Function at 0x4035f0
Capabilities:
Create thread
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x415b2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebp
push esi
push edi
mov ebp, ecx
push 0x138
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x120], edi
je 0x403637
mov ecx, eax
call fcn.00404fe0
jmp 0x403639
xor eax, eax
mov ecx, eax
mov dword [esp + 0x120], 0xffffffff
mov dword [ebp + 0x24], eax
call fcn.00405080
test eax, eax
je 0x403874
mov ecx, dword [ebp + 0x24]
call fcn.004052e0
test eax, eax
je 0x403874
cmp ebp, edi
je 0x40366f
lea eax, [ebp + 0x1c]
jmp 0x403671
xor eax, eax
mov ecx, dword [ebp + 0x24]
push edi
push eax
call fcn.00405300
test eax, eax
je 0x403874
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3f0
push eax
mov dword [ebp + 0x28], 1
call esi
push edi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov ecx, dword [ebp + 4]
push 0x3eb
push ecx
call esi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x41a494
push eax
call ebx
mov edx, dword [ebp + 4]
push 0x3ee
push edx
call esi
push 1
push eax
call edi
mov eax, dword [ebp + 4]
push 0x3ee
push eax
call esi
push 0x41a48c
push eax
call ebx
mov ecx, dword [ebp + 4]
push 0x3ef
push ecx
call esi
push 0
push eax
call edi
mov edi, dword [ebp + 0x34]
mov esi, dword [ebp + 0x30]
cmp edi, edi
mov dword [esp + 0x10], edi
je 0x40377b
mov ecx, dword [esi]
mov eax, dword [edi]
cmp ecx, eax
mov dword [esp + 0x14], eax
je 0x40376d
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x403720
mov edx, dword [0x41a034]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x403727
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x403758
mov ebx, dword [eax - 8]
mov ecx, esi
push ebx
call fcn.00404d80
test eax, eax
je 0x40376d
mov edx, dword [esp + 0x14]
mov ecx, dword [esi]
push ebx
lea eax, [ebx + 1]
push edx
push eax
push ecx
call fcn.00404100
mov edx, dword [esi]
add esp, 0x10
mov dword [edx - 8], ebx
mov eax, dword [esi]
mov byte [eax + ebx], 0
jmp 0x40376d
mov ecx, esi
call fcn.00404e20
mov eax, dword [edi]
mov dword [esi], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
add edi, 4
add esi, 4
cmp edi, eax
jne 0x403700
mov ebx, dword [ebp + 0x34]
mov edi, esi
cmp esi, ebx
je 0x4037b6
mov eax, dword [edi]
mov edx, dword [0x41a034]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4037af
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4037af
mov edx, dword [edi]
sub edx, 0xc
push edx
call fcn.00414a60
add esp, 4
add edi, 4
cmp edi, ebx
jne 0x403784
xor ebx, ebx
mov dword [ebp + 0x34], esi
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], 1
mov dword [ebp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp + 0x44], eax
lea eax, [esp + 0x18]
push 0x104
push eax
call esi
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, dword [ebp + 0x24]
push 3
call fcn.00405370
push ebx
lea edx, [esp + 0x1c]
push 0x26
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40381c
mov ecx, dword [ebp + 0x24]
lea eax, [esp + 0x18]
push 1
push eax
push 3
call fcn.00405370
lea ecx, [esp + 0x18]
push 0x104
push ecx
call esi
mov edi, str.:Documents_and_Settings_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x19]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x24]
push 3
call fcn.00405370
push ebp
push ebx
push 0x404060
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
xor eax, eax
pop ebx
jmp 0x4038a9
mov edx, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f0
push edx
mov dword [ebp + 0x28], edi
call esi
push edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 4]
push 0x3eb
push eax
call esi
push 0x41a42c
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x118
ret 0xc