Function at 0x401000
Capabilities:
Check mutex on windows
Hide graphical window
Link many functions at runtime
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
push edi
mov dword [ebp - 0x220], 0
mov byte [ebp - 0x5dc], 0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x5db]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x40f0f0]
mov word [ebp - 0x114], ax
mov byte [ebp - 0x6ec], 0
xor ecx, ecx
mov dword [ebp - 0x6eb], ecx
mov dword [ebp - 0x6e7], ecx
mov byte [ebp - 0x6e3], cl
mov byte [ebp - 0x218], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x458], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x457]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x354], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x353]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x7f4], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x7f3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x6e0], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6df]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x55c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x55b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x6f0], 0xc8
mov dword [ebp - 0x21c], 0xc8
mov dword [ebp - 4], 0
mov byte [ebp - 0x918], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x917]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 8]
mov dword [0x411100], edx
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a4
jne 0x401157
mov byte [0x40f0d0], 1
jmp 0x40115e
mov byte [0x40f0d0], 0
push 0x104
lea eax, [ebp - 0x918]
push eax
push 0x42
mov ecx, dword [0x411100]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40f0f4
lea edx, [ebp - 0x918]
push edx
call fcn.0040d180
add esp, 8
test eax, eax
jne 0x40119d
mov dword [0x410928], 1
jmp 0x4011a7
mov dword [0x410928], 0
push str._uinst
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040d180
add esp, 8
test eax, eax
jne 0x4011d0
mov dword [0x410928], 1
mov dword [0x410814], 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x218]
push ecx
call fcn.00409fa0
add esp, 8
mov byte [eax], 0
cmp dword [0x410928], 0
je 0x401226
push str._fidtpu.inf
lea edx, [ebp - 0x218]
push edx
call fcn.00409db0
add esp, 8
jmp 0x401259
cmp dword [0x40f0cc], 8
jae 0x401245
push str.Ftsetup.inf
lea eax, [ebp - 0x218]
push eax
call fcn.00409db0
add esp, 8
jmp 0x401259
push str.FIDMOU.inf
lea ecx, [ebp - 0x218]
push ecx
call fcn.00409db0
add esp, 8
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0x5dc]
push ecx
push 0x410d74
push str.DriverVer
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x410d78
lea edx, [ebp - 0x5dc]
push edx
call fcn.00409f10
add esp, 8
test eax, eax
je 0x401324
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x5dc]
push ecx
call fcn.00409e90
add esp, 8
mov dword [ebp - 0x578], eax
mov edx, dword [ebp - 0x578]
add edx, 1
push edx
lea eax, [ebp - 0x6ec]
push eax
call fcn.00409da0
add esp, 8
push 0x2e
lea ecx, [ebp - 0x6ec]
push ecx
call fcn.00409fa0
add esp, 8
mov byte [eax], 0
push 0x2e
lea edx, [ebp - 0x6ec]
push edx
call fcn.00409fa0
add esp, 8
mov byte [eax], 0
push 0x40f13c
push 0x4105f4
call fcn.00409da0
add esp, 8
lea eax, [ebp - 0x6ec]
push eax
push 0x4105f4
call fcn.00409db0
add esp, 8
jmp 0x401361
cmp dword [0x410928], 0
je 0x401348
push 0x104
push 0x4105f4
push 0x40
mov ecx, dword [0x411100]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x401361
push 0x104
push 0x4105f4
push 0x3f
mov edx, dword [0x411100]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x410928], 0
je 0x401387
push 0x104
lea eax, [ebp - 0x55c]
push eax
push 0x35
mov ecx, dword [0x411100]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x4013a1
push 0x104
lea edx, [ebp - 0x55c]
push edx
push 0x16
mov eax, dword [0x411100]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
lea ecx, [ebp - 0x7f4]
push ecx
push 0x1f
mov edx, dword [0x411100]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x410928], 0
je 0x4013e2
push 0x104
lea eax, [ebp - 0x354]
push eax
push 0x3b
mov ecx, dword [0x411100]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x401425
xor edx, edx
mov dl, byte [0x40f0d0]
test edx, edx
je 0x40140b
push 0x104
lea eax, [ebp - 0x354]
push eax
push 0xb
mov ecx, dword [0x411100]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x401425
push 0x104
lea edx, [ebp - 0x354]
push edx
push 0xc
mov eax, dword [0x411100]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x55c]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 0
je 0x40163e
push 0x40f140
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 0
je 0x4014a2
push 0x40f14c
mov edx, dword [ebp - 0x91c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x920], eax
call dword [ebp - 0x920]
mov dword [0x40f0cc], eax
mov eax, dword [ebp - 0x91c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4014a9
xor eax, eax
jmp 0x401c35
cmp dword [0x40f0cc], 8
jb 0x4014b9
xor eax, eax
jmp 0x401c35
push 0x40f158
lea ecx, [ebp - 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40f15c
lea edx, [ebp - 0x7f4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x24c], 3
mov dword [ebp - 0x248], fcn.00408170
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 0
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], 6
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x22c], ecx
lea edx, [ebp - 0x7f4]
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x250], 0x30
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
and eax, 0xffff
test eax, eax
jne 0x40157e
xor eax, eax
jmp 0x401c35
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0x80000000
lea edx, [ebp - 0x354]
push edx
lea eax, [ebp - 0x7f4]
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4015d1
mov ecx, dword [ebp - 0x7f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401c35
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x2345
push 0
push 0x400
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401626
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4015f3
mov ecx, dword [ebp - 0x7f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x80c]
jmp 0x401c35
lea edx, [ebp - 0x55c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 0
jne 0x401665
xor eax, eax
jmp 0x401c35
push 0
mov eax, dword [ebp - 0x7f8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x924], eax
mov ecx, dword [ebp - 0x924]
mov dword [ebp - 0x944], ecx
cmp dword [ebp - 0x944], 0
je 0x40169d
cmp dword [ebp - 0x944], 0x80
je 0x40169d
jmp 0x40169f
jmp 0x4016a6
xor eax, eax
jmp 0x401c35
push str.FTFL1.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 0
je 0x4016f2
push str.FtGeOsVe
mov edx, dword [ebp - 0x928]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x92c], eax
call dword [ebp - 0x92c]
mov dword [0x40f0cc], eax
mov eax, dword [ebp - 0x928]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4016f9
xor eax, eax
jmp 0x401c35
mov dword [ebp - 0x24c], 3
mov dword [ebp - 0x248], 0x406530
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], 0
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], 6
lea edx, [ebp - 0x354]
mov dword [ebp - 0x22c], edx
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x250], 0x30
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
and eax, 0xffff
test eax, eax
jne 0x4017a7
mov edx, dword [ebp - 0x7f8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401c35
cmp dword [0x410928], 0
je 0x4018ce
cmp dword [0x410814], 0
je 0x401896
mov dword [ebp - 0x930], 0
mov eax, 1
test eax, eax
je 0x401894
mov ecx, dword [ebp - 0x930]
add ecx, 1
mov dword [ebp - 0x930], ecx
cmp dword [ebp - 0x930], 0x3e8
jle 0x4017f8
jmp 0x401894
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x40f178
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x410704], eax
cmp dword [0x410704], 0xffffffff
je 0x401887
push 0x16
push 0
lea edx, [ebp - 0x574]
push edx
call fcn.00409d40
add esp, 0xc
push 0
push 0x4110a4
push 0x1c
push 0x4103a0
push 0
push 0
push 0x2220a4
mov eax, dword [0x410704]
push eax
mov ecx, dword [0x410928]
push ecx
call fcn.00408d70
add esp, 0x24
mov dword [ebp - 0x934], eax
mov edx, dword [0x410704]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x410704], 0
cmp dword [0x4103a4], 0
je 0x401887
jmp 0x401894
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4017cb
jmp 0x4018c9
mov eax, dword [0x410928]
push eax
call fcn.00408c50
add esp, 4
mov dword [0x410704], eax
cmp dword [0x410704], 0
je 0x4018c9
mov ecx, dword [0x410704]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x410704], 0
jmp 0x401aa2
cmp dword [0x40f0cc], 7
ja 0x401934
push 0x104
lea edx, [ebp - 0x458]
push edx
push 0x15
mov eax, dword [0x411100]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push 0x4000000
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x458]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x410704], eax
cmp dword [0x410704], 0xffffffff
jne 0x40192f
mov edx, dword [ebp - 0x7f8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401c35
jmp 0x401aa2
cmp dword [0x40f0cc], 8
jne 0x4019a0
push 0x104
lea eax, [ebp - 0x6e0]
push eax
push 0x14
mov ecx, dword [0x411100]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
lea edx, [ebp - 0x110]
push edx
push 0x13
mov eax, dword [0x411100]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x6e0]
push edx
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x4019a0
mov eax, dword [ebp - 0x7f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401c35
push 0x104
lea ecx, [ebp - 0x458]
push ecx
push 0x15
mov edx, dword [0x411100]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x410704], eax
cmp dword [0x410704], 0xffffffff
je 0x401a8e
push 0x16
push 0
lea ecx, [ebp - 0x574]
push ecx
call fcn.00409d40
add esp, 0xc
cmp dword [0x40f0cc], 8
jne 0x401a3b
push 0
push 0x4110a4
push 0x16
lea edx, [ebp - 0x574]
push edx
push 0
push 0
push 0x272000
mov eax, dword [0x410704]
push eax
mov ecx, dword [0x410928]
push ecx
call fcn.00408d70
add esp, 0x24
mov dword [ebp - 0x938], eax
jmp 0x401a6f
push 0
push 0x4110a4
push 0x16
lea edx, [ebp - 0x574]
push edx
push 0
push 0
push 0x222000
mov eax, dword [0x410704]
push eax
mov ecx, dword [0x410928]
push ecx
call fcn.00408d70
add esp, 0x24
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 0
jne 0x401a8c
mov edx, dword [ebp - 0x7f8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401c35
jmp 0x401aa2
mov eax, dword [ebp - 0x7f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401c35
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0x80000000
lea edx, [ebp - 0x354]
push edx
lea eax, [ebp - 0x7f4]
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401b02
mov ecx, dword [ebp - 0x7f8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x410704]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401c35
call fcn.00409340
test eax, eax
je 0x401bb6
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41091c], eax
cmp dword [0x41091c], 0
je 0x401b54
push str.WTSRegisterSessionNotification
mov eax, dword [0x41091c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 0
je 0x401b54
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x93c]
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x410920], eax
cmp dword [0x410920], 0
je 0x401bb6
push str.ProcessIdToSessionId
mov edx, dword [0x410920]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x940], eax
push str.WTSGetActiveConsoleSessionId
mov eax, dword [0x410920]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4110fc], eax
cmp dword [ebp - 0x940], 0
je 0x401bb6
push 0x41109c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [ebp - 0x940]
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x400
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401c08
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401bd5
mov eax, dword [ebp - 0x7f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x410704]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x410708]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80c]
pop edi
mov esp, ebp
pop ebp
ret 0x10