Function at 0x40ab80
Capabilities:
Create process on windows
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x58c], 2
jle 0x40ac68
call fcn.0040aac0
test al, al
jne 0x40ac1e
push 0
push dword [edi]
mov byte [edi + 0x60d], al
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
lea esi, [edi + 0xc40]
push 0x81
push dword [edi + 0x414]
mov dword [esi], 0x3bc
mov dword [edi + 0xc44], eax
mov dword [edi + 0xc48], 0x81
mov dword [edi + 0xc4c], 3
call dword [sym.imp.USER32.dll_LoadIconW]
push esi
push 0
mov dword [edi + 0xc54], eax
mov dword [edi + 0xc50], 0x40a
mov dword [edi + 0xf60], 0xbb8
mov dword [edi + 0xfe4], 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x40c]
test eax, eax
je 0x40ac4a
push pe_nt_image_headers32
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push eax
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
push 0
push 0x40b800
mov byte [edi + 0x60c], 0
call fcn.0041432b
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41
push 0x43479c
push 0x4347a8
push dword [edi]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x40adca
lea eax, [edi + 0xc40]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [edi + 0x62c]
test eax, eax
je 0x40aca7
push eax
call fcn.0040b890
add esp, 4
cmp dword [edi + 0x630], 0
je 0x40ad83
push 0
push dword [edi]
mov byte [edi + 0x60d], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x260c
call fcn.00413312
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40ad7a
mov ecx, dword [edi + 0x630]
xor esi, esi
mov dword [eax], ecx
mov dword [eax + 0x155c], edi
mov byte [eax + 0x2608], 1
mov eax, dword [edi + 0x618]
sub eax, dword [edi + 0x614]
sar eax, 2
mov dword [ebp - 4], eax
test eax, eax
je 0x40ad7a
mov ecx, dword [edi + 0x618]
mov edx, dword [edi + 0x614]
sub ecx, edx
sar ecx, 2
mov dword [ebp - 8], ecx
mov edi, edi
cmp ecx, esi
jbe 0x40ae64
mov ebx, dword [edx + esi*4]
test ebx, ebx
je 0x40ad75
mov ecx, 0x4344e0
lea eax, [ebx + 0x800]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ad60
test dl, dl
je 0x40ad5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ad60
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ad40
xor eax, eax
jmp 0x40ad65
sbb eax, eax
or eax, 1
test eax, eax
je 0x40add1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [edi + 0x614]
inc esi
cmp esi, eax
jb 0x40ad20
cmp dword [edi + 0x630], 0
jne 0x40ad8c
cmp dword [edi + 0x62c], 0
je 0x40ad93
mov ecx, edi
call fcn.0040ce70
add edi, 0x107c
mov ecx, edi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ada0
sub ecx, edx
cmp ecx, 5
jbe 0x40adc2
push 5
push 0
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x634]
test eax, eax
je 0x40adff
cmp byte [eax + 0x100], 0
lea ecx, [eax + 0x100]
je 0x40adff
lea eax, [ebx + 0x14c4]
push eax
push 0x80
push ecx
call fcn.00412f77
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov byte [ebx + 0x142e], 1
mov eax, dword [edi + 0x630]
push ebx
mov dword [eax + 0x154c], edx
mov ecx, dword [edi + 0x630]
push ecx
lea eax, [ecx + 0x400]
push eax
push ecx
mov ecx, edx
call fcn.00403940
mov eax, dword [edi + 0x630]
cmp byte [eax + 0x142e], 0
jne 0x40ae54
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
mov eax, dword [edi + 0x630]
cmp byte [eax + 0x142e], 0
je 0x40ae41
mov ecx, dword [edi + 0x630]
call fcn.00406740
jmp 0x40ad7a
push str.invalid_vector_T__subscript
call fcn.004291ac
int3