Function at 0x4029a0
Capabilities:
Create thread
Delete file
Read .ini file
Terminate thread

Disassembly:
sub esp, 0x9e8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push esi
push edi
push 0x4062e0
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push 0x458950
push 0
mov dword [0x45894c], eax
call ebx
push 0x2e
push 0x458950
call fcn.00407dd0
mov edx, eax
add esp, 8
test edx, edx
je 0x402a19
inc edx
je 0x402a19
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x402a19
mov edi, 0x430294
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4062f0
call ebp
push 0x104
push 0x458848
push 0
mov dword [0x458844], eax
call ebx
push 0x2e
push 0x458848
call fcn.00407dd0
mov edx, eax
add esp, 8
test edx, edx
je 0x402a7c
inc edx
je 0x402a7c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x402a7c
mov edi, 0x430294
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [0x434b94]
mov edi, dword [ebp]
cmp edi, ebp
je 0x402ac0
mov esi, edi
mov edi, dword [edi]
push 1
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [ecx], edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
lea ecx, [esi + 8]
call fcn.00401f70
push esi
call fcn.0041a2c2
mov ecx, dword [0x434b98]
add esp, 4
dec ecx
cmp edi, ebp
mov dword [0x434b98], ecx
jne 0x402a89
call fcn.00402fe0
test eax, eax
je 0x402fce
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x4581ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.processinfo.dat
call fcn.0041a5cc
lea ecx, [esp + 0x14]
push ecx
call fcn.00405c30
mov edi, dword [eax]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x258]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.0041a55e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x43027c
call fcn.0041a5cc
lea eax, [esp + 0x14]
push eax
call fcn.00405c30
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x58c]
push ecx
push 0x4581ac
push 0x430274
push edx
call fcn.00407d6b
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.0041a55e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WatchClient.ini
call fcn.0041a5cc
lea eax, [esp + 0x14]
push eax
call fcn.00405c30
mov ecx, dword [eax]
add esp, 8
push ecx
push 0x4581ac
lea edx, [esp + 0x30]
push 0x430274
push edx
call fcn.00407d6b
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.0041a55e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x258]
push eax
call esi
lea ecx, [esp + 0x58c]
push ecx
call esi
lea edx, [esp + 0x18]
xor ebx, ebx
push edx
push ebx
push ebx
push 0x405580
push ebx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x434b9c], eax
mov dword [0x434ba0], ebx
call fcn.00403ea0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x8b8]
lea ecx, [esp + 0x58c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x402f07
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4585f0]
mov ecx, dword [esp + 0x10]
inc ecx
cmp eax, ebx
mov dword [esp + 0x10], ecx
je 0x402d0c
cmp dword [0x4585f8], ebx
jne 0x402d0c
lea ecx, [esp + 0x1c]
call fcn.00402140
push 0x430254
lea ecx, [esp + 0x20]
call fcn.00402190
cmp eax, ebx
mov dword [0x4585f8], eax
je 0x402d03
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.vrvhook.dll
call fcn.0041a5cc
lea edx, [esp + 0x18]
push edx
call fcn.00405c30
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x6b8]
push eax
push 0x4581ac
push 0x430274
push ecx
call fcn.00407d6b
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.0041a55e
mov edx, dword [0x458610]
push 1
mov ecx, dword [edx + 4]
lea edx, [esp + 0x6bc]
push edx
mov edx, dword [0x4585f8]
mov eax, dword [ecx]
push ebx
push edx
call dword [eax + 0x10]
lea ecx, [esp + 0x1c]
call fcn.00402170
lea eax, [esp + 0x258]
push eax
call fcn.00404530
add esp, 4
lea ecx, [esp + 0x28]
lea edx, [esp + 0x12c]
push ecx
push 0x12c
push edx
push 0x434b88
push str.HelpControlDevice
push 0x430228
call ebp
lea eax, [esp + 0x12c]
push eax
call fcn.00407ca6
mov ecx, dword [0x4585d0]
add esp, 4
cmp ecx, ebx
je 0x402d6c
cmp dword [0x45861c], eax
je 0x402d6c
push eax
mov dword [0x45861c], eax
call ecx
add esp, 4
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x386]
mov word [esp + 0x384], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0x12c]
push ecx
push 0x12c
push edx
push 0x434b88
push str.DisableCreateDiskFile
push 0x430228
stosw word es:[edi], ax
call ebp
lea eax, [esp + 0x12c]
push eax
call fcn.00407ca6
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x402e11
lea ecx, [esp + 0x28]
lea edx, [esp + 0x12c]
push ecx
push 0x104
push edx
push 0x434b88
push str.DisableCreateDiskInfo
push 0x430228
call ebp
lea eax, [esp + 0x384]
push 0x104
push eax
lea ecx, [esp + 0x134]
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x384]
push edx
call fcn.004183ae
add esp, 4
cmp dword [0x4585d4], ebx
je 0x402e61
cmp dword [0x458620], esi
jne 0x402e3a
lea eax, [esp + 0x384]
push eax
push 0x45862c
call fcn.00407be6
add esp, 8
test eax, eax
je 0x402e61
lea ecx, [esp + 0x384]
push ecx
push 0x45862c
call fcn.00407bc1
push 0x45862c
push esi
mov dword [0x458620], esi
call dword [0x4585d4]
add esp, 0x10
lea edx, [esp + 0x28]
lea eax, [esp + 0x12c]
push edx
push 0x12c
push eax
push 0x4301f4
push str.DisableFormatUSBDisk
push 0x430228
call ebp
lea ecx, [esp + 0x12c]
push ecx
call fcn.00407ca6
add esp, 4
cmp eax, ebx
je 0x402eb5
mov ecx, dword [0x4585dc]
cmp ecx, ebx
je 0x402eb5
cmp dword [0x458624], eax
je 0x402eb5
push eax
mov dword [0x458624], eax
call ecx
add esp, 4
cmp dword [esp + 0x10], 6
jne 0x402c33
mov eax, dword [0x4583c4]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x402c33
call fcn.00404ca0
test eax, eax
je 0x402c33
mov eax, 0xce6c
call fcn.00407e90
mov ecx, 0x339b
mov esi, 0x44b340
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x4583c4]
add esp, 0xce6c
jmp 0x402c33
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, 0x434b9c
mov eax, dword [esi]
cmp eax, ebx
je 0x402f23
push ebx
push eax
call edi
add esi, 4
cmp esi, 0x434ba4
jl 0x402f19
mov eax, dword [0x434b94]
mov dword [esp + 0x14], eax
mov ebp, dword [eax]
cmp ebp, eax
je 0x402fc9
mov edi, ebp
mov ebp, dword [ebp]
mov edx, dword [edi + 4]
mov eax, dword [edi]
lea esi, [edi + 8]
mov dword [edx], eax
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [ecx + 4], edx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x402f9e
push eax
mov ecx, esi
call fcn.004061b0
cmp byte [eax], 0
je 0x402f8b
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.004061b0
cmp byte [eax], 0xff
je 0x402f8b
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.004061b0
dec byte [eax]
jmp 0x402f9e
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
add edx, 2
dec eax
push edx
push eax
mov ecx, esi
call fcn.004061c0
push edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0041a2c2
mov ecx, dword [0x434b98]
mov eax, dword [esp + 0x18]
add esp, 4
dec ecx
cmp ebp, eax
mov dword [0x434b98], ecx
jne 0x402f41
call fcn.00403fa0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x9e8
ret 0x10