Function at 0x480cf0
Capabilities:
Check os version
Create thread
Get disk information
Hide graphical window
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x6cc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x6c4], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], edx
push eax
mov ebx, ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x34], 0x42ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x104
push 0x4e6040
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
push 0x4e6040
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, 0x4e6040
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x481819
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push 0x4e6040
push 0x4e5c20
mov word [eax + 0x4e6040], cx
call esi
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.data_
push 0x4e5c20
call ebp
push 0x4e6040
push 0x4e5e28
call esi
push str.wintoolsnet.ini
push 0x4e5e28
call ebp
push 0x4e6040
push 0x4e6260
call esi
push str.langdefault.lng
push 0x4e6260
call ebp
push 0x4e6040
push 0x4e5a00
call esi
push str.help_
push 0x4e5a00
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x2c0]
push 0x4e6260
push 0x104
push eax
push 0
push 0x4b35b0
push str.LANGUAGE
call esi
lea eax, [esp + 0x2c0]
push eax
push 0x4e5a00
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4e5e28
push 0xc8
push str.Edition
push str.OPTIONS
call edi
push 2
push 0x32
mov dword [0x4cc1d8], eax
mov dword [0x4e5c0c], ebx
call fcn.004909d3
add esp, 8
mov dword [0x4e4f4c], eax
push 0x4e5e28
push 0
push 0x4c0a98
push str.OPTIONS
call edi
test eax, eax
jne 0x480f73
push 0x206
push eax
mov word [esp + 0xc0], ax
lea eax, [esp + 0xc2]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x4c8], ax
push 0x206
push eax
lea eax, [esp + 0x4d2]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x2c0], ax
push 0x206
push eax
lea eax, [esp + 0x2ca]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x24]
push 0
push 0
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x104
lea eax, [esp + 0x2d8]
push eax
push 0x4b6c94
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x1c]
lea eax, [esp + 0xbc]
push 0x4b5b00
push 0x104
push eax
call fcn.0040a420
add esp, 0x10
lea eax, [esp + 0x4c8]
push 0x4e5e28
push 0x104
push eax
push 0x4b34dc
push str.Trash
push str.SYSFILES
call esi
lea eax, [esp + 0x4c8]
push eax
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x480f73
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x4e5e28
push 0x4b34dc
push 0x4c22a0
push 0x4c22a4
call esi
push 0x4e5e28
lea eax, [esp + 0xbc]
push eax
push str.Trash
push str.SYSFILES
call esi
call fcn.00471fe0
test eax, eax
jne 0x480fd4
push eax
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x480fd4
mov dword [0x4e4f34], 1
mov dword [0x4e4f38], 1
mov dword [0x4e4f3c], 1
mov dword [0x4e4f44], 1
mov dword [0x4e4f48], 1
mov dword [0x4e4f30], 1
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4cf0000
push 0x4e6900
push 0x4e6838
push 0
call esi
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x48101d
mov ecx, dword [esp + 0x6d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x6cc
ret
push 0
push ebx
push 0
push eax
push 0
push 0
push 0
push 0
push 0xc0480000
push 0
push str.STATIC
push 8
mov dword [0x4e6030], eax
call esi
push 0x471df0
push 0xfffffffffffffffc
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x4e97
push ebx
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [esp + 0x34]
mov dword [0x4e4eac], eax
push ecx
xorps xmm0, xmm0
push 0x18
push eax
movups xmmword [esp + 0x40], xmm0
movq qword [esp + 0x50], xmm0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
lea eax, [esp + 0x64]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [esp + 0x70], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call ebx
push 0x40
push dword [esp + 0x40]
mov esi, eax
push dword [esp + 0x40]
sub esi, dword [esp + 0x78]
push 1
call ebx
sub eax, dword [esp + 0x48]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
call ebx
sub eax, dword [esp + 0x48]
mov esi, dword [esp + 0x20]
cdq
sub eax, edx
sar eax, 1
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 0x4b3ab0
mov ecx, str.MAINPAGE
call fcn.00478640
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0xc
push esi
call ebp
push 0x4e5e28
push 5
push str.Transparent
push str.OPTIONS
call edi
mov ebx, 0x64
mov edx, ebx
mov ecx, esi
sub edx, eax
call fcn.00480b00
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xbc], 6
jne 0x481179
mov eax, dword [esp + 0xc0]
test eax, eax
jne 0x481157
mov eax, 1
mov dword [0x4e59f8], eax
jmp 0x48117e
cmp eax, 1
jne 0x481168
mov eax, 2
mov dword [0x4e59f8], eax
jmp 0x48117e
cmp eax, 2
jne 0x481179
mov eax, 3
mov dword [0x4e59f8], eax
jmp 0x48117e
mov eax, dword [0x4e59f8]
sub eax, 1
je 0x48118d
sub eax, 2
mov eax, 0x200
je 0x481192
mov eax, 0x100
push 0x4e5e28
push 5
push str.Transparent
push str.OPTIONS
mov dword [0x4cc1c0], eax
call edi
mov ecx, dword [esp + 0x1c]
sub ebx, eax
mov edx, ebx
call fcn.00480b00
mov edx, 0x4b454c
mov ecx, str.MAINPAGE
call fcn.00478640
mov ebx, dword [0x4e6030]
push 0x2710
push ebx
push eax
push 0x40800000
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov dword [0x4e5c10], eax
test eax, eax
je 0x4812bd
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
push ebx
mov dword [esp + 0x98], 0x136
mov dword [esp + 0x9c], 0x2bc
mov dword [esp + 0xa0], 0x7d0
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [esp + 0x90]
push eax
push 4
push 0x404
push dword [0x4e5c10]
call ebp
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b330c
push str.MENUTEXT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
test eax, eax
jle 0x4812a5
lea edi, [esi + 0xa]
nop word [eax + eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x481293
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x481280
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.unnamed
push 2
push 0x40b
push dword [0x4e5c10]
call ebp
mov esi, dword [esp + 0x10]
push 0
push 0x3e8
push 1
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.004787c0
call fcn.0047c600
call fcn.00465c80
call fcn.0047d060
call fcn.0047fd10
call fcn.0047c7d0
push 0x4e5e28
push 0
push str.SaveSize
push str.OPTIONS
call edi
test eax, eax
je 0x48132c
push 0x4e5e28
push 0
push str.ShowMaximized
push str.SIZE
call edi
mov ecx, dword [esp + 0x20]
test eax, eax
mov edx, 3
cmovne ecx, edx
mov dword [esp + 0x20], ecx
mov edx, 0x4b489c
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.004040d0
mov edx, 0x4b4d78
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.0040b600
mov edx, 0x4b4dc0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00415400
mov edx, 0x4b4dc8
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.004274e0
mov edx, 0x4b4dd8
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00432a80
mov edx, 0x4b4dd0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00445600
mov edx, 0x4b4de0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.0044a4a0
mov edx, 0x4b6e74
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00455020
push 0x4e5e28
push 0
push str.OnTop
push str.OPTIONS
call edi
push 3
push 0
push 0
push 0
test eax, eax
mov eax, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
jne 0x481436
push 0xfffffffffffffffe
jmp 0x481438
push 0xffffffffffffffff
push dword [0x4e6030]
call eax
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x4e6470
push 0
push 0x10
call esi
push 0x4e5e28
push 0
push str.NoSaver
push str.OPTIONS
call edi
push 2
push 0
test eax, eax
jne 0x481472
push 1
jmp 0x481474
push 0
push 0x11
call esi
push 0x4e5e28
push 0
push str.Magnet
push str.OPTIONS
call edi
mov dword [0x4e6258], eax
call fcn.0047b6d0
call fcn.00471fe0
test eax, eax
je 0x4814b1
push 1
push 0x755e
push dword [0x4e6250]
call dword [sym.imp.USER32.dll_EnableMenuItem]
lea eax, [esp + 0x70]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x80]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x88]
mov ebx, dword [0x4cc1e4]
mov ebp, dword [0x4cc1e0]
add ebx, eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x8c]
push 0x4e5e28
push 0
push str.SaveSize
add ebp, eax
mov dword [0x4cc1e4], ebx
push str.OPTIONS
mov dword [0x4cc1e0], ebp
call edi
test eax, eax
je 0x481551
push 0x4e5e28
push dword [0x4cc1e4]
push str.Right
push str.SIZE
call edi
push 0x4e5e28
push dword [0x4cc1e0]
mov ebx, eax
push str.Bottom
push str.SIZE
call edi
mov ebp, eax
push 0
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [esp + 0x60], xmm0
call esi
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
sub esi, dword [esp + 0x5c]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
push 1
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, esi
cdq
sub eax, edx
mov ecx, eax
mov eax, ebp
cdq
push 0x4e5e28
sub eax, edx
sar ecx, 1
push 0
sar eax, 1
push str.Position
sub ecx, eax
push str.OPTIONS
mov dword [esp + 0x28], ecx
call edi
mov esi, dword [esp + 0x14]
test eax, eax
je 0x4815f5
push 0x4e5e28
push esi
push str.Left
push str.SIZE
call edi
push 0x4e5e28
mov esi, eax
mov eax, dword [esp + 0x1c]
push eax
push 0x4c6ee4
push str.SIZE
call edi
jmp 0x4815f9
mov eax, dword [esp + 0x18]
push 0
push ebp
push ebx
push eax
push esi
push 1
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push pe_nt_image_headers32
lea eax, [esp + 0xc0]
push 0
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0xb8], 0x114
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xbc], 6
ja 0x481666
jne 0x48171e
cmp dword [esp + 0xc0], 2
jb 0x48171e
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 4
push eax
push 1
push 0
push 0x4c6c30
push 0x80000001
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4816c5
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push str.AppsUseLightTheme
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Dwmapi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4816e7
push str.Dwmapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x48171e
push str.DwmSetWindowAttribute
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x481717
cmp dword [esp + 0x14], 0
mov dword [esp + 0x24], 1
jne 0x481717
push 4
lea ecx, [esp + 0x28]
push ecx
push 0x14
push dword [0x4e6030]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x4e5c10]
call esi
push dword [esp + 0x20]
mov ebx, dword [esp + 0x20]
push ebx
call esi
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4e5e28
push 0
push str.Protect
push str.OPTIONS
call edi
test eax, eax
je 0x481775
push 0
push 0x4639c0
push dword [0x4e6030]
push str.PASSWORD
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x475d00
push 0
push 0
call esi
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc0], ax
lea eax, [esp + 0xc2]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0xb8]
push 0x4e6040
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.Updates.ini
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xb8]
push eax
push 0
push str.AppVersion
push str.WINTOOLS
call edi
cmp eax, 0x5e25
jle 0x48180f
cmp dword [0x4e28d4], 0
jne 0x48180f
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x45fb30
push 0
push 0
call esi
mov eax, 1
jmp 0x481004
call fcn.0048eba6
int3