Function at 0x41e600
Capabilities:
Hide graphical window
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x41e608
push ecx
push ebx
xor eax, eax
push ebp
push 0x41e906
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00408530
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x10]
mov eax, 0x41e91c
call fcn.00409154
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x41e93c
call fcn.00404478
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x422cf4]
call fcn.00404d84
pop edx
call fcn.00404848
call fcn.004030b0
call fcn.00419b88
test al, al
je 0x41e8eb
mov al, 1
call fcn.0041bda4
mov byte [ebp - 1], 0
mov eax, 1
call fcn.00419c30
mov edx, 1
mov eax, 0x28
call fcn.0041bcd8
lea edx, [ebp - 0x14]
mov eax, dword [0x422d28]
mov eax, dword [eax]
call fcn.00412848
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.004190dc
mov edx, dword [ebp - 0x18]
mov cl, 1
pop eax
call fcn.0041d5b0
mov ebx, eax
mov edx, 2
mov eax, 0x28
call fcn.0041bcd8
test bl, bl
je 0x41e6ee
push 2
lea eax, [ebp - 0x1c]
call fcn.004190dc
mov eax, dword [ebp - 0x1c]
call fcn.0040462c
push eax
call sub.kernel32.dll_SetFileAttributesA
call fcn.00417120
push edx
push eax
call fcn.00418bd0
test bl, bl
je 0x41e7e5
call fcn.00418414
test eax, eax
jle 0x41e7e5
call fcn.00419904
mov ebx, eax
call fcn.0041849c
cmp ebx, eax
jne 0x41e735
call fcn.0041e4d8
test al, al
jne 0x41e735
cmp dword [0x422c70], 1
jne 0x41e7e5
call fcn.00419884
mov ebx, eax
call fcn.00418414
cmp ebx, eax
jle 0x41e7e5
call fcn.0041e41c
test al, al
je 0x41e7e5
lea eax, [ebp - 0x20]
call fcn.004191c8
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
call fcn.00419144
mov eax, dword [ebp - 0x24]
pop edx
call fcn.0041d4a0
test al, al
je 0x41e7e5
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x422cf4]
call fcn.00404d84
mov edx, 0x41e94c
call fcn.00404848
call fcn.004030b0
mov byte [ebp - 1], 1
call fcn.00417120
push edx
push eax
call fcn.00418cec
call fcn.00419904
call fcn.00418e00
call fcn.0041db04
mov ebx, eax
test bl, bl
je 0x41e7c3
call fcn.0041e524
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x422cf4]
call fcn.00404d84
mov edx, 0x41e970
call fcn.00404848
call fcn.004030b0
cmp dword [0x422c70], 1
jne 0x41e8db
mov eax, 0x3e8
call fcn.0040ce78
push 0
mov eax, dword [0x4238c0]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 1], 0
jne 0x41e8db
mov eax, dword [0x422cf4]
mov dl, byte [0x422c60]
call fcn.00403000
mov dl, 0x20
call fcn.00402fb0
push eax
call fcn.0041a0d4
mov edx, eax
pop eax
call fcn.00403000
call fcn.004030b0
cmp byte [0x422c60], 0
jne 0x41e8a0
call fcn.0041a0d4
test al, al
jne 0x41e8a0
lea eax, [ebp - 8]
mov edx, 0x41e994
call fcn.00404220
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov eax, 0x41e9d4
call fcn.00418aac
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.00404220
lea eax, [ebp - 0x2c]
call fcn.00418818
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00418a34
push eax
lea eax, [ebp - 0x30]
call fcn.004188c8
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0040d0e0
jmp 0x41e8db
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x41e9e0
call fcn.00418aac
lea eax, [ebp - 0x34]
call fcn.00418818
mov eax, dword [ebp - 0x34]
push eax
call fcn.00418a34
push eax
push 0
lea eax, [ebp - 0x38]
call fcn.004189b8
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov eax, 1
call fcn.0040d164
lea eax, [ebp - 0x3c]
call fcn.004190dc
mov eax, dword [ebp - 0x3c]
call fcn.00407138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e90d
lea eax, [ebp - 0x3c]
mov edx, 0xe
call fcn.004041ac
ret