Function at 0x401b30
Capabilities:
Check if file exists
Copy file
Create process on windows
Create process suspended
Delete file
Get common file path
Initialize winsock library
Log keystrokes via polling

Disassembly:
sub esp, 0x52c
push ebx
push ebp
push esi
push edi
push 0x3e8
push 0x5dc
call fcn.00401700
or ecx, 0xffffffff
mov edi, 0x8b187c
xor eax, eax
add esp, 8
xor ebx, ebx
mov dword [0x47eeb8], 0x1317eb6
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x47ef10], ebx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x47eef8
mov dword [0x47eebc], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [0x47eea4], ebx
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x8b187c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x47eee4
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x8b187c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x47eed0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x8b187c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x47eec0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x8b187c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x47eea8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [0x47ee88], bl
call fcn.00401a10
test eax, eax
je 0x401cd2
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 4
push str.Legend_Of_Mir_4
push str.Mir_4___Do_you_want_to_run_tutorial_
push ebx
call esi
cmp eax, 6
push 4
push str.Legend_Of_Mir_4
jne 0x401cc0
push str.Mir_4___Do_you_want_me_to_ask_you_again_next_time_
push ebx
call esi
cmp eax, 7
jne 0x401c65
call fcn.00401aa0
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x44]
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x40], ebx
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
push edx
push eax
push ebx
push ebx
xor ecx, ecx
push ebx
push ebx
mov dword [esp + 0x2c], ecx
push ebx
push ebx
mov dword [esp + 0x38], ecx
push ebx
push str.Manual.exe
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401cd2
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
push str.Mir_4___Do_you_want_to_run_it_next_time_
push ebx
call esi
cmp eax, 7
jne 0x401cd2
call fcn.00401aa0
call fcn.00401030
test al, al
jne 0x401ceb
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
mov al, byte [0x47ee90]
mov ecx, dword [0x47ee8c]
cmp al, bl
mov dword [0x47eea0], 1
mov dword [0x8ab808], ecx
je 0x401d2f
mov edi, 0x47ee90
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x8a9e54
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.Legend_Of_Mir_4
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401d4f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x1a4]
push eax
push 0x104
call ebp
lea ecx, [esp + 0xa0]
push ecx
push 0x104
call ebp
mov edi, str..Mir4Patch.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xa4]
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, str..Mir4Patch.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 3
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [esp + 0x1b8]
push connect
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push ebx
push 0x80
push 3
push ebx
cmp eax, 2
push 1
push connect
jne 0x401e74
lea ecx, [esp + 0xb8]
push ecx
call esi
mov esi, eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 2
jne 0x401e46
mov edx, dword [0x8ab7b0]
push ebx
push 0x47a398
push 0x47a344
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call edi
jmp 0x401eb4
push esi
call edi
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x1a4]
push 1
lea edx, [esp + 0xa4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
call edi
jmp 0x401eb4
lea eax, [esp + 0xb8]
push eax
call esi
mov esi, eax
call edi
cmp eax, 2
jne 0x401eb4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0xa0]
push 1
lea eax, [esp + 0x1a8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp byte [0x47ee88], bl
jne 0x401f6d
lea ecx, [esp + 0x2a8]
push ecx
push 0x104
call ebp
mov edi, str..Mir4Patch.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x3c], 0x44
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov dword [esp + 0x40], ebx
and ecx, 3
lea edx, [esp + 0x3c]
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xf
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
push ecx
push edx
push ebx
push ebx
mov dword [esp + 0x28], eax
push ebx
push ebx
mov dword [esp + 0x34], eax
push ebx
push ebx
lea eax, [esp + 0x2c8]
push ebx
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401f5d
push 0x10
push str.Legend_Of_Mir_4
push 0x47a320
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
nop
nop
nop
nop
nop
cmp eax, 7
jne 0x401f87
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
mov al, byte [0x47ee89]
push 5
cmp al, bl
je 0x401fa6
mov ecx, dword [esp + 0x544]
push 2
push 0x66
push ebx
push str.Legend_Of_Mir_4
push ecx
jmp 0x401fb8
mov edx, dword [esp + 0x544]
push 1
push 0x66
push ebx
push str.Legend_Of_Mir_4
push edx
mov ecx, 0x8ab7a8
call fcn.0045ca80
cmp eax, ebx
jne 0x401fd6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
mov eax, dword [0x8ab7b0]
mov ecx, dword [0x8ab7ac]
push ebx
push ebx
push ebx
push ebx
push eax
push ecx
mov ecx, 0x8aa488
call fcn.00451100
mov edx, dword [0x8aa48c]
push ebx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x8ab7b0]
push eax
call fcn.0045a8c0
add esp, 4
test eax, eax
jge 0x402019
mov dword [0x8ab138], ebx
jmp 0x402041
push str.SoundList.wwl
mov ecx, 0x8ab130
mov dword [0x8ab138], 1
call fcn.0045ada0
push str.Bgmlist.wwl
mov ecx, 0x8ab130
call fcn.0045ae90
mov ecx, 0x8aa5a8
call fcn.00449c80
test eax, eax
jne 0x40205f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
push ebx
call fcn.004685e8
push eax
call fcn.004684a8
add esp, 8
lea eax, [esp + 0x3ac]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x402094
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x52c
ret 0x10
mov eax, 0x8a9520
mov ecx, 0x8a9520
mov dword [0x8ab820], eax
mov dword [0x8b1870], eax
call fcn.004026e0
mov byte [0x8b1878], bl
xor edi, edi
call fcn.004016a0
mov ebp, dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [0x8b1874], eax
push ebx
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ebx
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40210c
push ebx
push ebx
lea edx, [esp + 0x28]
push ebx
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40224f
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4020cb
call ebp
mov ecx, eax
sub ecx, edi
mov edi, eax
je 0x4020cb
cmp dword [0x8ab7ec], ebx
je 0x4020cb
mov eax, dword [0x8b1878]
and eax, 0xff
sub eax, ebx
je 0x40216c
sub eax, 2
je 0x40215f
dec eax
jne 0x402177
cmp dword [0x8ab7e8], ebx
je 0x402149
push ecx
mov ecx, 0x47ef18
call fcn.0041bb00
jmp 0x402177
mov ecx, 0x47ef18
call fcn.0041b440
mov ecx, 0x47ef18
call fcn.0041b500
jmp 0x402177
push ecx
mov ecx, 0x8a7140
call fcn.004575d0
jmp 0x402177
push ecx
mov ecx, 0x8a9520
call fcn.00402be0
push 0x2c
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x40222e
lea edx, [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1a]
mov edx, dword [esp + 0x18]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x1a]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x1a]
push edx
mov edx, dword [esp + 0x1c]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push 0x47eee4
push 0x47eed0
lea eax, [esp + 0x5c]
push str.__s1.91__s_____d__d__d__2.2d:_2.2d:_2.2d
push eax
call fcn.0046811c
add esp, 0x28
lea ecx, [esp + 0x3c]
push ebx
push ecx
push ebx
push 0xa0a0a
push ebx
push ebx
push ebx
mov ecx, 0x8ab7a8
call fcn.0045dd70
lea edx, [esp + 0x3c]
push ebx
push edx
push ebx
push 0x96c8ff
push 1
push 1
push ebx
mov ecx, 0x8ab7a8
call fcn.0045dd70
mov eax, dword [0x8ab7c4]
push ebx
push eax
call fcn.00456430
add esp, 8
mov ecx, 0x8ab7a8
call fcn.004657b0
test eax, eax
jge 0x4020cb
mov ecx, 0x8ab7a8
call fcn.00465810
jmp 0x4020cb
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x52c
ret 0x10