Function at 0x4052c0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x320
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x31c], eax
mov eax, dword [esp + 0x328]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x334]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov byte [0x450023], bl
cmp byte [0x450df8], bl
je 0x4053e7
cmp byte [0x43d376], bl
je 0x40531f
push edi
call fcn.004050b0
add esp, 4
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
je 0x405372
push ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push 0x83050024
push eax
call esi
test eax, eax
je 0x40534e
cmp dword [esp + 0x1c], 0x320
je 0x405368
push 0x10
push 0x4346e4
push str.DebugView_has_found_a_previously_loaded_DebugView_driver_with_a_version_incompatable_with_the_nuser_interface._Please_reboot_the_system_and_restart_DebugView_to_synchronize_the_interface_and_driver.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x40582c
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
jne 0x4053a9
mov eax, dword [0x449734]
push ebx
push 0x9c5f
push eax
mov byte [0x43d376], bl
mov byte [0x450023], 1
mov dword [0x4534e4], 0x440c18
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
je 0x40559f
push ebx
xor edx, edx
cmp byte [0x43d367], bl
lea ecx, [esp + 0x14]
push ecx
push ebx
setne dl
push ebx
push ebx
push ebx
lea edx, [edx*4 - 0x7cfafff0]
push edx
push eax
call esi
test eax, eax
jne 0x405544
push 0x10
push 0x4346e4
push 0x434e50
push edi
call ebp
xor al, al
jmp 0x40582c
call fcn.00401500
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
cmp eax, ebx
jne 0x40540b
push 0x30
push 0x4346e4
push str.Failed_to_install_Win32_OutputDebugString_hook.
push ebx
call ebp
mov byte [0x43d374], bl
lea edx, [esp + 0x20]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405422
sub eax, edx
cmp byte [esp + eax + 0x1f], 0x5c
je 0x40544c
lea edi, [esp + 0x20]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x405437
mov ax, word [0x4351e8]
mov word [edi], ax
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x20]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x405451
mov ecx, dword [str.Dbgdd.vxd]
mov edx, dword [0x4351e0]
mov dword [eax], ecx
mov cx, word [0x4351e4]
mov dword [eax + 4], edx
lea edx, [esp + 0x20]
push edx
push str.RCDBGVXD
mov word [eax + 8], cx
call fcn.0040a600
add esp, 8
test al, al
jne 0x4054a1
push 0x10
push 0x4346e4
push str.Could_not_install_DebugView_VxD
push edi
call ebp
xor al, al
jmp 0x40582c
push ebx
push 0x44000000
push ebx
push ebx
push ebx
push ebx
push str..DBGDD.VXD
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x43d370], eax
cmp eax, 0xffffffff
jne 0x4054ee
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x43d370]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x4346e4
push str.Could_not_load_device_driver.
push edi
call ebp
xor al, al
jmp 0x40582c
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
je 0x40559f
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push 0x83050030
push eax
call esi
test eax, eax
jne 0x40539b
mov edx, dword [0x43d370]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x4346e4
push str.Cannot_connect_to_local_system_because_it_is_already_nconnected_to_another_instance_of_DebugView.
push edi
call ebp
xor al, al
jmp 0x40582c
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
je 0x40559f
push ebx
xor edx, edx
cmp byte [0x43d375], bl
lea ecx, [esp + 0x14]
push ecx
push ebx
sete dl
push ebx
push ebx
push ebx
lea edx, [edx*4 - 0x7cfaffcc]
push edx
push eax
call esi
test eax, eax
je 0x4053d1
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
je 0x40559f
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push 0x83050008
push eax
call esi
test eax, eax
je 0x4053d1
mov eax, dword [0x43d370]
cmp byte [0x450df8], bl
je 0x4055eb
push 0x450138
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x449848
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x43d370]
cmp eax, 0xffffffff
je 0x4055eb
push ebx
lea edx, [esp + 0x14]
push edx
push 4
push 0x4534e4
push ebx
push ebx
push 0x83050020
push eax
call esi
test eax, eax
je 0x4053d1
mov eax, dword [0x43d370]
cmp byte [0x43d376], bl
je 0x40565f
cmp eax, 0xffffffff
je 0x40565f
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push 0x83050000
push eax
call esi
test eax, eax
jne 0x40563a
push 0x10
push 0x4346e4
push str.Unable_to_hook_kernel_debug_prints._This_version_of_DebugView_is_not_compatible_nwith_this_version_of_Windows._nCheck_the_Sysinternals_site_for_updates.
push edi
call ebp
mov edx, dword [0x43d370]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov dword [0x43d370], eax
mov byte [0x43d376], bl
jmp 0x40565f
cmp byte [0x440c05], bl
je 0x40565a
mov ecx, dword [0x43d370]
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x8305003c
push ecx
call esi
mov eax, dword [0x43d370]
mov cl, byte [0x43d374]
cmp cl, bl
jne 0x405675
cmp byte [0x440c04], bl
je 0x40575c
cmp byte [0x450df8], bl
je 0x40572e
push ebx
call fcn.00403200
add esp, 4
test al, al
jne 0x4056d0
lea edx, [esp + 0x124]
push edx
call fcn.00401960
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x230]
push str.Unable_to_monitor_Win32_debug_output:__s_n
push ecx
call fcn.004124f2
add esp, 0x10
push 0x30
push 0x4346e4
lea edx, [esp + 0x230]
push edx
push ebx
call ebp
mov byte [0x43d374], bl
cmp byte [0x440c04], bl
je 0x40575c
push 1
call fcn.00403200
add esp, 4
test al, al
jne 0x40575c
lea eax, [esp + 0x124]
push eax
call fcn.00401960
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x230]
push str.Unable_to_monitor_Global_Win32_debug_output:__s_n
push edx
call fcn.004124f2
add esp, 0x10
push 0x30
push 0x4346e4
lea eax, [esp + 0x230]
push eax
push ebx
call ebp
mov byte [0x440c04], bl
jmp 0x40575c
cmp eax, 0xffffffff
je 0x40575c
push ebx
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push 4
push edx
xor edx, edx
cmp cl, bl
sete dl
lea edx, [edx*4 - 0x7cfaffe8]
push edx
push eax
call esi
test eax, eax
je 0x4053d1
push 0x450028
push str._s__local_
push 0x4524c0
mov byte [0x43d364], 1
mov byte [0x45014c], 1
mov byte [0x450022], bl
call fcn.004124f2
mov eax, dword [0x449734]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
add esp, 0xc
push 0x4524c0
push 0xc350
push ebx
push 4
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
mov ecx, dword [0x449734]
push 8
push 0xc350
push 4
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [0x43d365], bl
je 0x4057d7
mov ecx, dword [0x44cf60]
mov eax, dword [0x44b8ec]
jmp 0x4057e2
mov ecx, dword [0x44985c]
mov eax, dword [0x452324]
mov edx, dword [0x449734]
push ecx
push eax
push ebx
push 0xc350
push 4
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push ebx
push edi
call fcn.00403f00
mov eax, dword [0x449734]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
add esp, 8
push 1
push 0x9c71
push eax
call esi
mov ecx, dword [0x449734]
push ebx
push 0x9c78
push ecx
call esi
mov al, 1
mov ecx, dword [esp + 0x32c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004126a4
add esp, 0x320
ret