Function at 0x43e140
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44f05b
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x44]
push edi
xor ebx, ebx
mov eax, dword [esi]
mov edi, ecx
push eax
push ebx
push str.flag
push str.updateflag
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, dword [esp + 0x40]
cmp ebp, ebx
jne 0x43e18c
cmp eax, 2
je 0x43e18c
xor eax, eax
jmp 0x43e3f1
mov eax, dword [esi]
push eax
push 0x4637b4
push str.flag
push str.updateflag
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov al, byte [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov byte [esp + 0x20], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov cl, byte [esp + 0x4c]
mov dword [esp + 0x38], ebx
mov byte [esp + 0x10], cl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push esi
mov ecx, edi
mov byte [esp + 0x44], 1
call fcn.0043ec20
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push ecx
push esi
push edx
mov ecx, edi
call fcn.0043e4e0
cmp ebp, ebx
jne 0x43e209
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.0043ea50
call fcn.004132c0
test eax, eax
jne 0x43e30e
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.0043f7e0
test eax, eax
jne 0x43e30e
cmp ebp, ebx
jne 0x43e29f
mov edx, dword [esp + 0x44]
mov ecx, edi
push edx
call fcn.0043e410
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x38], bl
je 0x43e25d
push ebx
mov ecx, esi
call fcn.00441190
add esi, 0x28
cmp esi, edi
jne 0x43e24a
mov esi, dword [esp + 0x14]
push esi
call fcn.0044737a
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
add esp, 4
cmp esi, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], 0xffffffff
je 0x43e299
push ebx
mov ecx, esi
call fcn.00441190
add esi, 0x28
cmp esi, edi
jne 0x43e286
mov esi, dword [esp + 0x24]
push esi
jmp 0x43e3e4
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x38], bl
je 0x43e2c2
push ebx
mov ecx, esi
call fcn.00441190
add esi, 0x28
cmp esi, edi
jne 0x43e2af
mov esi, dword [esp + 0x14]
push esi
call fcn.0044737a
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
add esp, 4
cmp esi, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], 0xffffffff
je 0x43e2fe
push ebx
mov ecx, esi
call fcn.00441190
add esi, 0x28
cmp esi, edi
jne 0x43e2eb
mov esi, dword [esp + 0x24]
push esi
call fcn.0044737a
add esp, 4
xor eax, eax
jmp 0x43e3f1
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
push eax
push esi
push ecx
mov ecx, edi
call fcn.0043e4e0
mov ecx, dword [0x4dcbd0]
cmp ecx, ebx
jne 0x43e359
push 4
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x4c], eax
cmp eax, ebx
mov byte [esp + 0x38], 2
je 0x43e34a
mov ecx, eax
call fcn.00443680
jmp 0x43e34c
xor eax, eax
mov ecx, eax
mov byte [esp + 0x38], 1
mov dword [0x4dcbd0], ecx
call fcn.00443d30
mov eax, dword [esi]
push eax
push 0x467810
push str.flag
push str.updateflag
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x44], ebx
je 0x43e38c
mov ecx, edi
call fcn.0043f550
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x38], bl
je 0x43e3af
push ebx
mov ecx, esi
call fcn.00441190
add esi, 0x28
cmp esi, edi
jne 0x43e39c
mov esi, dword [esp + 0x14]
push esi
call fcn.0044737a
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
push edx
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x40], 0xffffffff
call fcn.0043fc40
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0044737a
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10