Function at 0x415690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497d90
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4c606c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x415a89
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x4156f1
sub esp, 0x10
call fcn.004160a0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x138
jne 0x41573d
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x104]
je 0x41570b
cmp eax, dword [esi + 0x108]
jne 0x415719
push 0x191514
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x1ac]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x2b
jne 0x41579a
movzx eax, word [ebp + 0x10]
sub eax, 0x5e0
je 0x415767
sub eax, 1
je 0x41575f
sub eax, 5
jne 0x415778
lea ecx, [esi + 0x13c]
jmp 0x41576a
lea ecx, [esi + 0x98]
jmp 0x41576a
lea ecx, [esi + 0x5c]
push dword [esi + 0x1ac]
push dword [ebp + 0x14]
call fcn.004196a0
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x14
jne 0x4157c5
sub esp, 0x10
call fcn.004168f0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x4e
jne 0x41589a
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffe
je 0x4157e2
cmp eax, 0xfffffffc
jne 0x415878
mov eax, dword [ecx]
cmp eax, dword [esi + 0x58]
jne 0x415878
mov ebx, dword [esi + 0x19c]
mov ecx, dword [ebx - 0x10]
lea esi, [ebx - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, eax
lea eax, [esi + 0xc]
shr ecx, 0x1f
test cl, cl
jne 0x415816
cmp edx, dword [esi]
jne 0x415816
lock inc dword [eax]
jmp 0x415842
mov eax, dword [edx]
lea edi, [esi + 4]
push 2
push dword [edi]
mov ecx, edx
call dword [eax]
mov esi, eax
test esi, esi
je 0x415a9f
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov edx, dword [edi]
inc edx
push edx
push ebx
call fcn.00403610
add esp, 8
push 1
push 0
push 0
add esi, 0x10
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esi, 0xfffffff0
mov dword [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415878
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x18
jne 0x41591c
cmp dword [ebp + 0x10], 0
je 0x4158ec
mov eax, dword [0x4cb78c]
test eax, eax
jne 0x4158bc
push 0x5e0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [0x4cb78c], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x113
jne 0x41594d
sub esp, 8
push dword [ebp + 0x10]
push ecx
call fcn.00416b30
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x111
jne 0x415a89
movzx eax, word [ebp + 0x10]
mov ecx, 0x5e0
cmp cx, ax
jne 0x4159d5
add dword [esi + 0x1c4], 0xffffffff
mov eax, dword [esi + 0x1c4]
jns 0x415984
mov dword [esi + 0x1c4], 2
mov eax, 2
push dword [esi + 0x1ac]
lea ecx, [esi + 0x178]
push eax
call fcn.00419f40
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x1b58
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x5e1
cmp cx, ax
jne 0x415a4d
inc dword [esi + 0x1c4]
mov eax, dword [esi + 0x1c4]
cmp eax, 2
jle 0x4159fc
mov dword [esi + 0x1c4], 0
xor eax, eax
push dword [esi + 0x1ac]
lea ecx, [esi + 0x178]
push eax
call fcn.00419f40
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x1b58
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x5e6
cmp cx, ax
jne 0x415a7f
sub esp, 0x10
mov ecx, esi
call fcn.004171a0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 2
cmp cx, ax
je 0x415a57
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.00403600
int3