Function at 0x4191a0
Capabilities:
Create thread
Get common file path
Resume thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5303ea
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, ecx
push ebx
call fcn.004263f0
mov ecx, 0x41
xor eax, eax
lea edi, [esi + 0x65cc]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x5a90]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
cmp eax, ebx
je 0x4191f4
push eax
call edi
mov dword [esi + 0x5a90], ebx
mov eax, dword [esi + 0x5a8c]
cmp eax, ebx
je 0x419207
push eax
call edi
mov dword [esi + 0x5a8c], ebx
mov eax, dword [esi + 0x675c]
cmp eax, ebx
je 0x41921e
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi + 0x675c], ebx
mov eax, dword [esi + 0x6c]
lea ecx, [esi + 0x6c]
call dword [eax + 4]
mov dword [esi + 0x5ed4], ebx
call fcn.005269f5
mov eax, dword [eax + 4]
push ebx
push 0x5909b4
push 0x5785f0
mov ecx, eax
mov dword [esp + 0x1c], eax
call fcn.00526483
mov ecx, dword [0x5a1f2c]
mov dword [ecx + 0x104], eax
call fcn.005269f5
mov ecx, dword [eax + 4]
call fcn.0051196c
mov edx, dword [0x5a1f2c]
mov dword [esp + 0x22c], ebx
mov byte [esp + 0x120], bl
mov eax, dword [edx + 0x20]
push eax
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x120]
push ecx
call fcn.00433410
mov eax, dword [0x5a1ef8]
add esp, 4
cmp eax, ebx
jne 0x41933f
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x41933f
mov eax, dword [0x598d50]
mov dword [esp + 0x10], eax
mov byte [esp + 0x22c], 1
mov dword [esp + 0x14], eax
mov byte [esp + 0x22c], 2
push 0xc6
lea ecx, [esp + 0x18]
mov dword [0x5a1ed4], ebx
call fcn.00512508
mov eax, dword [0x5a1f2c]
lea edx, [esp + 0x10]
mov ecx, dword [eax + 0x20]
push ecx
push 0x56
push edx
call fcn.0050a958
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x10
push eax
push ecx
mov ecx, esi
call fcn.0050fb08
lea ecx, [esp + 0x14]
mov byte [esp + 0x22c], 1
call fcn.00511eeb
lea ecx, [esp + 0x10]
mov byte [esp + 0x22c], bl
call fcn.00511eeb
jmp 0x41956c
mov ebp, dword [esi + 0x17fc]
xor edi, edi
cmp ebp, ebx
jbe 0x419364
mov edx, dword [esi + 0x17f8]
mov ecx, dword [edx + edi*4]
cmp ecx, ebx
je 0x41935f
mov eax, dword [ecx]
push 1
call dword [eax + 4]
inc edi
cmp edi, ebp
jb 0x41934b
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x17f4]
call fcn.0050cbdd
mov ecx, dword [0x5a1db4]
push 0xfffffd0b
push 0xfffffd0b
push 0x403
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov ecx, esi
mov dword [esi + 0x66e4], ebx
mov dword [esi + 0x66d0], ebx
mov dword [esi + 0x66d4], ebx
mov dword [esi + 0x66d8], ebx
mov dword [esi + 0x66dc], ebx
mov dword [esi + 0x6784], ebx
mov dword [esi + 0x6734], 1
call fcn.0041eea0
mov eax, dword [esi + 0x676c]
mov dword [esi + 0x6730], ebx
cmp eax, ebx
mov dword [esi + 0x6990], ebx
mov dword [esi + 0x6994], ebx
je 0x4193f0
push eax
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
mov dword [esi + 0x676c], ebx
mov ecx, dword [esi + 0x5a74]
cmp ecx, ebx
je 0x419415
call fcn.00442080
mov ecx, dword [esi + 0x5a74]
cmp ecx, ebx
je 0x41940f
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x5a74], ebx
mov ecx, dword [esi + 0x5a78]
cmp ecx, ebx
je 0x41943a
call fcn.00442080
mov ecx, dword [esi + 0x5a78]
cmp ecx, ebx
je 0x419434
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x5a78], ebx
mov eax, dword [esi + 0x17e0]
cmp eax, ebx
je 0x419453
push eax
call fcn.0046185f
add esp, 4
mov dword [esi + 0x17e0], ebx
mov eax, dword [esi + 0x17e4]
cmp eax, ebx
je 0x41946a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x17e4], ebx
push 0x48
call fcn.00511c2c
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x22c], 3
je 0x41948d
mov ecx, eax
call fcn.00441f70
jmp 0x41948f
xor eax, eax
mov byte [esp + 0x22c], bl
mov dword [esi + 0x5a74], eax
mov eax, dword [0x5a1f2c]
cmp dword [eax + 0x78], ebx
jne 0x4194ab
cmp dword [eax + 0x7c], ebx
je 0x4194bd
lea eax, [esp + 0x14]
push eax
call fcn.0050ab75
mov ecx, dword [eax]
mov dword [esi + 0x6718], ecx
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov ebp, dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x671c], ebx
mov edx, dword [0x5a1f2c]
mov eax, dword [edx + 0x78]
cmp eax, ebx
mov eax, dword [esi + 0x6710]
je 0x419506
cmp eax, ebx
je 0x4194ed
push eax
mov eax, dword [esi + 0x1c]
push eax
call edi
mov ecx, dword [esi + 0x1c]
push ebx
push 0x1388
push 0x3f2
push ecx
call ebp
mov dword [esi + 0x6710], eax
jmp 0x419511
cmp eax, ebx
je 0x419511
mov edx, dword [esi + 0x1c]
push eax
push edx
call edi
mov eax, dword [0x5a1f2c]
mov ecx, dword [eax + 0x7c]
mov eax, dword [esi + 0x6714]
cmp ecx, ebx
je 0x419547
cmp eax, ebx
je 0x41952e
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call edi
mov edx, dword [esi + 0x1c]
push ebx
push 0x1388
push 0x7e4
push edx
call ebp
mov dword [esi + 0x6714], eax
jmp 0x419552
cmp eax, ebx
je 0x419552
push eax
mov eax, dword [esi + 0x1c]
push eax
call edi
mov ecx, dword [0x5a1f2c]
cmp dword [ecx + 0xb8], 3
jne 0x41958b
mov ecx, esi
call fcn.004257c0
test eax, eax
jne 0x41958b
mov dword [esp + 0x22c], 0xffffffff
call fcn.005269f5
mov ecx, dword [eax + 4]
call fcn.00511981
xor eax, eax
jmp 0x41977e
push 0x7c0
call fcn.00461c33
add esp, 4
mov edi, eax
lea edx, [esp + 0x1c]
mov ecx, 0x1f0
xor eax, eax
mov dword [esi + 0x17e0], edi
push edx
push 0x104
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4195cf
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00433ca0
add esp, 8
lea ecx, [esp + 0x1c]
push 0x57c790
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [esp + 0x10]
push ebx
push 0x57c778
push 0x5785f0
mov ecx, edi
call fcn.00526483
mov edx, dword [esi + 0x17e0]
lea ecx, [esp + 0x10]
mov dword [edx + 0x594], eax
lea eax, [esp + 0x1c]
push eax
push 0x57c760
push 0x5785f0
push ecx
mov ecx, edi
call fcn.005264ef
mov edx, dword [esi + 0x17e0]
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edx, 0x38c
push eax
push edx
mov byte [esp + 0x234], 4
call ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x22c], bl
call fcn.00511eeb
mov eax, dword [esi + 0x17e0]
add eax, 0x38c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x419676
mov edx, dword [esi + 0x17e0]
lea ecx, [esp + 0x1c]
add edx, 0x38c
push ecx
push edx
call ebp
push 0x1770
push 0x57c744
push 0x5785f0
mov ecx, edi
call fcn.00526483
mov ecx, dword [esi + 0x17e0]
mov dword [ecx + 0x598], eax
mov edx, dword [esi + 0x17e0]
mov eax, dword [esi + 0x1c]
mov dword [edx + 4], eax
mov edx, dword [0x5a1db4]
mov ecx, dword [esi + 0x17e0]
mov eax, dword [edx + 0x1c]
mov dword [ecx], eax
mov ecx, dword [esi + 0x17e0]
mov dword [ecx + 8], ebx
mov edx, dword [esi + 0x17e0]
mov dword [edx + 0x110], esi
mov eax, dword [0x5a1f2c]
mov ecx, dword [esi + 0x17e0]
mov eax, dword [eax + 0x20]
add ecx, 0xc
push eax
push ecx
call ebp
mov edx, dword [esi + 0x17e0]
add edx, 0xc
push edx
call fcn.00433410
mov ecx, dword [esi + 0x17e0]
lea eax, [esp + 0x1c]
push eax
push 4
push ecx
push 0x40e840
push ebx
push ebx
call fcn.00461973
add esp, 0x1c
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
lea eax, [esi + 0x17e4]
push ebx
push eax
call ebp
push eax
push edi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x419749
push ebx
push 0x579dc0
push 0x579da4
mov ecx, esi
call fcn.0050fb08
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [esp + 0x22c], 0xffffffff
call fcn.005269f5
mov ecx, dword [eax + 4]
call fcn.00511981
mov eax, 1
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret