea ecx, [ebp - 0x324]
push esi
mov edx, edi
call fcn.00401570
test eax, eax
js 0x403219
lea eax, [ebp - 0x324]
mov cl, byte [eax]
cmp cl, 0x20
jne 0x40251b
cmp bl, 0x22
jne 0x40252b
cmp cl, 0x22
jne 0x402524
cmp bl, cl
je 0x40252b
test cl, cl
je 0x40252b
inc eax
jmp 0x40250f
mov edx, edi
mov byte [eax], 0
lea ecx, [ebp - 0x324]
call fcn.00402127
cmp byte [ebp - 0x705], 0x22
lea ebx, [esi + eax]
mov dword [ebp - 0x710], ebx
jne 0x402559
cmp byte [ebx], 0x22
jne 0x402559
inc ebx
mov dword [ebp - 0x710], ebx
cmp byte [ebx], 0x20
jne 0x402571
inc ebx
cmp byte [ebx], 0x20
je 0x40255e
mov dword [ebp - 0x710], ebx
jmp 0x402571
mov edi, 0xa0
push edi
lea eax, [ebp - 0x324]
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
mov al, byte [ebp - 0x324]
test al, al
je 0x4025d0
cmp al, 0x5c
je 0x4025d0
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x3a
jne 0x4025d0
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0x5c
jne 0x4025d0
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x5c
jne 0x4025d0
push esi
mov edx, edi
lea ecx, [ebp - 0x324]
call fcn.00401570
test eax, eax
js 0x403219
mov edx, edi
lea ecx, [ebp - 0x324]
call fcn.00402127
push ecx
mov esi, eax
mov edx, edi
lea eax, [ebp - 0x324]
push eax
push ecx
lea ecx, [ebp - 0x284]
call fcn.00401671
test eax, eax
js 0x403219
lea eax, [ebp - 0x284]
add eax, esi
jmp 0x40261a
cmp byte [eax], 0x5c
je 0x402624
push eax
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
lea ecx, [ebp - 0x284]
cmp eax, ecx
ja 0x402607
push eax
call dword [sym.imp.USER32.dll_CharNextA]
push 0x20
mov byte [eax], 0
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x4026e6
mov edx, edi
lea ecx, [ebp - 0x284]
call fcn.00402127
add eax, 3
cmp eax, edi
jae 0x4026e6
lea eax, [ebp - 0x284]
push eax
push 0x401188
lea eax, [ebp - 0x564]
push edi
push eax
call fcn.0040160e
add esp, 0x10
test eax, eax
js 0x403219
mov byte [ebp - 0x1e4], 0
mov al, byte [ebx]
cmp al, 0x2d
je 0x402698
cmp al, 0x2f
jne 0x402806
movsx eax, byte [ebx + 1]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
cmp eax, 0x4c
jne 0x40273c
add ebx, 2
cmp byte [ebx], 0x20
jne 0x4026c2
mov al, 0x20
test al, al
je 0x4026c2
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4026b7
push ebx
mov edx, edi
lea ecx, [ebp - 0x1e4]
call fcn.00401570
test eax, eax
js 0x403219
mov al, byte [ebp - 0x1e4]
lea ecx, [ebp - 0x1e4]
jmp 0x402708
push ecx
lea eax, [ebp - 0x284]
mov edx, edi
push eax
push ecx
lea ecx, [ebp - 0x564]
call fcn.00401671
jmp 0x40267b
test al, al
je 0x40270c
inc ecx
mov al, byte [ecx]
cmp al, 0x20
jne 0x402701
mov byte [ecx], 0
mov edx, edi
lea ecx, [ebp - 0x1e4]
call fcn.00402127
add ebx, eax
mov dword [ebp - 0x710], ebx
cmp byte [ebx], 0x20
jne 0x40273c
mov al, 0x20
test al, al
je 0x402736
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x40272b
mov dword [ebp - 0x710], ebx
cmp byte [ebp - 0x1e4], 0
je 0x402806
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x284]
push eax
push 0x40114c
lea eax, [ebp - 0x144]
push edi
push eax
call fcn.0040160e
add esp, 0x14
test eax, eax
js 0x403219
push 0
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x40314b
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
mov edi, eax
push esi
mov dword [ebp - 0x71c], edi
call dword [sym.imp.KERNEL32.dll__lclose]
cmp edi, 0xffff
jg 0x403146
test edi, edi
je 0x403146
and dword [0x406730], 0
lea eax, [ebp - 0x740]
and dword [0x40671c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edi, word [ebp - 0x740]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, eax
movzx esi, dl
shr edx, 8
mov dword [ebp - 0x714], edx
cmp edi, 0xa
jae 0x40286c
lfence
mov edi, dword [edi*4 + 0x401008]
jmp 0x40289f
push ecx
lea eax, [ebp - 0x324]
mov edx, edi
push eax
push ecx
lea ecx, [ebp - 0x144]
call fcn.00401671
test eax, eax
js 0x403219
lea eax, [ebp - 0x144]
add eax, esi
jmp 0x402841
cmp byte [eax], 0x2e
je 0x40284b
push eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
lea ecx, [ebp - 0x144]
cmp eax, ecx
ja 0x40282e
push eax
call dword [sym.imp.USER32.dll_CharNextA]
push 0x406054
mov edx, edi
lea ecx, [ebp - 0x144]
mov byte [eax], 0
call fcn.004015a3
jmp 0x40276c
mov edi, 0x4064fc
jmp 0x40289f
movzx ecx, byte [edi]
cmp ecx, esi
jb 0x402881
jne 0x40289c
cmp byte [edi + 1], dl
ja 0x40289c
mov edx, eax
lea ecx, [ebp - 0x144]
call fcn.004042ce
test eax, eax
jne 0x402b32
mov edx, dword [ebp - 0x714]
add edi, 0xc
mov eax, dword [edi + 4]
test eax, eax
jne 0x402873
mov esi, dword [0x406730]
test esi, esi
jne 0x4028da
mov esi, str.Params
lea ecx, [ebp - 0x144]
mov edx, esi
call fcn.004042ce
test eax, eax
je 0x402b48
mov dword [0x406730], esi
mov dword [0x40671c], 0x406058
lea eax, [ebp - 0x144]
mov edi, 0x80
push eax
push edi
push 0x406a00
push 0x401140
push 0x401190
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40313b
lea eax, [ebp - 0x144]
push eax
push 0
push 0x40119c
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
shl eax, 0xa
mov dword [0x406960], eax
test eax, eax
jle 0x40313b
lea eax, [ebp - 0x144]
push eax
push 1
push 0x4011a8
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x406dc0], eax
test eax, eax
jle 0x40313b
lea eax, [ebp - 0x144]
push eax
push 1
push 0x4011b4
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x406b00], eax
test eax, eax
jle 0x40313b
lea eax, [ebp - 0x144]
mov esi, 0x406760
push eax
push edi
push esi
push 0x401140
push 0x4011c0
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40313b
lea eax, [ebp - 0x144]
push eax
push edi
push 0x406860
push 0x401140
push 0x4011cc
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40313b
lea eax, [ebp - 0x144]
push eax
push edi
push 0x406a80
push 0x401140
push 0x4011d4
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40313b
lea eax, [ebp - 0x144]
push eax
push edi
push 0x4068e0
push 0x401140
push 0x4011e0
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40313b
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x403176
lea eax, [ebp - 0x144]
mov esi, 0x401140
push eax
push edi
push 0x406cc0
push esi
push 0x4011e8
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x144]
push eax
push edi
push 0x406ba0
push esi
push 0x4011f4
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x144]
push eax
push edi
push 0x406b20
push esi
push 0x401200
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x406d40], 0
je 0x402b56
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
jne 0x402b56
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 8
cmp al, 0xa
jae 0x402b56
cmp dword [0x406728], 0
jne 0x403188
push 0x100
lea eax, [ebp - 0x428]
push eax
push 0
push dword [0x406714]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x402b13
push ecx
push 0x406508
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x428]
call fcn.00401671
test eax, eax
js 0x403219
push 0x10
lea eax, [ebp - 0x428]
push eax
push 0x406d40
push dword [0x406718]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403188
mov esi, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [0x406730], esi
mov dword [0x40671c], eax
jmp 0x4028ac
push ecx
push 0
push 0
push 0x10
push 0xa
jmp 0x40317f
call fcn.00402166
mov cl, byte [0x4068e0]
mov eax, 0x4068e0
test cl, cl
je 0x402b94
push 0xd
pop ebx
cmp cl, 0x5c
jne 0x402b81
lea ecx, [eax + 1]
cmp byte [ecx], 0x6e
jne 0x402b81
mov byte [eax], bl
mov eax, ecx
mov byte [eax], 0xa
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x402b6d
mov ebx, dword [ebp - 0x710]
mov al, byte [ebx]
cmp al, 0x2d
je 0x402ba2
cmp al, 0x2f
jne 0x402c6f
movsx eax, byte [ebx + 1]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
cmp eax, 0x57
jne 0x402c6f
add ebx, 2
cmp byte [ebx], 0x20
jne 0x402bcc
mov al, 0x20
test al, al
je 0x402bcc
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x402bc1
push ecx
lea eax, [ebp - 0x284]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x428]
call fcn.00401671
test eax, eax
js 0x403219
mov edx, 0x104
lea ecx, [ebp - 0x428]
call fcn.00402127
lea edx, [ebp - 0x428]
add edx, eax
mov al, byte [ebx]
cmp al, 0x20
je 0x402c35
mov ecx, edx
lea esi, [ebp - 0x428]
sub ecx, esi
test al, al
je 0x402c30
mov byte [edx], al
inc edx
inc ecx
cmp ecx, 0x104
jae 0x403219
inc ebx
mov al, byte [ebx]
cmp al, 0x20
jne 0x402c15
mov esi, 0x401140
mov byte [edx], 0
lea edx, [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x428]
call fcn.0040ff43
movzx ecx, ax
push 0xd
pop eax
cmp cx, ax
je 0x402c6f
cmp ecx, 0x13
je 0x403188
push ecx
push 0
lea eax, [ebp - 0x428]
push eax
push 0x10
jmp 0x403180
lea eax, [ebp - 0x144]
push eax
push edi
mov edi, 0x406980
push edi
push esi
push 0x401210
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x144]
push eax
push 0x80
push 0x4067e0
push esi
push 0x40121c
push dword [0x406730]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x406980], 0
mov esi, 0xa0
je 0x402dc3
push ecx
lea eax, [ebp - 0x284]
mov edx, esi
push eax
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.00401671
test eax, eax
js 0x403219
push edi
mov edx, esi
lea ecx, [ebp - 0x1e4]
call fcn.004015a3
test eax, eax
js 0x403219
cmp byte [0x4067e0], 0
je 0x402d35
push 0x401228
mov edx, esi
lea ecx, [ebp - 0x1e4]
call fcn.004015a3
test eax, eax
js 0x403219
push 0x4067e0
mov edx, esi
lea ecx, [ebp - 0x1e4]
call fcn.004015a3
test eax, eax
js 0x403219
push 0x40122c
mov edx, esi
lea ecx, [ebp - 0x1e4]
call fcn.004015a3
test eax, eax
js 0x403219
mov edi, 0x406a80
lea ecx, [ebp - 0x1e4]
push edi
mov edx, esi
call fcn.004015a3
test eax, eax
js 0x403219
push 0x401230
mov edx, esi
lea ecx, [ebp - 0x1e4]
call fcn.004015a3
test eax, eax
js 0x403219
push 0x4068e0
mov edx, esi
lea ecx, [ebp - 0x1e4]
call fcn.004015a3
test eax, eax
js 0x403219
push 1
lea eax, [ebp - 0x1e4]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
push 0x4067e0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x70c], eax
test eax, eax
jne 0x402de3
mov ecx, dword [ebp - 0x718]
call fcn.0040ff43
mov dword [0x406718], eax
test eax, eax
jne 0x402de3
push ecx
push eax
push eax
push 0x10
push 6
jmp 0x40317f
mov edx, dword [ebp - 0x71c]
lea ecx, [ebp - 0x144]
call fcn.00403f8c
movzx ecx, ax
push 0xd
pop eax
cmp cx, ax
je 0x402e09
push ecx
push 0
push 0
jmp 0x402c68
push 0x401234
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.004015a3
test eax, eax
js 0x403219
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.00402127
lea ecx, [ebp - 0xa4]
mov edx, esi
add eax, ecx
push 0x40116c
mov dword [ebp - 0x710], eax
call fcn.004015a3
test eax, eax
js 0x403219
push 0x406a00
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.004015a3
test eax, eax
js 0x403219
lea eax, [ebp - 0xa4]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
mov byte [ebp - 0x705], 0x5a
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movsx ecx, byte [ebp - 0x705]
mov edi, eax
sub ecx, 0x41
call fcn.00402091
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, dword [ebp - 0x710]
cmp esi, 2
jne 0x402eef
mov al, byte [ebp - 0x705]
lea edx, [ebp - 0xa4]
push edi
lea ecx, [ebp - 0x284]
mov byte [ebp - 0xa4], al
call fcn.0040321f
push 0xd
movzx eax, ax
pop ecx
cmp ax, cx
je 0x402f03
push 3
pop ecx
cmp ax, cx
je 0x402dff
push 0xb
pop ecx
cmp ax, cx
je 0x403188
mov al, byte [ebp - 0x705]
dec al
mov byte [ebp - 0x705], al
cmp al, 0x41
jge 0x402e81
jmp 0x402f09
mov al, byte [ebp - 0x705]
cmp al, 0x41
jge 0x40300b
push 0xa0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
lea eax, [ebp - 0xa4]
add eax, esi
push eax
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
mov esi, 0xa0
cmp byte [eax], 0x5c
je 0x402f6c
push 0x40116c
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.004015a3
test eax, eax
js 0x403219
push 0x401234
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.004015a3
test eax, eax
js 0x403219
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.00402127
lea edi, [ebp - 0xa4]
mov edx, esi
push 0x40116c
lea ecx, [ebp - 0xa4]
add edi, eax
call fcn.004015a3
test eax, eax
js 0x403219
push 0x406a00
mov edx, esi
lea ecx, [ebp - 0xa4]
call fcn.004015a3
test eax, eax
js 0x403219
lea eax, [ebp - 0xa4]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
push edi
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x284]
call fcn.0040321f
movzx ecx, ax
push 0xd
pop eax
cmp cx, ax
je 0x40300b
push 0xb
pop eax
cmp cx, ax
je 0x403188
jmp 0x402dff
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x401188
mov esi, 0x406860
mov dword [0x40672c], eax
push esi
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4030fa
add eax, 4
push 0x401240
push eax
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4030fa
push ebx
lea eax, [ebp - 0x284]
push eax
push esi
mov esi, 0x1a0
lea eax, [ebp - 0x4c4]
push esi
push eax
call fcn.0040160e
add esp, 0x14
test eax, eax
js 0x403219
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x401144
lea eax, [ebp - 0x704]
push esi
push eax
call fcn.0040160e
add esp, 0x14
test eax, eax
js 0x403219
push 0x10000
call dword [sym.imp.KERNEL32.dll_GlobalCompact]
cmp dword [0x406724], 0
jne 0x4030ba
call fcn.004042f5
mov ebx, dword [ebp - 0x70c]
test ebx, ebx
je 0x4030d7
push 0
push 0x105
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x406718]
lea eax, [ebp - 0x704]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jbe 0x403106
mov ecx, esi
call fcn.0040ff43
jmp 0x403108
push ebx
lea eax, [ebp - 0x564]
jmp 0x403057
xor eax, eax
test eax, eax
jne 0x40311e
push ecx
push eax
push eax
push 0x10
xor edx, edx
push 6
inc edx
pop ecx
call fcn.0040221e
jmp 0x403128
mov dword [0x406720], 1
test edi, edi
je 0x40318e
mov edx, edi
lea ecx, [ebp - 0xa4]
call fcn.004032ca
jmp 0x40318e
push ecx
push 0
push 0
push 0x10
push 5
jmp 0x40317f
mov edi, 0xa0
push ecx
lea eax, [ebp - 0x144]
mov edx, edi
push eax
push ecx
mov ecx, 0x406c20
call fcn.00401671
test eax, eax
js 0x403219
push ecx
push 0
push 0
push 0x10
push 3
pop eax
mov ecx, eax
jmp 0x403180
push ecx
push 0
push 0
push 0x10
push 2
pop ecx
xor edx, edx
inc edx
call fcn.0040ff43
mov ebx, dword [ebp - 0x70c]
call fcn.004041a8
cmp dword [0x406720], 0
mov dword [0x406080], 9
je 0x4031ab
call fcn.00404345
mov eax, dword [0x406718]
test eax, eax
je 0x4031bb
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
test ebx, ebx
je 0x403201
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403201
xor eax, eax
cmp dword [0x406080], eax
push 0
setne al
add eax, 0x106
push eax
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403201
push 0
push 0
push 0x12
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 4]
mov eax, dword [0x406080]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00404c50
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040215d
int3