Function at 0x40433e
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push 0x158
mov eax, 0x40b4f8
call fcn.0040b1b2
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
inc ebx
cmp edi, 0x200
je 0x40478c
cmp edi, 0x201
je 0x404700
xor ebx, ebx
cmp edi, 0x203
je 0x404477
cmp edi, 0x204
je 0x404549
cmp edi, 0x402
je 0x40451c
lea eax, [edi - 0x403]
cmp eax, 2
ja 0x40453c
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_1043]
mov dword [ebp - 0x144], eax
lea ecx, [ebp - 0x138]
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x40d4a4
push eax
mov dword [ebp - 0x140], str.BallonAction
call fcn.00401f89
push ecx
push ebx
push edi
push str.Message
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], ebx
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1620]
mov ecx, eax
call fcn.004069c7
lea ecx, [ebp - 0x138]
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_579]
mov cl, byte [eax]
test cl, cl
sete cl
test cl, cl
sete cl
test cl, cl
je 0x404416
xor ecx, ecx
inc ecx
mov byte [eax + 1], cl
jmp 0x40441e
xor ecx, ecx
inc ecx
mov byte [eax + 1], cl
mov byte [eax], cl
mov eax, dword [esi + 0x24a4]
push 5
pop edx
mov dword [esi + 0x24a0], eax
mov dword [esi + 0x24a4], edx
cmp eax, edx
je 0x40444f
push eax
mov ecx, esi
call fcn.00404053
test al, al
jne 0x40445f
mov dword [esi + 0x24a0], 5
jmp 0x40445f
mov eax, dword [esi + 0x2494]
push ecx
push eax
push eax
mov ecx, esi
call fcn.00403694
lea ecx, [ebp - 0x138]
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_177]
cmp edi, 0x405
jne 0x40453c
cmp byte [esi + 0x2508], 0
je 0x404494
push 0x93
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [esi + 0x2508], bl
push ebx
mov ecx, esi
call fcn.00404878
cmp dword [esi + 0x2514], 0
mov edi, 0x102
mov byte [ebp - 0x12d], bl
mov byte [ebp - 0x13c], bl
je 0x404666
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x12c], 0x41032c
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edi
xor eax, eax
mov word [ebp - 0x11c], ax
mov dword [ebp - 4], 2
lea edx, [ebp - 0x12c]
mov ecx, dword [esi + 0x2514]
push edx
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ecx]
call dword [eax + 0x9c]
cmp dword [ebp - 0x134], 0xffffffff
jne 0x404559
xor eax, eax
inc eax
mov byte [ebp - 0x12d], al
jmp 0x404575
mov eax, dword [esi + 0x3e4]
xor ebx, ebx
test eax, eax
je 0x40453e
push 0x53
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [eax + 0x15e8]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor ebx, ebx
inc ebx
mov al, bl
call fcn.0040b173
ret 4
push 0
call fcn.00404878
mov ecx, esi
call fcn.00403739
jmp 0x40453c
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x134], 0
push 1
movzx eax, al
pop ecx
cmovg eax, ecx
mov dword [ebp - 0x13c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00401dde
cmp byte [ebp - 0x12d], 0
je 0x4045a3
mov ecx, dword [esi + 0x2514]
test ecx, ecx
je 0x40453c
mov eax, dword [ecx]
push ebx
push ebx
call dword [eax + 0xa0]
jmp 0x40453c
cmp byte [ebp - 0x13c], 0
je 0x404666
cmp dword [esi + 0x2514], 0
je 0x40453c
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x12c], 0x41032c
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edi
xor eax, eax
mov word [ebp - 0x11c], ax
mov dword [ebp - 4], 4
lea edx, [ebp - 0x12c]
mov ecx, dword [esi + 0x2514]
mov dword [ebp - 0x134], ebx
push edx
lea edx, [ebp - 0x134]
mov eax, dword [ecx]
push edx
call dword [eax + 0x9c]
mov ecx, dword [ebp - 0x128]
call fcn.00401833
test eax, eax
je 0x404646
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x404646
xor eax, eax
inc eax
push eax
push ebx
push ebx
push dword [ebp - 0x128]
push str.open
push dword [esi + 0xc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esi + 0x2514]
push ebx
push ebx
mov eax, dword [ecx]
call dword [eax + 0xa0]
lea ecx, [ebp - 0x12c]
call fcn.00401dde
jmp 0x40453c
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x12c], 0x41032c
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edi
xor eax, eax
mov word [ebp - 0x11c], ax
mov dword [ebp - 4], 6
cmp byte [esi + 0x248d], al
je 0x4046c6
cmp byte [esi + 0x248f], al
je 0x4046af
mov esi, str._repairdb
jmp 0x4046d9
cmp byte [esi + 0x2490], 0
je 0x4046bf
mov esi, str._repairdbsize
jmp 0x4046d9
mov esi, str._repair
jmp 0x4046d9
cmp byte [esi + 0x248e], 0
mov esi, str._update
jne 0x4046d9
mov esi, 0x40c400
mov ecx, esi
call fcn.00401833
push eax
mov edx, esi
lea ecx, [ebp - 0x12c]
call fcn.004093ec
mov ecx, dword [ebp - 0x128]
xor edx, edx
call fcn.00403bd1
jmp 0x404656
cmp byte [esi + 0x2508], 0
jne 0x40453f
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x14
push eax
call dword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
jne 0x404749
push str.System_Error:_GetCursorInfo_failed
push 0x32
push 0x4b8
push 0x63386b72
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1121]
add esp, 0x10
xor al, al
jmp 0x404541
mov eax, dword [ebp - 0x144]
mov ecx, esi
mov dword [esi + 0x3e8], eax
mov eax, dword [ebp - 0x140]
push 0
mov dword [esi + 0x3ec], eax
call fcn.00404878
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0x93
push eax
mov ecx, esi
call fcn.00404a00
test al, al
je 0x404742
mov byte [esi + 0x2508], bl
jmp 0x40453f
lea eax, [ebp - 0x164]
mov dword [ebp - 0x164], 0x14
push eax
call dword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x404742
cmp dword [esi + 0x3e4], 0
mov eax, dword [ebp - 0x158]
mov dword [esi + 0x3e8], eax
mov eax, dword [ebp - 0x154]
mov dword [esi + 0x3ec], eax
jne 0x40453f
cmp byte [esi + 0x24fd], 0
jne 0x40453f
cmp byte [esi + 0x24fe], 0
jne 0x40453f
cmp byte [esi + 0x24ff], 0
jne 0x40453f
push 0x90
push 0xffffffffffffffff
mov ecx, esi
call fcn.00404a00
test al, al
je 0x40453f
mov ecx, esi
call fcn.004035e2
mov byte [esi + 0x24fd], bl
jmp 0x40453f