Function at 0x403c70
Capabilities:
Delete file
Hide graphical window

Disassembly:
sub esp, 0x118
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
mov ebx, dword [esp + 0x120]
push ebp
push esi
push edi
push 0x452380
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x130]
mov esi, edi
imul esi, esi, 0x160
mov eax, dword [esi + 0x450024]
push 0x452380
mov dword [esp + 0x1c], eax
mov dword [esi + 0x450024], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x44ba04]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov ebp, dword [esp + 0x134]
test ebp, ebp
jne 0x403d1a
lea edx, [esi + 0x450028]
push edx
push str.Disconnecting_from__s...
push 0x44a8c0
mov byte [esp + 0x1f], 1
call fcn.004124f2
mov eax, dword [0x44f9e0]
add esp, 0xc
push 0x44a8c0
push ebp
push 0x408
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x449734]
push 0
lea ecx, [edi + 0xc350]
push ecx
push 4
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
test ebp, ebp
jne 0x403d8e
push ebp
push 1
lea eax, [esp + 0x24]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push edi
push ebx
mov dword [esp + 0x30], 0x83050004
call fcn.004113c0
add esp, 0x1c
test eax, eax
jne 0x403d65
lea ebp, [eax + 1]
push 0
push 1
lea edx, [esp + 0x24]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push edi
push ebx
mov dword [esp + 0x30], 0x8305002c
call fcn.004113c0
add esp, 0x1c
test eax, eax
jne 0x403d8e
lea ebp, [eax + 1]
mov eax, dword [esi + 0x450178]
test eax, eax
je 0x403da1
push eax
call fcn.00412c42
add esp, 4
mov eax, dword [esi + 0x450130]
test eax, eax
je 0x403db1
push eax
call sub.WS2_32.dll_closesocket
mov eax, dword [esi + 0x450174]
test eax, eax
je 0x403dc2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x403e25
cmp byte [esi + 0x450020], 0
je 0x403e25
lea ebp, [esi + 0x450028]
push str.DBGVSVC
push ebp
call fcn.0040cf10
push ebp
lea ecx, [esp + 0x2c]
push str._sADMIN_System32Dbgvsvc.exe
push ecx
call fcn.004124f2
add esp, 0x14
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
lea eax, [esp + 0x24]
push str._sADMIN_System32Dbgv.sys
push eax
call fcn.004124f2
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call fcn.00403a80
add esp, 4
mov edx, dword [0x449734]
push 8
push 0xc350
push 4
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push ebx
call fcn.00401870
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x403ea2
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebp
mov eax, dword [0x450024]
push 5
push eax
mov dword [0x449850], eax
mov dword [0x440c28], 0
call ebp
mov eax, dword [esp + 0x18]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x450024]
push 0
push edi
push ebx
mov dword [0x449850], ecx
call fcn.00403550
add esp, 0xc
cmp byte [esp + 0x13], 0
pop edi
mov byte [esi + 0x450022], 0
pop esi
pop ebp
pop ebx
je 0x403eca
mov edx, dword [0x44f9e0]
push 0
push 0
push 0x409
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004126a4
add esp, 0x118
ret