Function at 0x404960
Capabilities:
Check if file exists
Create process on windows
Create thread
Get file attributes
Hide graphical window
Print debug messages
Terminate process

Disassembly:
sub esp, 0xc
push 0
push 0
push 0
push 0x404900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.C:Program_Files_rw_bin_rw.exe
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40499a
push str.Have_No_SoftWare
push str.report
call fcn.00401830
add esp, 8
push ebx
push ebp
push esi
push edi
push str.Begin_reg
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push str.taskkill__f__im_rw.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push str.rw.exe
call fcn.00403be0
add esp, 4
test eax, eax
jne 0x4049e8
push eax
push eax
push eax
push str.C:Program_Files_rw_bin_rw.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0x14], 0
push str.vU_
push 0x434a08
call edi
mov ebp, eax
push 0
push ebp
call ebx
push 0xc8
call esi
test ebp, ebp
je 0x404a21
cmp dword [esp + 0x14], 0xa
jge 0x404a2f
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x14], eax
jl 0x4049fc
push 0
push ebp
call ebx
test ebp, ebp
jne 0x404a8f
push ebp
push str.taskkill__f__im_rw.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1388
call esi
push str.rw.exe
call fcn.00403be0
add esp, 4
test eax, eax
jne 0x404a70
push eax
push eax
push eax
push str.C:Program_Files_rw_bin_rw.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x64
call esi
push str.vU_
push 0x434a08
call edi
mov ebp, eax
test ebp, ebp
je 0x404b2a
push 0
push ebp
call ebx
mov edi, 5
push 0
push ebp
call ebx
push 0x3e8
call esi
dec edi
jne 0x404a94
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
push 0x43a524
push str.Static
inc ecx
push 0
push ebp
mov dword [esp + 0x24], ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
test edi, edi
je 0x404ad8
push str.FInd_Reg_Button
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 0x201
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x202
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1f4
call esi
xor edi, edi
lea eax, [esp + 0x10]
push eax
call fcn.00403c60
add esp, 4
test eax, eax
jne 0x404b43
push 0x3e8
call esi
mov ecx, dword [esp + 0x10]
push 0
push ecx
call ebx
inc edi
cmp edi, 0x14
jl 0x404b01
jmp 0x404b57
push str.Havent_find_the_Window:UserLogin
push str.report
call fcn.00401830
add esp, 8
push 0
call fcn.0040d11f
push str.Find_Reg_Window
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [esp + 0x10]
push 0
push edx
call ebx
mov edi, 0x14
mov eax, dword [esp + 0x10]
push 0
push eax
call ebx
push 0x1f4
call esi
dec edi
jne 0x404b5c
mov ecx, dword [esp + 0x10]
xor edi, edi
push edi
push ecx
call ebx
push 0x434c4c
mov dword [0x43a520], edi
mov dword [0x43a51c], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00403e20
add esp, 8
push 0x3e8
call esi
push edi
push edi
push edi
push 0x404ef0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00403e50
mov edi, eax
add esp, 4
test edi, edi
jne 0x404bd7
cmp dword [esp + 0x14], 2
jle 0x404aab
push 0xbb8
call esi
test edi, edi
mov dword [0x43a51c], 1
je 0x404c3d
push str.succ
call fcn.004016d0
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
add esp, 4
push 0
push 0
push 0x10
push edx
call edi
mov eax, dword [esp + 0x10]
push 0x43a524
push str.Button
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0
mov esi, eax
push 0
push 0x201
push esi
call edi
push 0
push 0
push 0x202
push esi
call edi
push str.succ
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret