Function at 0x431c00
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c3707
mov eax, dword fs:[0]
push eax
sub esp, 0x558
mov eax, dword [0x4f4214]
xor eax, esp
mov dword [esp + 0x550], eax
push ebx
push esi
push edi
mov eax, dword [0x4f4214]
xor eax, esp
push eax
lea eax, [esp + 0x568]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
call fcn.00418b30
mov edi, dword [esi]
mov ecx, str.click
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431c86
cmp dx, bx
je 0x431c82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431c86
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x431c60
xor eax, eax
jmp 0x431c8b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x432276
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x3c]
push edx
call eax
mov dword [esp + 0x570], ebx
mov eax, dword [eax]
mov edi, 1
mov dword [esp + 0x14], edi
mov ecx, str.CancelBtn
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431ce6
cmp dx, bx
je 0x431ce2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431ce6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x431cc0
xor eax, eax
jmp 0x431ceb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x431d53
mov ecx, dword [esi + 0x108]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0xc4]
push eax
call edx
mov dword [esp + 0x570], edi
mov eax, dword [eax]
mov dword [esp + 0x14], 3
mov ecx, str.CloseBtn
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431d46
cmp dx, bx
je 0x431d42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431d46
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x431d20
xor eax, eax
jmp 0x431d4b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x431d53
xor bl, bl
jmp 0x431d55
mov bl, 1
mov dword [esp + 0x570], 0
test byte [esp + 0x14], 2
je 0x431d87
mov eax, dword [esp + 0xc4]
and dword [esp + 0x14], 0xfffffffd
lea ecx, [esp + 0xc8]
cmp eax, ecx
je 0x431d87
push eax
call fcn.0049c78c
add esp, 4
or edi, 0xffffffff
mov dword [esp + 0x570], edi
test byte [esp + 0x14], 1
je 0x431db2
mov eax, dword [esp + 0x3c]
and dword [esp + 0x14], 0xfffffffe
lea edx, [esp + 0x40]
cmp eax, edx
je 0x431db2
push eax
call fcn.0049c78c
add esp, 4
test bl, bl
je 0x431de1
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 0xc]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4323f4
mov ecx, dword [esi - 0xc]
push 0
push 2
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4323f4
mov ecx, dword [esi + 0x108]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x3c]
push eax
call edx
mov dword [esp + 0x570], 2
mov eax, dword [eax]
mov ecx, str.OkBtn
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431e2b
test dx, dx
je 0x431e27
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431e2b
add eax, 4
add ecx, 4
test dx, dx
jne 0x431e05
xor eax, eax
jmp 0x431e2f
sbb eax, eax
sbb eax, edi
test eax, eax
sete bl
mov dword [esp + 0x570], edi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x431e50
push eax
call fcn.0049c78c
add esp, 4
test bl, bl
je 0x43206e
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x2d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
call eax
mov dword [esp + 0x570], 3
mov ecx, dword [eax]
call fcn.00432c40
mov bl, al
mov dword [esp + 0x570], edi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x431e9e
push eax
call fcn.0049c78c
add esp, 4
mov esi, dword [esp + 0x10]
test bl, bl
je 0x431f05
mov ecx, dword [esi + 0x2d8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x3c]
push eax
call edx
mov dword [esp + 0x570], 4
mov eax, dword [eax]
movzx eax, word [eax]
movsx ecx, al
push ecx
push str.ecstoragelocationel_c
xor edi, edi
call fcn.00424cb0
lea ecx, [edi + 0xa]
mov edx, eax
call fcn.00424690
add esp, 8
mov dword [esp + 0x570], 0xffffffff
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x40]
cmp eax, edx
je 0x431f05
push eax
call fcn.0049c78c
add esp, 4
mov ecx, dword [esi + 0x2dc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
call eax
mov dword [esp + 0x570], 5
mov eax, dword [eax]
push eax
call fcn.0049eaf7
add esp, 4
mov edi, eax
mov dword [esp + 0x570], 0xffffffff
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x431f4f
push eax
call fcn.0049c78c
add esp, 4
call fcn.00435070
cmp eax, edi
je 0x431f92
push edi
push 0x2e
push str.CSettingWnd::Notify
push str._s__d__SetLimitSpeed___d_n
call fcn.00487d90
mov edx, edi
shl edx, 0xa
push edx
call fcn.00489160
add esp, 0x14
push edi
push str.ecspeedsettingel_d
xor edi, edi
call fcn.00424cb0
lea ecx, [edi + 0xa]
mov edx, eax
call fcn.00424690
add esp, 8
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x156]
push ecx
mov word [esp + 0x158], ax
call fcn.0049f910
mov edx, dword [esi + 0x2e0]
add esp, 0xc
push edx
push 0x104
lea eax, [esp + 0x154]
push eax
push 0x4d8c0c
push 0x4d8c10
push str.DuoDuoMain
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x14c]
push ecx
call fcn.0049eaf7
mov edx, dword [esi + 0x2e4]
add esp, 4
cmp byte [edx + 0x958], 0
je 0x432001
push str.ecinsettingelhidden
jmp 0x43202b
mov eax, dword [esi + 0x2e8]
cmp byte [eax + 0x958], 0
je 0x432017
push str.ecinsettingeldirectly
jmp 0x43202b
mov ecx, dword [esi + 0x2ec]
cmp byte [ecx + 0x958], 0
je 0x43203f
push str.ecinsettingeleverytime
xor edi, edi
call fcn.00424cb0
lea ecx, [edi + 0xb]
mov edx, eax
call fcn.00424690
add esp, 4
lea ecx, [esi - 0x10]
call fcn.004324f0
mov edx, dword [esi - 0xc]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4323f4
mov eax, dword [esi - 0xc]
push 0
push 1
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4323f4
mov ecx, dword [esi + 0x108]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x3c]
push eax
call edx
mov dword [esp + 0x570], 6
mov ecx, str.ModifyDirBtn
call fcn.00451eb0
mov bl, al
mov dword [esp + 0x570], edi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x4320b3
push eax
call fcn.0049c78c
add esp, 4
test bl, bl
je 0x4321de
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
mov ecx, dword [eax + 0x2d8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], 0x53
mov dword [esp + 0x28], 0x4da3f8
mov dword [esp + 0x20], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
call eax
mov dword [esp + 0x570], 7
mov ecx, dword [eax]
lea edx, [esp + 0x354]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x432126
mov dword [esp + 0x570], edi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x432153
push eax
call fcn.0049c78c
add esp, 4
lea edx, [esp + 0x354]
lea ecx, [esp + 0x1c]
mov eax, edx
push ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x34], 0x431b90
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
xor edx, edx
push 0x206
mov edi, eax
push edx
lea eax, [esp + 0x156]
push eax
mov word [esp + 0x158], dx
call fcn.0049f910
add esp, 0xc
test edi, edi
je 0x4323f4
lea ecx, [esp + 0x14c]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4323f4
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x2d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
lea edx, [esp + 0x14c]
push edx
call eax
jmp 0x4323f4
mov ecx, dword [esi + 0x108]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x3c]
push eax
call edx
mov dword [esp + 0x570], 8
mov ecx, str.OpenDirBtn
call fcn.00451eb0
mov bl, al
mov dword [esp + 0x570], edi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x432223
push eax
call fcn.0049c78c
add esp, 4
test bl, bl
je 0x4323f4
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x2d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
call eax
mov dword [esp + 0x570], 9
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x570], edi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
jmp 0x4323e7
mov ecx, 0x4d5cf4
mov eax, edi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4322a6
cmp dx, bx
je 0x4322a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4322a6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x432280
xor eax, eax
jmp 0x4322ab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4323f4
mov edx, esi
mov ecx, dword [edx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0xc4]
push edx
call eax
mov dword [esp + 0x570], 0xa
mov ebx, dword [esp + 0x10]
push 1
add ebx, 0x11c
push str.SettingTabLayout
call fcn.00452590
mov esi, eax
mov eax, dword [esp + 0xc4]
mov edx, str.DLSettingOption
mov ecx, eax
jmp 0x432300
mov di, word [ecx]
cmp di, word [edx]
jne 0x432326
test di, di
je 0x432322
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x432326
add ecx, 4
add edx, 4
test di, di
jne 0x432300
xor ecx, ecx
jmp 0x43232b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x432359
push ecx
mov eax, esi
call fcn.00453770
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x108]
mov dword [ecx + 0x4a0], 0xff14b4f0
call fcn.0045bba0
push 1
push str.ClosePageOption
jmp 0x4323b8
mov edx, str.ClosePageOption
mov ecx, eax
mov di, word [ecx]
cmp di, word [edx]
jne 0x432386
test di, di
je 0x432382
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x432386
add ecx, 4
add edx, 4
test di, di
jne 0x432360
xor ecx, ecx
jmp 0x43238b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x4323ce
push 1
mov eax, esi
call fcn.00453770
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0x108]
mov dword [ecx + 0x4a0], 0xff14b4f0
call fcn.0045bba0
push 1
push str.DLSettingOption
call fcn.00452590
mov ecx, eax
mov dword [eax + 0x4a0], 0xff333333
call fcn.0045bba0
mov dword [esp + 0x570], 0xffffffff
mov eax, dword [esp + 0xc4]
lea ecx, [esp + 0xc8]
cmp eax, ecx
je 0x4323f4
push eax
call fcn.0049c78c
add esp, 4
mov ecx, dword [esp + 0x568]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x550]
xor ecx, esp
call fcn.0049c72a
mov esp, ebp
pop ebp
ret 4