Function at 0x414350
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac347
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
push edi
mov eax, dword [0x663068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
lea eax, [ecx + 0x634]
mov dword [ebp - 0x10], 0
cmp edx, eax
jne 0x4143a6
push 0
push 0
push 0x10
push dword [ecx + 0x20]
mov dword [ecx + 0x784], 1
jmp 0x41459e
lea eax, [ecx + 0x4e4]
cmp edx, eax
jne 0x4145a4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00403990
lea edx, [ebp - 0x70]
mov dword [ebp - 0x10], 1
call fcn.0042ae90
push str.clientsetup.duck
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x44]
call fcn.0042e060
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4143fd
cmp dword [eax + 0x24], ecx
mov ecx, 0x64d50c
je 0x4143fd
mov ecx, dword [eax + 0x1c]
call fcn.0042b160
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00403c40
mov edi, 1
mov dword [ebp - 0x10], edi
and edi, 0xfffffffe
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00403c40
test esi, esi
jne 0x4144a1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00403990
or edi, 2
lea edx, [ebp - 0x70]
mov dword [ebp - 0x10], edi
call fcn.0042ae90
push str.clientsetup.duck
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x44]
call fcn.0042e060
add esp, 4
mov byte [ebp - 4], 3
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x414479
cmp dword [eax + 0x24], ecx
mov ecx, 0x64d50c
je 0x414479
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00403c40
and edi, 0xfffffffd
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00403c40
mov esi, dword [0x666030]
mov edx, 0x64d010
lea ecx, [esi + 0xfa8]
call fcn.00414630
test eax, eax
je 0x414537
lea ecx, [ebp - 0x70]
call fcn.00403990
mov dword [ebp - 4], 4
mov dword [ebp - 0x70], vtable.CWConstString.0
mov dword [ebp - 0x64], 0x64d3d0
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00403990
mov byte [ebp - 4], 6
mov dword [ebp - 0x44], vtable.CWConstString.0
mov dword [ebp - 0x38], str._OS_MR_t
mov byte [ebp - 4], 7
lea eax, [ebp - 0x70]
push ecx
push eax
mov edx, 4
lea ecx, [ebp - 0x44]
call fcn.0041f4b0
mov esi, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00403c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00403c40
cmp esi, 6
je 0x4145a4
mov esi, dword [0x666030]
push 0
push dword [esi + 0xe64]
call dword [0x665fbc]
mov eax, dword [0x666030]
push 1
push dword [eax + 0xe64]
call dword [0x665fb8]
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x412ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41457a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push 1
push dword [eax + 0xc]
call dword [0x665fb8]
mov eax, dword [ebp - 0x14]
push 0
push 0
push 0x10
push dword [eax + 0x20]
mov dword [eax + 0x784], 1
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20