Function at 0x403860
Capabilities:
Copy file
Create directory
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x449828
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4038a6
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x58], 0
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4038d8
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x58], 1
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403907
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x58], 2
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403936
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
lea esi, [esp + 0x1c]
mov byte [esp + 0x58], 3
call fcn.00410e20
push str.static.ini
mov ecx, esi
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00405920
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x5c], 4
call fcn.00401f40
mov byte [esp + 0x58], 3
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40399d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.unists.exe
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00405920
add esp, 0xc
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x5c], 5
call fcn.00401f40
mov byte [esp + 0x58], 3
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4039e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403a02
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov byte [esp + 0x58], 6
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x64
or eax, ecx
jge 0x403a38
push 0x64
lea ecx, [esp + 0x28]
call fcn.00402140
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x34]
push ebx
push 0x64
push esi
push 0x451c5c
push str.inner
push str.cqss
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004328f3
add esp, 8
test eax, eax
jl 0x40413a
cmp eax, dword [esi - 8]
jg 0x40413a
xor ecx, ecx
push ecx
add ebx, 0xfffffff0
mov dword [esi - 0xc], eax
mov dword [esp + 0x48], esp
mov edi, esp
push ebx
mov word [esi + eax*2], cx
mov dword [esp + 0x48], ebx
call fcn.00402190
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00411260
add esp, 4
test eax, eax
je 0x403b8d
lea edx, [esp + 0x24]
push 0x451f34
push edx
call fcn.00405a00
add esp, 8
test al, al
je 0x403b8d
add esi, 0xfffffff0
mov byte [esp + 0x58], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403ae3
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x58], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x58], 1
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b26
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov byte [esp + 0x58], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x58], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b73
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [esp + 0x28]
call fcn.00410f20
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403bb0
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x58], 7
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403bdf
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x20]
push ecx
push 0x1a
mov byte [esp + 0x60], 8
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x403c1c
lea ebx, [esp + 0x20]
lea esi, [esp + 0x14]
call fcn.00411510
push 8
push 0x451f38
lea ecx, [esp + 0x1c]
call fcn.00405e30
mov edi, dword [esp + 0x14]
push ecx
lea eax, [edi - 0x10]
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.00402190
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00411260
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
test eax, eax
jne 0x403c5f
push 0
push edi
call ebx
push 1
push 0x451f4c
lea ecx, [esp + 0x1c]
call fcn.00405e30
push 4
push str.cqss
lea ecx, [esp + 0x1c]
call fcn.00405e30
mov edi, dword [esp + 0x14]
push ecx
lea eax, [edi - 0x10]
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.00402190
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00411260
add esp, 4
test eax, eax
jne 0x403cab
push eax
push edi
call ebx
push 1
push 0x451f4c
lea ecx, [esp + 0x1c]
call fcn.00405e30
push 0x451f50
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00405920
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 9
call fcn.00401f40
mov byte [esp + 0x58], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403d06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 3
push ecx
lea eax, [ebx - 0x10]
mov dword [esp + 0x4c], esp
mov edi, esp
push eax
mov dword [esp + 0x48], eax
call fcn.00402190
mov ebx, dword [ebp + 8]
add esp, 4
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.00404e70
mov edi, dword [esp + 0x14]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x48], esp
mov dword [esp + 0x24], esp
push edi
call fcn.00402190
mov ecx, dword [esp + 0x28]
add eax, 0x10
add esp, 4
mov dword [ecx], eax
call fcn.00404220
push ecx
mov dword [esp + 0x48], esp
mov dword [esp + 0x24], esp
push edi
call fcn.00402190
mov edx, dword [esp + 0x28]
add esp, 4
add eax, 0x10
push ebx
mov dword [edx], eax
call fcn.00404ba0
push ecx
mov dword [esp + 0x48], esp
mov ebx, esp
push edi
call fcn.00402190
add eax, 0x10
add esp, 4
mov dword [ebx], eax
call fcn.00404410
push ecx
mov dword [esp + 0x48], esp
mov ebx, esp
push edi
call fcn.00402190
add eax, 0x10
add esp, 4
mov dword [ebx], eax
call fcn.00404150
lea eax, [esi - 0x10]
push eax
mov dword [esp + 0x48], eax
call fcn.00402190
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x20], esi
push 0x5c
mov byte [esp + 0x5c], 0xa
mov ebx, dword [esi - 0xc]
push esi
call fcn.00432a50
add esp, 8
test eax, eax
jne 0x403dee
or eax, 0xffffffff
jmp 0x403df2
sub eax, esi
sar eax, 1
sub ebx, eax
dec ebx
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x28]
call fcn.00405800
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x5c], 0xb
call fcn.00401f40
mov byte [esp + 0x58], 0xa
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.static.ini
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00405920
add esp, 0xc
mov byte [esp + 0x58], 0xc
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push 0x451c5c
push 0x451f64
push str.cqss
call esi
mov ecx, dword [esp + 0x18]
push ecx
push 0x451c5c
push 0x451f6c
push str.cqss
call esi
mov edx, dword [esp + 0x18]
push edx
push 0x451f74
push 0x451f78
push str.cqss
call esi
mov eax, dword [esp + 0x18]
push eax
push 0x451f84
push 0x451f8c
push str.cqss
call esi
mov ecx, dword [esp + 0x18]
push ecx
push 0x451c5c
push str.Install
push str.cqss
call esi
mov edx, dword [esp + 0x18]
push edx
push 0x451c5c
push str.DName
push str.cqss
call esi
mov eax, dword [esp + 0x18]
push eax
push 0x451fb0
push str.hotkey
push str.cqss
call esi
mov ecx, dword [esp + 0x18]
push ecx
push 0x451fc8
push str.hotName
push str.cqss
call esi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push edx
push eax
push str.filename
push str.cqss
call esi
mov ecx, dword [esp + 0x18]
push ecx
push 0x451f34
push str.inner
push str.cqss
call esi
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push 5
push edx
push 0x451ed0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push str.static.ini
lea edx, [esp + 0x20]
push edx
push ecx
call fcn.00405920
mov esi, dword [ebp + 8]
add esp, 0xc
push esi
call fcn.00404e70
push 4
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push 0x452000
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.00405920
add esp, 0xc
push esi
call fcn.00404e70
push 5
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x45200c
call fcn.00402520
push esi
call fcn.00404e70
push ecx
mov dword [esp + 0x4c], esp
mov ebx, esp
push edi
call fcn.00402190
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [ebx], eax
call fcn.00404fd0
cmp dword [esi + 0xc4], 0
je 0x403fe3
mov dword [esi + 0xc4], 0
mov byte [esp + 0x58], 0xa
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404008
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x58], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40402d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x58], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40404f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x58], 6
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40406d
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov byte [esp + 0x58], 3
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404092
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x58], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x40]
mov byte [esp + 0x58], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x44]
mov byte [esp + 0x58], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x58], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404123
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401000
int3