Function at 0x421b40
Capabilities:
Delete file

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx + 4]
push edi
mov dword [esp + 0x14], ecx
mov ebp, 0x402e9c
call fcn.00421710
mov ebx, eax
cmp ebx, 2
jbe 0x421b7b
cmp word [edi], 0x5c
jne 0x421b7b
cmp word [edi + 2], 0x5c
jne 0x421b7b
add edi, 4
mov ebp, 0x402e88
sub ebx, 2
push ebp
call fcn.004241c8
add eax, ebx
lea eax, [eax + eax + 4]
push eax
call fcn.004121f0
mov esi, eax
add esp, 8
test esi, esi
je 0x421c4f
push ebp
push esi
call fcn.004241a4
push ebx
push edi
push esi
call fcn.004243d1
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x421be3
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x10]
push esi
mov dword [edx + 8], 6
call fcn.00412210
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x421c2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
push esi
mov dword [eax + 8], 6
call fcn.00412210
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x421c46
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], 6
push esi
call fcn.00412210
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret

Function at 0x423580
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
mov eax, dword [esi + 0x48]
je 0x4235f9
test eax, eax
jne 0x42361e
mov dword [esi + 0x48], 1
call fcn.0040a680
test eax, eax
je 0x4235a7
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
call fcn.0040a680
test eax, eax
je 0x4235e8
mov eax, dword [esi + 0x40]
push edi
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esi + 0x40]
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edx
call edi
pop edi
call fcn.0040a680
test eax, eax
je 0x42361e
mov dword [esi + 0x4c], 1
ret
test eax, eax
je 0x42361e
mov eax, dword [esi + 0x4c]
test eax, eax
mov dword [esi + 0x48], 0
je 0x42361e
mov eax, dword [esi + 0x40]
push 0
push eax
mov dword [esi + 0x4c], 0
call dword [sym.imp.USER32.dll_FlashWindow]
ret

Function at 0x423d10
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x42b018]
test eax, eax
jne 0x423d7f
push 0x14
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [0x42b018], eax
je 0x423d7f
mov ecx, dword [esp + 8]
push 0
push 0
mov dword [eax], ecx
push 0
mov dword [eax + 0xc], 0
push 0
mov dword [eax + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [0x42b018]
lea edx, [esp]
push edx
push 0
push ecx
push 0x423cf0
push 0
push 0
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x42b018]
mov dword [ecx + 4], eax
pop ecx
ret 4