Function at 0x401722
Capabilities:
Create directory
Delete file
Read file on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
push esi
push edi
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x154], 0
mov word [ebp - 0x194], 0
mov ecx, 6
mov esi, str.are_You_started_this_app_
lea edi, [ebp - 0x180]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x38], 0
push 3
push 0x40e2ac
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x15c], 0
push 4
push 0x1000
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x15c], 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0xb8], 0x1000
push 4
push 0x1000
mov eax, dword [ebp - 0x15c]
push eax
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x401816
mov dword [ebp - 0x1d0], 1
cmp dword [ebp - 0x1c8], 0
je 0x401839
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0x1d4], edx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x1d0], 0
je 0x40184b
mov eax, 1
test eax, eax
je 0x4018b8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401867
push 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x401872
push 0xa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.EA0:Db_gkMXX
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 4
push 0x1000
push 0x23c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c4], 1
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0xbc], 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c4], 0
jbe 0x401924
mov eax, dword [ebp - 0x158]
mov dword [eax + 0x104], 0xfbf28cc6
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x1c4], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x1fc]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 4], 0xfffff
mov dword [ebp - 0x164], 4
cmp dword [ebp - 0xbc], 1
je 0x40194b
mov ecx, 1
test ecx, ecx
je 0x401cab
push 0
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x30]
mov dword [eax + 0xcc], 2
mov byte [ebp - 0xb4], 0x31
mov byte [ebp - 0xb3], 0x38
lea ecx, [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [ebp - 0xb2], 3
mov dword [ebp - 0x1f4], 0
lea edx, [ebp - 0xb4]
push edx
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov word [ebp - 0x21c], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x1e0], str.AOL_IS_DISABLED
cmp dword [ebp - 0x1e0], 0
jne 0x4019f2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov eax, dword [ebp - 0x1e0]
add eax, 3
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x23c], 0
mov ecx, dword [str.slx305]
mov dword [ebp - 0x228], ecx
mov dx, word [0x40e2d4]
mov word [ebp - 0x224], dx
mov al, byte [0x40e2d6]
mov byte [ebp - 0x222], al
mov dword [ebp - 0x164], 0x3bf3
mov dword [ebp - 0x234], 0
mov ecx, dword [ebp - 0x234]
cmp ecx, dword [ebp - 0x22c]
jae 0x401a9c
mov edx, dword [ebp - 0x234]
cmp edx, dword [ebp - 0x22c]
jae 0x401a6a
mov eax, dword [ebp - 0x234]
add eax, 1
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jbe 0x401a8b
push 4
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x1dc]
push edx
call fcn.00401e24
add esp, 0xc
mov eax, dword [ebp - 0x1dc]
add eax, 1
mov dword [ebp - 0x23c], eax
jmp 0x401a3f
mov dword [ebp - 0x240], 1
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x248], 2
lea ecx, [ebp - 0x228]
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
jne 0x401af4
lea edx, [ebp - 0x24c]
push edx
call dword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x401af4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jne 0x401b20
mov edx, dword [ebp - 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1f4], 0xa
jae 0x401b3f
push 4
push 0x1000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x401b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x23c], 0x715
jne 0x401bc4
push 0
push 1
call dword [sym.imp.WS2_32.dll_listen]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x220]
mov dword [eax + 0x100], ecx
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x100], 0
je 0x401b98
xor eax, eax
test eax, eax
je 0x401b98
mov dword [ebp - 0x2e4], 0x94
cmp dword [ebp - 0x250], 0x276d
jne 0x401bc4
mov ecx, dword [ebp - 0x158]
push ecx
lea edx, [ebp - 0xb4]
push edx
call section..text
add esp, 8
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x230], 0
mov eax, dword [ebp - 4]
shl eax, 1
cmp eax, dword [ebp - 0x1f4]
jb 0x401c7c
cmp dword [ebp - 0x1d8], 0
je 0x401c7c
mov ecx, dword [ebp - 0x30]
mov dword [ecx], 0
mov byte [ebp - 0x180], 0x53
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2e8], 0x7d83
cmp dword [ebp - 0x1a4], 0xffffffff
je 0x401c21
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2f4], 0
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x8000
push 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x1fc]
mov dword [0x40e730], edx
cmp dword [ebp - 0x1c4], 0xa
jbe 0x401c75
mov dword [ebp - 0x30], 0xff1a
mov dword [ebp - 0x158], 0xfaf0
jmp 0x401c7a
mov eax, dword [ebp - 0x30]
jmp 0x401cad
jmp 0x401cab
mov eax, dword [ebp - 0xc0]
add eax, 3
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov ecx, dword [ebp - 0xc0]
add ecx, 0x12
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp - 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret