Function at 0x404d70
Capabilities:
Delete file
Inspect load icon resource

Disassembly:
mov eax, 0x40d098
call fcn.00407bd0
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
call fcn.00404b17
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.004091f2
mov ecx, edi
call fcn.00409217
call fcn.0040861b
push str._kill
mov ecx, edi
call fcn.00408ee3
push eax
call sub.MSVCRT.dll_strstr
pop ecx
test eax, eax
pop ecx
je 0x404fa1
push 0x20
mov ecx, edi
call fcn.00408ee3
push eax
call sub.MSVCRT.dll_strchr
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop ecx
mov edi, eax
pop ecx
inc edi
push edi
call ebx
test eax, eax
jne 0x404df8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x404df8
push 0
call fcn.00407f08
pop ecx
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
jmp 0x404dd4
lea ecx, [ebp - 0x20]
call fcn.00408d5c
and dword [ebp - 4], 0
test edi, edi
je 0x404ef9
push str..exe
lea ecx, [ebp - 0x30]
call fcn.00408de4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004091f2
lea ecx, [ebp - 0x30]
call fcn.00409217
lea edi, [esi + 0x1c]
lea ecx, [ebp - 0x20]
push edi
call fcn.00408f17
lea ecx, [ebp - 0x30]
call fcn.00408ee3
push eax
lea ecx, [ebp - 0x20]
call fcn.004094c1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404ee2
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.00408eb6
add eax, ebx
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00408fe5
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00408f17
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00408e57
lea ecx, [ebp - 0x20]
call fcn.00409217
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00408f17
push str._install
mov ecx, edi
call fcn.00408ee3
push eax
call sub.MSVCRT.dll_strstr
pop ecx
test eax, eax
pop ecx
je 0x404eed
mov ecx, esi
call fcn.00405fc2
test eax, eax
jne 0x404ed9
and byte [ebp - 4], al
lea ecx, [ebp - 0x30]
call fcn.00408e57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00408e57
jmp 0x40502f
mov ecx, edi
call fcn.00408ed5
jmp 0x404eed
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00408f17
and byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00408e57
lea ebx, [esi + 0x3c]
push 0
mov ecx, ebx
call fcn.00408ef0
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push eax
call edi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x404f25
lea ecx, [esi + 0x2c]
call fcn.00408ef0
push eax
push 0
call edi
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404f55
push 0
push 0x8005
push 0x111
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x404ec8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00408e57
push dword [esi + 0x10]
mov ecx, esi
call fcn.004051cc
test ax, ax
je 0x405028
push esi
xor edi, edi
push dword [esi + 0x10]
lea ecx, [esi + 0x2c]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call fcn.00408ee3
push eax
mov ecx, ebx
call fcn.00408ee3
push eax
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [esi + 0xc], eax
jmp 0x40502a
push str._uninstall
mov ecx, edi
call fcn.00408ee3
push eax
call sub.MSVCRT.dll_strstr
pop ecx
pop ecx
test eax, eax
mov ecx, esi
je 0x404fc2
call fcn.004061fb
jmp 0x40502f
call fcn.00405fc2
test eax, eax
je 0x40502f
lea ebx, [esi + 0x3c]
push 0
mov ecx, ebx
call fcn.00408ef0
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push eax
call edi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x404ff7
lea ecx, [esi + 0x2c]
call fcn.00408ef0
push eax
push 0
call edi
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404f61
push 0
push 0x8005
push 0x111
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x40502f
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0x405036
xor eax, eax
jmp 0x405120
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, edi
je 0x405053
push eax
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea ecx, [esi + 0xec]
call fcn.00408ef0
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
movzx eax, word [esi + 0x14]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_LoadIconA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov ebx, 0x80
push 1
push ebx
mov dword [ebp - 0x10], eax
push dword [esi + 0xc]
call edi
push dword [ebp - 0x10]
push 0
push ebx
push dword [esi + 0xc]
call edi
lea ebx, [esi + 0x3ec]
push 1
mov ecx, ebx
call fcn.0040ad38
lea ecx, [esi + 0x2c]
call fcn.00408ee3
push eax
mov ecx, ebx
push dword [ebp - 0x10]
push 0
push dword [esi + 0xc]
call fcn.0040af92
lea ebx, [esi + 0x1c]
push str._noconnect
mov ecx, ebx
call fcn.00408ee3
push eax
call sub.MSVCRT.dll_strstr
pop ecx
test eax, eax
pop ecx
je 0x4050ef
push str._dial
mov ecx, ebx
call fcn.00408ee3
push eax
call sub.MSVCRT.dll_strstr
pop ecx
test eax, eax
pop ecx
je 0x405100
push 0
push 0x8005
push 0x111
push dword [esi + 0xc]
call edi
mov ecx, esi
call fcn.00405a9e
push 0
push dword [esi + 0x368]
push 0x3e6
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetTimer]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret