Function at 0x41317c
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create directory
Create process on windows
Create process suspended
Delete file
Get common file path
Hide graphical window
Link many functions at runtime
Log keystrokes
Log keystrokes via application hook
Move file
Resume thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc78
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x384], edx
mov dword [ebp - 0x388], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4143af
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004069ac
mov eax, dword [ebp - 4]
fstp qword [eax + 0x1ec]
wait
push 0x4143c0
mov eax, dword [0x419810]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
push eax
push 1
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
fld qword [eax + 0x188]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x1ec]
fnstsw ax
sahf
jae 0x41322a
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
call fcn.00403644
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x194]
call fcn.00403644
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x414384
cmp byte [0x41979c], 0
je 0x413255
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
call fcn.00403644
push eax
push 0x4143cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov byte [0x41979c], 0
mov eax, dword [ebp - 4]
call fcn.004130f8
test al, al
je 0x414384
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c0], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1ac], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1a8], edx
xor eax, eax
mov dword [ebp - 0x48], eax
xor edx, edx
push ebp
push 0x41437a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14d]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x388]
lea edx, [ebp - 0x14d]
mov ecx, 0x105
call fcn.00403454
mov eax, dword [ebp - 0x388]
push eax
lea eax, [ebp - 0x384]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x204]
mov ecx, 0x414420
call fcn.0040bc58
mov edx, dword [ebp - 0x384]
mov eax, dword [ebp - 4]
add eax, 0x190
call fcn.0040327c
lea eax, [ebp - 0x384]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
call fcn.00403480
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov ecx, 1
call fcn.00403684
mov eax, dword [ebp - 0x384]
mov edx, 0x414440
call fcn.00403590
je 0x413384
mov eax, dword [ebp - 4]
add eax, 0x190
mov edx, 0x414440
call fcn.00403488
mov eax, dword [ebp - 4]
add eax, 0x228
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x190]
call fcn.0040327c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
add eax, 0x190
mov ecx, 0x41444c
call fcn.004034cc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1f8], edx
push 0x414454
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x4134e8
push 0x15b3
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, 0xffffff7f
je 0x4134e8
call fcn.00402de0
jmp 0x414384
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x41343a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x190]
lea eax, [ebp - 0x384]
mov edx, 0x414470
call fcn.004034cc
mov ecx, dword [ebp - 0x384]
mov dl, 1
mov eax, dword [0x405008]
call fcn.004073b4
call fcn.00402d40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
call fcn.00412f24
test al, al
je 0x4134a5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x190]
lea eax, [ebp - 8]
mov ecx, 0x41448c
call fcn.004034cc
lea eax, [ebp - 0x380]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x37c], 3
mov eax, dword [ebp - 8]
call fcn.00403644
mov dword [ebp - 0x378], eax
mov word [ebp - 0x370], 0x414
lea eax, [ebp - 0x380]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4134e8
mov eax, dword [ebp - 4]
inc dword [eax + 0x1f8]
mov eax, dword [ebp - 4]
push dword [eax + 0x228]
push 0x41444c
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
call fcn.00405c64
push dword [ebp - 0x384]
mov eax, dword [ebp - 4]
add eax, 0x190
mov edx, 3
call fcn.00403540
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
call fcn.00403644
push eax
call sub.kernel32.dll_CreateDirectoryA_1
test eax, eax
je 0x4133fe
mov eax, dword [ebp - 4]
add eax, 0x1fc
mov edx, 0x414498
call fcn.0040327c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
je 0x41354b
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
call fcn.00405c64
mov edx, dword [ebp - 0x384]
mov eax, dword [ebp - 4]
add eax, 0x1fc
call fcn.00403488
cmp dword [ebp - 0x48], 0
je 0x41355f
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x48], eax
call fcn.0040263c
mov eax, dword [ebp - 4]
add eax, 0x190
mov edx, 0x414440
call fcn.00403488
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x74]
mov byte [ebx + 0x24], 1
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x190]
call fcn.0040327c
mov eax, dword [ebp - 4]
add eax, 0x21c
call fcn.00403228
mov eax, dword [ebp - 4]
add eax, 0x220
call fcn.00403228
mov eax, dword [ebp - 4]
add eax, 0x228
call fcn.00403228
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x234]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a0]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x4144a8
call fcn.00410e2c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x228], 0
jne 0x413616
call fcn.00402de0
jmp 0x414384
call fcn.004069ac
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x188]
fnstsw ax
sahf
jbe 0x413655
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
call fcn.00403644
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x194]
call fcn.00403644
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 4]
call fcn.004121d4
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1fc]
lea eax, [ebp - 0x384]
mov edx, 0x4144bc
call fcn.004034cc
mov eax, dword [ebp - 0x384]
call fcn.00403644
push eax
push 0x2774
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4136b9
call fcn.00402de0
jmp 0x414384
push 0x64
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c0], ebx
test ebx, ebx
jne 0x4136e6
call fcn.00402de0
jmp 0x414384
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x190]
mov eax, dword [ebp - 4]
add eax, 0x228
call fcn.004034cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
call fcn.00403644
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x413758
push 0
lea edx, [ebp - 0x384]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x384]
call fcn.00403644
push eax
push 0x4144d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00402de0
jmp 0x414384
push 0x4144ec
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x413779
call fcn.00402de0
jmp 0x414384
push 0x4144f4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x413797
call fcn.00402de0
jmp 0x414384
push 0x4144fc
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x4137b5
call fcn.00402de0
jmp 0x414384
push 0x414504
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x4137d1
call fcn.00402de0
jmp 0x414384
push 0x41450c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x4137ef
call fcn.00402de0
jmp 0x414384
push 0x414514
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x41380b
call fcn.00402de0
jmp 0x414384
push 0x41451c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x413827
call fcn.00402de0
jmp 0x414384
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
xor ecx, ecx
mov edx, 0x64
call fcn.004027ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
mov dword [eax + 0x58], 1
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41386d
call fcn.00402de0
jmp 0x414384
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0xba]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
mov byte [eax + 0x4a], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x9a]
mov byte [eax + 0x49], dl
push 0
mov eax, dword [ebp - 0x14]
push eax
push esi
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4138af
call fcn.00402de0
jmp 0x414384
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x32]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c0]
mov byte [edx + 0x3f], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
cmp byte [eax + 0x3f], 0
jne 0x413902
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12a], 0
jne 0x413906
mov eax, dword [ebp - 4]
cmp byte [eax + 0x13a], 0
jne 0x413906
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x413902
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
jne 0x413906
xor eax, eax
jmp 0x413908
mov al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c0]
mov byte [edx + 0x51], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
cmp byte [eax + 0x51], 0
je 0x41392f
mov edx, dword [ebp - 4]
cmp byte [edx + 0x15a], 0
jne 0x413933
xor edx, edx
jmp 0x413935
mov dl, 1
mov byte [eax + 0x52], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
cmp byte [eax + 0x51], 0
je 0x413953
mov edx, dword [ebp - 4]
cmp byte [edx + 0x16a], 0
jne 0x413957
xor edx, edx
jmp 0x413959
mov dl, 1
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x22]
xor dl, 1
mov byte [eax + 0x3e], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x14a]
mov byte [eax + 0x54], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
cmp byte [eax + 0x3f], 0
jne 0x41398f
cmp byte [eax + 0x3e], 0
jne 0x41398f
cmp byte [eax + 0x54], 0
je 0x4139b3
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4139b3
call fcn.00402de0
jmp 0x414384
push 0
mov eax, dword [ebp - 0x14]
push eax
push edi
push 4
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4139d4
call fcn.00402de0
jmp 0x414384
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1c0]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x230]
mov byte [ebx + 0x61], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x45], 0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x47], 0
mov byte [ebx + 0x46], 0
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x10a]
mov byte [ebx + 0x50], al
xor eax, eax
mov byte [ebx + 0x3c], al
test al, al
je 0x413a72
push 0xfffffffffffffff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowRect
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1fc]
lea eax, [ebp - 0x384]
mov edx, 0x41452c
call fcn.004034cc
mov eax, dword [ebp - 0x384]
call fcn.00403644
push eax
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1a4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1a4], 0
jne 0x413ac3
call fcn.00402de0
jmp 0x414384
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21c], 0
jne 0x413ad9
call fcn.00402de0
jmp 0x414384
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x21c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x190]
lea eax, [ebp - 8]
call fcn.004034cc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
je 0x413b1e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x190]
mov eax, dword [ebp - 4]
add eax, 0x220
call fcn.004034cc
lea eax, [ebp - 0x14d]
mov edx, dword [ebp - 8]
call fcn.00406110
lea eax, [ebp - 0x194]
xor ecx, ecx
mov edx, 0x44
call fcn.004027ec
mov word [ebp - 0x164], 0
mov dword [ebp - 0x168], 0x81
lea edx, [ebp - 0x384]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x384]
call fcn.00403644
push eax
push 0x414544
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
add eax, 0x1a8
push eax
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
call fcn.00403644
push eax
push 0
push 4
push 0xffffffffffffffff
push 0
push 0
push 0
lea eax, [ebp - 0x14d]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x413f24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b0]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c0]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x413be6
xor eax, eax
call fcn.00412b74
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
call fcn.00412bbc
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
fld qword [eax + 0x188]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x1ec]
fnstsw ax
sahf
jb 0x413c0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c4], 0
jne 0x413c2c
push 0x2b67
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
push eax
call sub.user32.dll_WaitForInputIdle
call fcn.004069ac
fstp qword [ebp - 0x3c]
wait
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1b8], edx
jmp 0x413c6d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c4], 0
jne 0x413c8e
push 0x16
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
push eax
push 0x412934
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b4]
push eax
call sub.user32.dll_EnumThreadWindows
call fcn.004069ac
fsub qword [ebp - 0x3c]
fld xword [0x41455c]
fcompp
fnstsw ax
sahf
jbe 0x413c8e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b8], 0
je 0x413c42
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b8], 0
jne 0x413ca6
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c4], 1
jmp 0x413cc5
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b4]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
call fcn.00412544
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c4], 0
jne 0x413f24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c0]
mov dword [edx + 0x30], eax
cmp dword [ebp - 0x28], 0
je 0x413cfe
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [ebp - 0x28], eax
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x37
call sub.kernel32.dll_Sleep
call fcn.00411dd4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8a], 0
je 0x413d56
push 0x44
mov eax, dword [0x41b6a4]
push eax
mov eax, dword [0x41b6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x413efa
push 0x54
mov eax, dword [0x41b6a4]
push eax
mov eax, dword [0x41b6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x413efa
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c4], 0
jne 0x413f16
cmp byte [0x41b6a8], 0
je 0x413dd4
push 0x14
mov eax, dword [0x41b6a4]
push eax
mov eax, dword [0x41b6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
push eax
call sub.user32.dll_InvalidateRect
mov byte [0x41b6a8], 0
call fcn.00411dd4
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x8a]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c0]
mov byte [edx + 0x3d], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c5], 0
je 0x413e10
cmp dword [ebp - 0x24], 0
je 0x413e10
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c5], 0
je 0x413edc
cmp word [0x41b692], 0
jne 0x413eba
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x11a], 0
je 0x413e73
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x413e8b
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
call fcn.00411dd4
push 0
push 0
push 0x406
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
push eax
call sub.user32.dll_InvalidateRect
jmp 0x413ebf
call fcn.00411dd4
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c6], 1
mov eax, dword [ebp - 4]
mov dword [0x41b694], eax
mov dword [0x41b690], 0x414578
cmp byte [0x419794], 0
je 0x413efa
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
push eax
call sub.user32.dll_PostMessageA
push 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x413d7e
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414384
cmp dword [ebp - 0x48], 0
je 0x413f40
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b4]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
je 0x413fbf
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040c7a4
cmp al, 2
jne 0x413f84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040c578
call fcn.00411dd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040c43c
call fcn.00411dd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
call fcn.00403644
mov edx, eax
lea eax, [ebp - 0x384]
call fcn.004033dc
mov eax, dword [ebp - 0x384]
call fcn.00405ed8
mov eax, dword [ebp - 8]
call fcn.00403644
mov edx, eax
lea eax, [ebp - 0x384]
call fcn.004033dc
mov eax, dword [ebp - 0x384]
call fcn.00405ed8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x234]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x414034
inc ebx
xor esi, esi
lea ecx, [ebp - 0x388]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x234]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x388]
call fcn.00403644
mov edx, eax
lea eax, [ebp - 0x384]
call fcn.004033dc
mov eax, dword [ebp - 0x384]
call fcn.00405ed8
inc esi
dec ebx
jne 0x413ff7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x41404d
mov eax, dword [ebp - 0x44]
call fcn.00412bbc
mov eax, dword [ebp - 0x40]
call fcn.00412b74
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1ac], 0
je 0x414068
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1a8], 0
je 0x414083
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [0x41b690], eax
mov dword [0x41b694], eax
cmp dword [ebp - 0x18], 0
je 0x4140b2
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x1c], 0
je 0x4140c1
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x20], 0
je 0x4140ed
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4140db
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x4140e2
push 0
call sub.user32.dll_MessageBeep
call fcn.00411dd4
cmp dword [ebp - 0x20], 0
jne 0x4140c7
cmp dword [ebp - 0x24], 0
je 0x4140fc
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x28], 0
je 0x41410b
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x2c], 0
je 0x41411a
mov eax, dword [ebp - 0x2c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x14], 0
je 0x414129
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c0], 0
je 0x414175
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x30], edx
xor edx, edx
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x38], edx
mov byte [eax + 0x3c], 0
mov byte [eax + 0x3d], 0
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c0]
push eax
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0x30], 0
je 0x414184
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
call fcn.00411f64
mov eax, dword [ebp - 4]
call fcn.004120cc
call fcn.00411dd4
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
call fcn.00403644
mov edx, eax
lea eax, [ebp - 0x384]
call fcn.004033dc
mov eax, dword [ebp - 0x384]
call fcn.00405ed8
test al, al
jne 0x414214
cmp dword [ebp - 0x30], 6
jne 0x4141fc
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
call fcn.00403644
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x414206
push 0x22b
call sub.kernel32.dll_Sleep
call fcn.00411dd4
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 7
jne 0x4141b2
mov eax, dword [ebp - 4]
push dword [eax + 0x190]
push 0x414570
push 0x41448c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403540
lea eax, [ebp - 0x380]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x37c], 3
mov eax, dword [ebp - 8]
call fcn.00403644
mov dword [ebp - 0x378], eax
mov word [ebp - 0x370], 0x414
lea eax, [ebp - 0x380]
push eax
call sub.shell32.dll_SHFileOperationA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
call fcn.00403480
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
add eax, 0x190
call fcn.00403754
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
call fcn.00402778
call fcn.0040263c
test eax, eax
je 0x414379
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x190]
lea eax, [ebp - 8]
mov ecx, 0x41448c
call fcn.004034cc
lea eax, [ebp - 0x380]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x37c], 3
mov eax, dword [ebp - 8]
call fcn.00403644
mov dword [ebp - 0x378], eax
mov word [ebp - 0x370], 0x414
call sub.kernel32.dll_GetTickCount
mov ebx, eax
lea eax, [ebp - 0x380]
push eax
call sub.shell32.dll_SHFileOperationA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414318
push 0x6f
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0x10], 0
je 0x414331
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x8ae
jle 0x4142fc
cmp dword [ebp - 0x10], 0
je 0x414379
lea eax, [ebp - 0x380]
xor ecx, ecx
mov edx, 0x1e
call fcn.004027ec
mov dword [ebp - 0x37c], 3
mov eax, dword [ebp - 8]
call fcn.00403644
mov dword [ebp - 0x378], eax
mov word [ebp - 0x370], 0x454
lea eax, [ebp - 0x380]
push eax
call sub.shell32.dll_SHFileOperationA
mov dword [ebp - 0x10], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4143b6
lea eax, [ebp - 0x388]
mov edx, 2
call fcn.0040324c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040324c
ret