Function at 0x4010e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x4173f4]
xor eax, esp
mov dword [esp + 0x120], eax
push ebp
push 0x104
lea eax, [esp + 0x24]
push eax
push 0
mov ebp, 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call fcn.00404b60
add esp, 8
test eax, eax
je 0x40150e
mov edx, dword [str....._npK7SRNPExt.dll]
mov dword [eax + 1], edx
mov ecx, dword [0x4157cc]
mov dword [eax + 5], ecx
mov edx, dword [0x4157d0]
mov dword [eax + 9], edx
mov ecx, dword [0x4157d4]
mov dword [eax + 0xd], ecx
mov edx, dword [0x4157d8]
mov dword [eax + 0x11], edx
mov cx, word [0x4157dc]
push ebx
lea edx, [esp + 0x24]
push edx
mov word [eax + 0x15], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x4014f5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.K7WPBAL_InitEx
push ebx
call esi
mov edi, eax
test edi, edi
je 0x4014d3
push str.K7WPBAL_DeInitEx
push ebx
call esi
mov dword [esp + 0x24], eax
test eax, eax
je 0x4014d3
push str.IDProtLaunchK7PMEx
push ebx
call esi
mov dword [esp + 0x20], eax
test eax, eax
je 0x4014d3
push str.IDProtRegPMStatusCB
push ebx
call esi
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
je 0x4014d3
call edi
call fcn.00404316
push eax
push 1
lea eax, [esp + 0x24]
push 4
push eax
call fcn.00404951
add esp, 0x10
test eax, eax
je 0x4014cd
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4014cd
inc eax
push eax
call fcn.004041c0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4014c9
call fcn.00404316
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push 1
push ebx
call fcn.00404951
mov ecx, dword [esp + 0x2c]
add esp, 0x10
cmp ecx, eax
jne 0x4014c0
push str.LaunchK7PM
push ebx
mov byte [ecx + ebx], 0
call fcn.00404290
add esp, 8
test eax, eax
je 0x4012bf
call dword [esp + 0x20]
dec eax
neg eax
sbb eax, eax
neg eax
push eax
push str.LaunchK7PMReply
lea edx, [esp + 0x34]
push str._type_:___s____status_:__u
push edx
call fcn.00404066
lea eax, [esp + 0x3c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401275
sub eax, edx
mov dword [esp + 0x10], eax
call fcn.00404316
add eax, 0x20
push eax
push 1
lea eax, [esp + 0x18]
push 4
push eax
call fcn.00404ad0
add esp, 0x10
cmp eax, 1
jne 0x4014aa
call fcn.00404316
mov ecx, dword [esp + 0x10]
add eax, 0x20
push eax
push ecx
push 1
lea edx, [esp + 0x38]
push edx
jmp 0x4013a5
push str.RegPMStatusCB
push ebx
call fcn.00404290
add esp, 8
test eax, eax
je 0x401309
push 0
push 0x401080
call esi
dec eax
neg eax
sbb eax, eax
neg eax
push eax
push str.RegPMStatusCBReply
lea eax, [esp + 0x34]
push str._type_:___s____status_:__u
push eax
call fcn.00404066
lea eax, [esp + 0x3c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401300
jmp 0x401367
push str.GetSessionID
push ebx
call fcn.00404290
add esp, 8
test eax, eax
je 0x4013de
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [esp + 0x14]
push edx
push str.GetSessionIDReply
lea eax, [esp + 0x34]
push str._type_:___s____sid_:__u
push eax
call fcn.00404066
lea eax, [esp + 0x3c]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401360
sub eax, edx
mov dword [esp + 0x10], eax
call fcn.00404316
add eax, 0x20
push eax
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.00404ad0
add esp, 0x10
cmp eax, 1
jne 0x4014aa
call fcn.00404316
mov edx, dword [esp + 0x10]
add eax, 0x20
push eax
push edx
push 1
lea eax, [esp + 0x38]
push eax
call fcn.00404ad0
add esp, 0x10
cmp dword [esp + 0x10], eax
jne 0x4014aa
call fcn.00404316
add eax, 0x20
push eax
call fcn.00404655
add esp, 4
push ebx
call fcn.004040e3
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
add esp, 4
jmp 0x4011d4
push 6
push str._url_:
push ebx
call fcn.00411481
add esp, 0xc
test eax, eax
je 0x4014aa
push 0x80000
push 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x40000
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea esi, [edi + 0x40000]
test edi, edi
je 0x4014aa
lea ecx, [esp + 0x14]
push ecx
push edi
lea ecx, [esp + 0x18]
mov edx, ebx
call fcn.004015e0
add esp, 8
mov ecx, edi
call fcn.004019d0
cmp eax, 1
jne 0x401465
mov edx, dword [esp + 0x10]
push edi
push edx
push str.UrlReply
push str._type_:___s____status_:__u___data_:__s
push esi
call fcn.00404066
add esp, 0x14
jmp 0x401495
mov eax, dword [esp + 0x10]
push eax
push str.UrlReply
push str._type_:___s____status_:__u___data_:__
push esi
call fcn.00404066
mov ebp, eax
add ebp, esi
push ebp
mov eax, edi
call fcn.00401ac0
add esp, 0x14
push 0x415934
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00401000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call fcn.004040e3
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
add esp, 4
jmp 0x4011d4
push ebx
call fcn.004040e3
add esp, 4
mov ebx, dword [esp + 0x18]
call dword [esp + 0x24]
xor ebp, ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00404057
add esp, 0x124
ret
pop ebx
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00404057
add esp, 0x124
ret
mov ecx, dword [esp + 0x124]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00404057
add esp, 0x124
ret