Function at 0x401e10
Capabilities:
Enumerate files on windows
Get common file path
Get memory capacity
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xbb4
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0xbb0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x288]
mov dword [esp + 0x288], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, word [esp + 0x294]
push 0x424158
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ebx, dword [sym.imp.USER32.dll_CreatePopupMenu]
call ebx
mov esi, eax
mov dword [esp + 0x34], esi
call ebx
push 0x80
push str.Free
mov edi, eax
call fcn.00404530
add esp, 8
push eax
push 0x418a4c
call fcn.004044b0
add esp, 4
push eax
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [esp + 0x3ac]
add esp, 0xc
push eax
push 0x272f
push 0
push esi
call ebx
push 0x418a54
call fcn.004044b0
add esp, 4
push eax
push 0x2737
push 0
push esi
call ebx
push 0x418a5c
call fcn.004044b0
add esp, 4
push eax
push edi
push 0x10
push esi
call ebx
mov esi, dword [0x424160]
mov eax, 0x581e4b
mul esi
sub esp, 8
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 0x13
mov eax, esi
shr eax, 0x1f
movd xmm0, esi
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x419ea0]
lea eax, [esp + 0x3a8]
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x2c], xmm0
divss xmm0, dword [0x419e90]
movss dword [esp + 0x28], xmm0
mulss xmm0, dword [0x419e40]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push 0x418a68
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x2724
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e4c]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.20_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x2725
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e54]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.30_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x2726
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e5c]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.40_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x2727
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e68]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.50_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x2728
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e70]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.60_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x2729
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e78]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.70_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x272a
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e84]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.80_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x272b
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x20]
lea eax, [esp + 0x3a0]
mulss xmm0, dword [0x419e8c]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.90_s_of__d_MB___.0f_MB_
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x272c
push 0
push edi
call ebx
movss xmm0, dword [esp + 0x24]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push esi
push 0x418a64
push str.100_s_of__d_MB___.0f_MB_
lea eax, [esp + 0x3b4]
push 0x100
push eax
call fcn.00408280
add esp, 0x1c
lea eax, [esp + 0x3a0]
push eax
push 0x272d
push 0
push edi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418c4c
mov esi, eax
call fcn.004044b0
mov edi, dword [esp + 0x38]
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
push 0x418c54
call fcn.004044b0
add esp, 4
push eax
push 0x2738
push 0
push esi
call ebx
push 0x418c5c
call fcn.004044b0
add esp, 4
push eax
push 0x2739
push 0
push esi
call ebx
push 0x418c64
call fcn.004044b0
add esp, 4
push eax
push 0x273a
push 0
push esi
call ebx
push 0x418c6c
call fcn.004044b0
add esp, 4
push eax
push 0x273b
push 0
push esi
call ebx
push 0x418c74
call fcn.004044b0
add esp, 4
push eax
push 0x273c
push 0
push esi
call ebx
push 0x418c7c
call fcn.004044b0
add esp, 4
push eax
push 0x273d
push 0
push esi
call ebx
push 0x418c84
call fcn.004044b0
add esp, 4
push eax
push 0x273e
push 0
push esi
call ebx
push 0x418c8c
call fcn.004044b0
add esp, 4
push eax
push 0x4e0
push 0
push esi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, eax
push 0x418c94
mov dword [esp + 0x28], esi
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
push 0
push 0x418928
push str.OPTIONS
call esi
sub eax, 0
je 0x402373
sub eax, 1
je 0x402359
sub eax, 1
jne 0x40233f
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 8
jmp 0x402383
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], eax
jmp 0x40238b
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 8
mov dword [esp + 0x30], 0
jmp 0x40238b
mov dword [esp + 0x20], 8
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
push 0x418c9c
call fcn.004044b0
add esp, 4
push eax
push 0x274a
push dword [esp + 0x28]
push dword [esp + 0x30]
call ebx
push 0x418ca4
call fcn.004044b0
add esp, 4
push eax
push 0x274b
push dword [esp + 0x34]
push dword [esp + 0x30]
call ebx
push 0x418cac
call fcn.004044b0
add esp, 4
push eax
push 0x274c
push dword [esp + 0x38]
push dword [esp + 0x30]
call ebx
push 0x4188b4
push 0
push 0x800
push edi
call ebx
push 0x423418
push 0
push 0x41894c
push str.OPTIONS
call esi
neg eax
push 0
sbb esi, esi
push str.monramWndClass
and esi, 8
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x402438
push 0x423418
push 0x418924
push 0x41894c
push str.OPTIONS
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x418cd4
call fcn.004044b0
add esp, 4
push eax
push 0x2744
push esi
push edi
call ebx
push 0x423418
push 0
push str.MonCPU
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0
sbb esi, esi
push str.moncpuWndClass
and esi, 8
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x40249a
push 0x423418
push 0x418924
push str.MonCPU
push str.OPTIONS
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x418cfc
call fcn.004044b0
add esp, 4
push eax
push 0x2761
push esi
push edi
call ebx
push 0x4188b4
push 0
push 0x800
push edi
call ebx
push 0x418d04
call fcn.004044b0
add esp, 4
push eax
push 0x2743
push 0
push edi
call ebx
push 0x418d0c
call fcn.004044b0
add esp, 4
push eax
push 0x274f
push 0
push edi
call ebx
push 0x423418
push 0
push str.Noicons
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418d14
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x2741
push esi
push edi
call ebx
push 0x4188b4
push 0
push 0x800
push edi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418d1c
mov esi, eax
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
push str.Admin
push 0x4e8
push 0
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push esi
call ebx
push str.MS_Info
push 0x4e1
push 0
push esi
call ebx
push str.Cleanup
push 0x4e3
push 0
push esi
call ebx
push str.Services
push 0x4e5
push 0
push esi
call ebx
push str.Manage
push 0x4e6
push 0
push esi
call ebx
push str.Policy
push 0x4e7
push 0
push esi
call ebx
cmp dword [esp + 0x28], 0x1db0
jae 0x4025de
push str.MS_Config
push 0x4e2
push 0
push esi
call ebx
push str.Defrag
push 0x4e4
jmp 0x402606
push str.Devices
push 0x4e9
push 0
push esi
call ebx
push str.Firewall
push 0x4ea
push 0
push esi
call ebx
push str.Autoplay
push 0x4eb
push 0
push esi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418de0
mov esi, eax
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
push 0x418de8
call fcn.004044b0
add esp, 4
push eax
push 0x4d7
push 0
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push esi
call ebx
push 0x418df0
call fcn.004044b0
add esp, 4
push eax
push 0x4d8
push 0
push esi
call ebx
push 0x418df8
call fcn.004044b0
add esp, 4
push eax
push 0x4d9
push 0
push esi
call ebx
push 0x418e00
call fcn.004044b0
add esp, 4
push eax
push 0x4da
push 0
push esi
call ebx
push 0x418e08
call fcn.004044b0
add esp, 4
push eax
push 0x4db
push 0
push esi
call ebx
push 0x418e10
call fcn.004044b0
add esp, 4
push eax
push 0x4dc
push 0
push esi
call ebx
push 0x418e18
call fcn.004044b0
add esp, 4
push eax
push 0x4dd
push 0
push esi
call ebx
push 0x418e20
call fcn.004044b0
add esp, 4
push eax
push 0x4de
push 0
push esi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, eax
push 0x418e28
mov dword [esp + 0x24], esi
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
cmp dword [esp + 0x28], 0x1db0
jae 0x402758
push 0x423418
push 0
push str.Hide1
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418e30
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x275c
push esi
push dword [esp + 0x2c]
call ebx
push 0x423418
push 0
push str.Hide3
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418e38
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x275e
push esi
push dword [esp + 0x2c]
call ebx
push 0x423418
push 0
push str.Hide4
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418e40
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x275f
push esi
push dword [esp + 0x2c]
call ebx
push 0x423418
push 0
push str.Hide5
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418e48
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x2760
push esi
push dword [esp + 0x2c]
call ebx
push 0x423418
push 0
push str.Hide2
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418e50
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x275d
push esi
push dword [esp + 0x2c]
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, eax
push 0x418e58
mov dword [esp + 0x2c], esi
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
push 0x423418
push 0
push str.Nosaver
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
sbb esi, esi
push 0x418e60
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x273f
push esi
mov esi, dword [esp + 0x34]
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push esi
call ebx
push 0x418e68
call fcn.004044b0
add esp, 4
push eax
push 0x2732
push 0
push esi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418e70
mov edi, eax
call fcn.004044b0
add esp, 4
push eax
push edi
push 0x10
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push esi
call ebx
push 0x104
lea eax, [esp + 0x9b4]
mov esi, 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x9b0]
push eax
call fcn.0040b2c1
add esp, 4
lea eax, [esp + 0x38]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x402a08
push 0
lea eax, [esp + 0x7ac]
mov esi, 0x1389
push eax
push 0x104
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5a8], ax
lea eax, [esp + 0x5aa]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x7a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [esp + 0x5a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x5a0]
push eax
push esi
push 0
push edi
call ebx
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4029fe
push 0
lea eax, [esp + 0x7ac]
inc esi
push eax
push 0x104
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x7a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [esp + 0x5a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x5a0]
push eax
push esi
push 0
push edi
call ebx
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4029a5
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [esp + 0x9b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x9b0]
push eax
call fcn.0040b2c1
add esp, 4
lea eax, [esp + 0x38]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x402b24
push 0
lea eax, [esp + 0x7ac]
inc esi
push eax
push 0x104
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5a8], ax
lea eax, [esp + 0x5aa]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x7a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [esp + 0x5a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x5a0]
push eax
push esi
push 0
push edi
call ebx
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x402b1a
push 0
lea eax, [esp + 0x7ac]
inc esi
push eax
push 0x104
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x7a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [esp + 0x5a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x5a0]
push eax
push esi
push 0
push edi
call ebx
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402ac1
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x418e78
call fcn.004044b0
mov esi, dword [esp + 0x2c]
add esp, 4
push eax
push 0x2762
push 0
push esi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418e80
mov edi, eax
call fcn.004044b0
mov esi, dword [esp + 0x38]
add esp, 4
push eax
push edi
push 0x10
push esi
call ebx
push 0x418e88
call fcn.004044b0
add esp, 4
push eax
push 0x2750
push 0
push edi
call ebx
push 0x4188b4
push 0
push 0x800
push edi
call ebx
push 0x423418
push 0
push str.RecycleAuto
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
push 0x418e90
sbb esi, esi
and esi, 8
call fcn.004044b0
add esp, 4
push eax
push 0x2751
push esi
push edi
call ebx
push 0x418e98
call fcn.004044b0
add esp, 4
push eax
push 0x2752
push 0
push edi
call ebx
mov edi, dword [esp + 0x34]
push 0x4188b4
push 0
push 0x800
push edi
call ebx
push 0x418ea0
call fcn.004044b0
add esp, 4
push eax
push 0x2733
push 0
push edi
call ebx
push 0x418ea8
call fcn.004044b0
add esp, 4
push eax
push 0x2745
push 0
push edi
call ebx
push 0x4188b4
push 0
push 0x800
push edi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418eb0
mov esi, eax
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
push 0x418eb8
call fcn.004044b0
add esp, 4
push eax
push 0x2748
push 0
push esi
call ebx
push 0x418ec0
call fcn.004044b0
add esp, 4
push eax
push 0x2747
push 0
push esi
call ebx
push 0x418ec8
call fcn.004044b0
add esp, 4
push eax
push 0x2749
push 0
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push esi
call ebx
push 0x418ed0
call fcn.004044b0
add esp, 4
push eax
push 0x2742
push 0
push esi
call ebx
push 0x418ed8
call fcn.004044b0
add esp, 4
push eax
push 0x2746
push 0
push esi
call ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x418ee0
mov esi, eax
call fcn.004044b0
add esp, 4
push eax
push esi
push 0x10
push edi
call ebx
push 0x418ee8
call fcn.004044b0
add esp, 4
push eax
push 0x2736
push 0
push esi
call ebx
push 0x418ef0
call fcn.004044b0
add esp, 4
push eax
push 0x2735
push 0
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push esi
call ebx
push 0x418ef8
call fcn.004044b0
add esp, 4
push eax
push 0x274e
push 0
push esi
call ebx
push 0x418f00
call fcn.004044b0
add esp, 4
push eax
push 0x274d
push 0
push esi
call ebx
push 0x418f08
call fcn.004044b0
add esp, 4
push eax
push 0x4df
push dword [0x424150]
push esi
call ebx
push 0x418f10
call fcn.004044b0
add esp, 4
push eax
push 0x2731
push 0
push esi
call ebx
push 0x4188b4
push 0
push 0x800
push edi
call ebx
push 0x418f18
call fcn.004044b0
add esp, 4
push eax
push 0x12c
push 0
push edi
call ebx
push 1
push 1
push edi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push 2
push edi
call esi
push str.Defragment
push eax
call fcn.00401300
push 3
push edi
call esi
push str.Tools
push eax
call fcn.00401300
push 4
push edi
call esi
push 0x418928
push eax
call fcn.00401300
push 0xd
push edi
call esi
push str.System_Tools
push eax
call fcn.00401300
push 0xe
push edi
call esi
push str.Control_Panels
push eax
call fcn.00401300
push 0xf
push edi
call esi
push str.Toolbar
push eax
call fcn.00401300
push 0x10
push edi
call esi
push str.Screen
push eax
call fcn.00401300
push 0x11
push edi
call esi
push str.Re_Bin
push eax
call fcn.00401300
push 0x16
push edi
call esi
push str.Shutdown
push eax
call fcn.00401300
push 0x17
push edi
call esi
push str.Information
push eax
call fcn.00401300
mov ecx, dword [esp + 0xbbc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004082ae
mov esp, ebp
pop ebp
ret