Function at 0x4034e0
Capabilities:
Create thread
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x41425e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebp
push esi
push edi
mov ebp, ecx
push 0x138
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x120], edi
je 0x403527
mov ecx, eax
call fcn.00404ec0
jmp 0x403529
xor eax, eax
mov ecx, eax
mov dword [esp + 0x120], 0xffffffff
mov dword [ebp + 0x24], eax
call fcn.00404f60
test eax, eax
je 0x403764
mov ecx, dword [ebp + 0x24]
call fcn.004051c0
test eax, eax
je 0x403764
cmp ebp, edi
je 0x40355f
lea eax, [ebp + 0x1c]
jmp 0x403561
xor eax, eax
mov ecx, dword [ebp + 0x24]
push edi
push eax
call fcn.004051e0
test eax, eax
je 0x403764
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3f0
push eax
mov dword [ebp + 0x28], 1
call esi
push edi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov ecx, dword [ebp + 4]
push 0x3eb
push ecx
call esi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x4194b4
push eax
call ebx
mov edx, dword [ebp + 4]
push 0x3ee
push edx
call esi
push 1
push eax
call edi
mov eax, dword [ebp + 4]
push 0x3ee
push eax
call esi
push 0x4194ac
push eax
call ebx
mov ecx, dword [ebp + 4]
push 0x3ef
push ecx
call esi
push 0
push eax
call edi
mov edi, dword [ebp + 0x34]
mov esi, dword [ebp + 0x30]
cmp edi, edi
mov dword [esp + 0x10], edi
je 0x40366b
mov ecx, dword [esi]
mov eax, dword [edi]
cmp ecx, eax
mov dword [esp + 0x14], eax
je 0x40365d
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x403610
mov edx, dword [0x419034]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x403617
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x403648
mov ebx, dword [eax - 8]
mov ecx, esi
push ebx
call fcn.00404c70
test eax, eax
je 0x40365d
mov edx, dword [esp + 0x14]
mov ecx, dword [esi]
push ebx
lea eax, [ebx + 1]
push edx
push eax
push ecx
call fcn.00403ff0
mov edx, dword [esi]
add esp, 0x10
mov dword [edx - 8], ebx
mov eax, dword [esi]
mov byte [eax + ebx], 0
jmp 0x40365d
mov ecx, esi
call fcn.00404d10
mov eax, dword [edi]
mov dword [esi], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
add edi, 4
add esi, 4
cmp edi, eax
jne 0x4035f0
mov ebx, dword [ebp + 0x34]
mov edi, esi
cmp esi, ebx
je 0x4036a6
mov eax, dword [edi]
mov edx, dword [0x419034]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40369f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40369f
mov edx, dword [edi]
sub edx, 0xc
push edx
call fcn.00413190
add esp, 4
add edi, 4
cmp edi, ebx
jne 0x403674
xor ebx, ebx
mov dword [ebp + 0x34], esi
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], 1
mov dword [ebp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp + 0x44], eax
lea eax, [esp + 0x18]
push 0x104
push eax
call esi
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, dword [ebp + 0x24]
push 3
call fcn.00405250
push ebx
lea edx, [esp + 0x1c]
push 0x26
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40370c
mov ecx, dword [ebp + 0x24]
lea eax, [esp + 0x18]
push 1
push eax
push 3
call fcn.00405250
lea ecx, [esp + 0x18]
push 0x104
push ecx
call esi
mov edi, str.:Documents_and_Settings_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x19]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x24]
push 3
call fcn.00405250
push ebp
push ebx
push 0x403f50
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
xor eax, eax
pop ebx
jmp 0x403799
mov edx, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f0
push edx
mov dword [ebp + 0x28], edi
call esi
push edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 4]
push 0x3eb
push eax
call esi
push 0x41944c
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x118
ret 0xc