Function at 0x413330
Capabilities:
Create thread
Empty the recycle bin
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
cmp edx, dword [0x465f54]
jne 0x413ae8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a8b0
add esp, 8
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x4139dd
cmp dword [0x466a20], 0x189
je 0x413920
cmp dword [0x466a20], 0x2b8
je 0x41377c
cmp dword [0x465f88], 0
jne 0x413777
cmp dword [0x466a20], 0x2b2
jne 0x413510
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040af20
mov dword [ebp - 0x14], 0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x40005
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x3da
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x384
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [0x466a84]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a80]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a98]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a4c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a68]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a44]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a40]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x4663e4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x11c
push 0x126
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
sub eax, 0x11c
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
sub eax, 0x126
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
push 0xf1
mov edx, dword [0x466a4c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x466a20], 0x2b7
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x413777
cmp dword [0x466a20], 0x2b6
jne 0x41354d
push 0
mov edx, dword [0x466a90]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a94]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a9c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x413707
cmp dword [0x466a20], 0x2b5
jne 0x41358a
push 0
mov edx, dword [0x466a64]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a7c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a78]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x413707
cmp dword [0x466a20], 0x2b4
jne 0x4135d6
push 0
mov edx, dword [0x466a50]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a88]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a54]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a74]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x413707
cmp dword [0x466a20], 0x2b3
jne 0x413656
push 5
mov eax, dword [0x466a84]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a80]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a98]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x4663f4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x465f74], 0
je 0x413651
push 0
push 0
push 0
push 0x414fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x465f74], 0
jmp 0x413707
cmp dword [0x466a20], 0x2b1
jne 0x413707
push 5
mov edx, dword [0x466a84]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a80]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a98]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466abc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466ab8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a24]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a28]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a2c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x466a30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a34]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0x466a38]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x34], 0x17
mov dword [ebp - 0x30], 0x1b
mov dword [ebp - 0x2c], 0x117
mov dword [ebp - 0x28], 0xc1
push 1
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
mov eax, dword [0x466a4c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a68]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a44]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a40]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x466a20], 0x2b7
jmp 0x413920
cmp dword [0x4663ac], 0
jne 0x413920
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040af20
mov dword [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x40005
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x3da
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 5
mov edx, dword [0x466a84]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a80]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a98]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a4c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x466a68]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [0x466a44]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x466a40]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x4663e4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x11c
push 0x126
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
sub eax, 0x11c
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
sub eax, 0x126
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
push 0xf1
mov edx, dword [0x466a4c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x50], 0x6d0
push 1
mov eax, dword [ebp - 0x50]
push eax
call fcn.0042f5a5
add esp, 8
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [0x466420]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0042ca90
add esp, 0xc
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x50]
push edx
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x60], eax
push 0
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x4c], 0
je 0x413900
mov edx, dword [ebp - 0x4c]
push edx
call fcn.0042f5b0
add esp, 4
mov dword [0x466a20], 0x2b7
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x465f68], 1
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
push 0x466430
call fcn.0042fb63
add esp, 8
push 5
mov ecx, dword [0x466ab4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [0x466a44]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x32
mov eax, dword [0x465f9c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0040a8b0
add esp, 8
push 0
push 0
push 0x466430
push 0x40f650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x4139a9
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x44], 0xa0
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x11a
mov dword [ebp - 0x38], 0x83
push 1
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x413ae8
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 8]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x413ae8
mov dword [ebp - 0x54], 1
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
call fcn.00409ae0
add esp, 4
test eax, eax
je 0x413a44
push 0x14
push 0x450410
push 0x450418
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x413a3b
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
call fcn.004088e0
add esp, 4
mov dword [ebp - 0x54], 0
jmp 0x413a9d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esp
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
call fcn.00403550
mov dword [ebp - 0x6c], eax
call fcn.0041e020
add esp, 0x18
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x413a9d
push 0x14
push 0x45047c
push 0x4504a8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x413a96
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
call fcn.004088e0
add esp, 4
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], 0
je 0x413ab9
push 0
push 0x45050c
push 0x450484
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 3
push 0
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
push 0x40005
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x3db
call dword [sym.imp.WINMM.dll_PlaySoundW]
call fcn.0041a7e0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret