Function at 0x40de2d
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov dword [ebp - 0x140], 0x4177d0
mov dword [ebp - 0x13c], 0x4177e0
mov dword [ebp - 0x138], 0x4177f0
mov dword [ebp - 0x134], 0x417800
mov dword [ebp - 0x130], 0x417810
mov dword [ebp - 0x12c], 0x417820
mov dword [ebp - 0x128], 0x417830
mov dword [ebp - 0x124], 0x417840
mov dword [ebp - 0x120], 0x417850
mov dword [ebp - 0x11c], 0x417860
mov dword [ebp - 0x118], 0x417870
push str.WebFile.ini
mov eax, dword [0x418a20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x418d40
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x114]
push eax
push 0
push str.file
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov word [ebp - 0x338], 1
jmp 0x40df05
mov cx, word [ebp - 0x338]
add cx, 1
mov word [ebp - 0x338], cx
mov edx, dword [ebp - 0x338]
and edx, 0xffff
xor eax, eax
mov ax, word [0x418aea]
cmp edx, eax
jg 0x40df97
xor ecx, ecx
mov cx, word [0x418a82]
mov edx, dword [ebp + ecx*4 - 0x144]
add edx, 2
push edx
mov eax, dword [ebp - 0x338]
and eax, 0xffff
push eax
push 0x41788c
mov ecx, dword [0x418a20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x338]
and edx, 0xffff
push edx
push 0x417894
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x418d40
lea edx, [ebp - 0x344]
push edx
push str.Files
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x40def3
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x44
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.0040eab0
add esp, 0xc
mov dword [ebp - 0x41c], 0x44
lea ecx, [ebp - 0x114]
push ecx
push 0x418b00
push str.__s____s_
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x14
call fcn.00408150
add esp, 8
mov dword [ebp - 0x3d8], 0x94
lea eax, [ebp - 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40e0f4
cmp dword [ebp - 0x3c8], 2
jne 0x40e067
push 1
lea ecx, [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x4178ac
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x40e047
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40e02c
push 0
push str.TABCMain
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40e062
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40e047
jmp 0x40e0f4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x334]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e0f4
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e0e0
call dword [sym.imp.USER32.dll_WaitMessage]
test eax, eax
je 0x40e0de
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40e0de
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40e091
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xf
call fcn.00408150
add esp, 8
mov esp, ebp
pop ebp
ret