Function at 0x409030
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x416c4e
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x694
cmp eax, 0xd1
push ebx
push ebp
push esi
push edi
mov ebx, 1
jg 0x4095fb
je 0x4095ef
add eax, 0xffffffa2
cmp eax, 0x72
ja case.0x40907d.101
xor ecx, ecx
mov cl, byte [eax + 0x409bcc]
jmp dword [ecx*4 + 0x409bac]
mov eax, dword [0x41d258]
test eax, eax
jne 0x4090b4
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne 0x4090b4
mov edx, dword [esp + 0x6b4]
push 0x30
push str.You_are_prohibited_from_sending_messages_to_others_now.
push edx
call sub.REDCOMM.dll_Ordinal_54
jmp 0x409b8e
mov esi, dword [esp + 0x6bc]
push esi
call sub.REDCOMM.dll_Ordinal_37
cmp eax, 1
je 0x4090d3
mov ecx, 0x41c1b0
call dword [sym.imp.REDCOMM.dll_public:_int___thiscall_CBaseHostListing::DeselectAll_void_]
jmp 0x4090df
push esi
mov ecx, 0x41c1b0
call dword [sym.imp.REDCOMM.dll_public:_int___thiscall_CBaseHostListing::SelectANodeOnly_unsigned_long_int_]
mov ecx, dword [0x41d16c]
push 0x41d230
mov edx, dword [0x41d170]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x41d174]
mov dword [eax + 4], edx
mov edx, dword [0x41d178]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [0x41d168]
push eax
call sub.REDCOMM.dll_Ordinal_106
mov ecx, dword [esp + 0x6cc]
push eax
push 1
push 1
push 0x41c1b0
push 0
push ecx
call sub.REDCOMM.dll_Ordinal_172
jmp 0x409b8e
mov eax, dword [0x41c1f0]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x88]
push 0x104
push edx
push eax
call esi
test eax, eax
je 0x40916e
push str._reviewer.exe
lea ecx, [esp + 0x8c]
push 0x5c
push ecx
call fcn.0040e650
add esp, 8
push eax
jmp 0x40917b
lea edx, [esp + 0x88]
push str.C:_reviewer.exe
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
mov ecx, dword [0x41c1f0]
lea eax, [esp + 0x294]
push 0x104
push eax
push ecx
call esi
test eax, eax
je 0x4091b8
lea edx, [esp + 0x294]
push 0x5c
push edx
call fcn.0040e650
add esp, 8
mov edx, eax
mov edi, str.DATA
jmp 0x4091c4
lea edx, [esp + 0x294]
mov edi, str.C:DATA
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Message
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x298]
push ecx
call esi
lea edx, [esp + 0x190]
push str._m__
push edx
call ebx
lea eax, [esp + 0x294]
lea ecx, [esp + 0x190]
push eax
push ecx
call esi
lea edx, [esp + 0x190]
push 0x41a13c
push edx
call esi
push 1
lea eax, [esp + 0x194]
push 0
lea ecx, [esp + 0x90]
push eax
push ecx
jmp 0x409344
push 0
call fcn.00401cb0
add esp, 4
jmp 0x409b8e
mov eax, dword [0x41c1f0]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x190]
push 0x104
push edx
push eax
call esi
test eax, eax
je 0x409287
push str._reviewer.exe
lea ecx, [esp + 0x194]
push 0x5c
push ecx
call fcn.0040e650
add esp, 8
push eax
jmp 0x409294
lea edx, [esp + 0x190]
push str.C:_reviewer.exe
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
mov ecx, dword [0x41c1f0]
lea eax, [esp + 0x88]
push 0x104
push eax
push ecx
call esi
test eax, eax
je 0x4092d1
lea edx, [esp + 0x88]
push 0x5c
push edx
call fcn.0040e650
add esp, 8
mov edx, eax
mov edi, 0x41d2a0
jmp 0x4092dd
lea edx, [esp + 0x88]
mov edi, 0x41ab20
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str._r__
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x298]
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x88]
lea eax, [esp + 0x294]
push edx
push eax
call esi
lea ecx, [esp + 0x294]
push 0x41a13c
push ecx
call esi
push 1
lea edx, [esp + 0x298]
push 0
lea eax, [esp + 0x198]
push edx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x409b8e
push 3
push 0
push 0
push str.http:__www.3000soft.net
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, ebx
jmp 0x409b93
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x190]
push 0x41d29c
push ecx
call ebp
lea edx, [esp + 0x10]
lea eax, [esp + 0x190]
push edx
push eax
push 0
push str.port_DefaultTeacher
mov dword [esp + 0x20], 0x100
call sub.REDCOMM.dll_Ordinal_25
lea ecx, [esp + 0x190]
push ecx
call sub.REDCOMM.dll_Ordinal_36
cmp eax, 1
je 0x4094ac
mov eax, dword [0x41c1b4]
test eax, eax
je 0x409493
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
mov eax, dword [0x41c1b4]
mov cl, 0x40
mov esi, eax
test byte [esi + 0x374], cl
jne 0x40940f
mov esi, dword [esi + 4]
cmp esi, eax
je 0x409487
test byte [esi + 0x374], cl
je 0x4093fc
push 0x7f00
push 0
call edi
push eax
call ebx
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x88]
lea edx, [esi + 0xc]
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x88], eax
call sub.REDCOMM.dll_Ordinal_106
cmp dword [esp + 0x88], eax
jne 0x409451
xor eax, eax
jmp 0x409b93
lea eax, [esp + 0x8c]
push 0x41a3c0
push eax
call ebp
add esi, 0x1c
lea ecx, [esp + 0x8c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x88]
push edx
push 0
call dword [sym.imp.RSCLASS.dll_int___stdcall_FUN_OpenDlgFTP_struct_HWND_____struct__DLGFTP_PARAM__]
jmp 0x409b8e
push 0x7f00
push 0
call edi
push eax
call ebx
mov eax, dword [esp + 0x6b4]
push 0x30
push str.There_is_no_any_Tutors_computer_detected.
push eax
call sub.REDCOMM.dll_Ordinal_54
jmp 0x409b8e
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x190]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x88], eax
call sub.REDCOMM.dll_Ordinal_106
cmp dword [esp + 0x88], eax
jne 0x4094e6
xor eax, eax
jmp 0x409b93
mov ebx, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push 0
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebp
mov esi, dword [0x41c1b4]
test esi, esi
je 0x409563
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edx, [esi + 0xc]
lea eax, [esp + 0x190]
push edx
push eax
call edi
test eax, eax
je 0x40953e
mov esi, dword [esi + 4]
mov eax, dword [0x41c1b4]
cmp esi, eax
je 0x409563
lea ecx, [esi + 0xc]
lea edx, [esp + 0x190]
push ecx
push edx
call edi
test eax, eax
jne 0x409520
lea eax, [esp + 0x8c]
push 0x41a3c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0x1c
lea ecx, [esp + 0x8c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x7f00
push 0
call ebx
push eax
call ebp
lea edx, [esp + 0x88]
push edx
push 0
call dword [sym.imp.RSCLASS.dll_int___stdcall_FUN_OpenDlgFTP_struct_HWND_____struct__DLGFTP_PARAM__]
jmp 0x409b8e
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x398]
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
lea ecx, [esp + 0x398]
add eax, 0x1166
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ecx, 0x41
xor eax, eax
lea edi, [edx + 0x1166]
mov edx, dword [esp + 0x6b4]
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
lea ecx, [esp + 0x398]
push ecx
push edx
mov byte [eax + 0x1166], 2
call dword [sym.imp.RSCLASS.dll_int___stdcall_MP_UpLoadPaper_struct_HWND_____char__]
neg eax
sbb eax, eax
neg eax
jmp 0x409b93
push 0
call sub.RSCLASS.dll_Ordinal_100
jmp 0x409b8e
cmp eax, 0xda
jg 0x409882
je 0x409853
sub eax, 0xd2
je 0x40981f
dec eax
je 0x409810
sub eax, 5
jne case.0x40907d.101
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x190]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x190]
push 0x41aabc
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x190]
push 0x41a140
push ecx
call ebx
mov edx, dword [esp + 0x6bc]
lea eax, [esp + 0x190]
add edx, 4
push edx
push eax
call ebx
lea ecx, [esp + 0x190]
push 0x41a13c
push ecx
call ebx
mov eax, dword [0x41c1f0]
lea edx, [esp + 0x294]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x294]
push 0x5c
push ecx
call fcn.0040e650
mov edx, eax
mov edi, str.edpaper.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
lea edi, [esp + 0x94]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2a0]
push ecx
call fcn.0040e650
mov ecx, eax
lea edx, [esp + 0x2a4]
sub ecx, edx
lea esi, [esp + 0x2a4]
mov eax, ecx
lea edi, [esp + 0x98]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 0x10
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x68]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::constructor_void_]
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4097d4
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14], ecx
lea edi, [esp + 0x24]
mov dword [esp + 0x18], ecx
lea edx, [esp + 0x49c]
mov dword [esp + 0x1c], ecx
push 0x41a13c
mov dword [esp + 0x24], ecx
mov ecx, 0x11
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x2c], 0x44
call ebp
lea eax, [esp + 0x294]
lea ecx, [esp + 0x49c]
push eax
push ecx
call ebx
lea edx, [esp + 0x49c]
push 0x41a738
push edx
call ebx
lea eax, [esp + 0x190]
lea ecx, [esp + 0x49c]
push eax
push ecx
call ebx
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x8c]
push eax
mov eax, dword [esp + 0x8c]
push ecx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x4b8]
push 0
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x409801
lea ecx, [esp + 0x88]
push 1
lea edx, [esp + 0x194]
push ecx
mov ecx, dword [esp + 0x6bc]
lea eax, [esp + 0x29c]
push edx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x68]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::destructor_void_]
jmp 0x409b8e
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
jmp 0x409b8e
mov eax, dword [0x41d250]
mov esi, dword [esp + 0x6b4]
xor edx, edx
push 1
test eax, eax
sete dl
push 0x41d168
push esi
mov dword [0x41d250], edx
call fcn.00402ce0
push esi
call fcn.00402950
add esp, 0x10
jmp 0x409b8e
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x88], 1
push eax
push 0
call sub.RSCLASS.dll_Ordinal_108_1
jmp 0x409b8e
cmp eax, 0xdb
je 0x409a10
cmp eax, 0x7df
jle case.0x40907d.101
cmp eax, 0x7e4
jg case.0x40907d.101
add eax, 0xfffff820
mov edi, 0x50
cmp eax, 4
ja case.0x4098b2.2018
jmp dword [eax*4 + 0x409c40]
mov esi, 0x64
push 0
jmp 0x409917
push 0
push str.UseJPEGCompression
mov esi, 0x5f
call sub.REDCOMM.dll_Ordinal_16
push ebx
jmp 0x409923
push ebx
push str.UseJPEGCompression
mov esi, 0x32
call sub.REDCOMM.dll_Ordinal_16
push 0
push str.UseConvertTo16bit
call sub.REDCOMM.dll_Ordinal_16
push esi
jmp 0x40992e
push ebx
push str.UseJPEGCompression
mov esi, 0x14
call sub.REDCOMM.dll_Ordinal_16
push 0
push str.UseConvertTo16bit
call sub.REDCOMM.dll_Ordinal_16
push esi
jmp 0x40992e
mov esi, edi
push ebx
push str.UseJPEGCompression
call sub.REDCOMM.dll_Ordinal_16
push 0
push str.UseConvertTo16bit
call sub.REDCOMM.dll_Ordinal_16
push edi
push str.JPEGQuality
call sub.REDCOMM.dll_Ordinal_17
mov eax, dword [0x41d21c]
test eax, eax
je 0x409a09
mov ecx, dword [0x41d17c]
test ecx, ecx
je 0x409a09
cmp esi, 0x64
jne 0x40998f
mov dword [eax + 0xa0], 0
mov ecx, dword [0x41d21c]
mov eax, ebx
mov dword [ecx + 0xa8], 0
mov edx, dword [0x41d21c]
mov dword [edx + 0xb0], edi
mov dword [0x41d24c], 6
jmp 0x409b93
cmp esi, 0x5f
jne 0x4099c6
mov dword [eax + 0xa0], 0
mov eax, dword [0x41d21c]
mov dword [eax + 0xa8], ebx
mov ecx, dword [0x41d21c]
mov eax, ebx
mov dword [ecx + 0xb0], edi
mov dword [0x41d24c], 6
jmp 0x409b93
mov dword [eax + 0xa0], ebx
mov edx, dword [0x41d21c]
cmp esi, 5
mov dword [edx + 0xa8], 0
jb 0x4099e8
cmp esi, 0x5a
jae 0x4099ef
jmp 0x4099f4
mov esi, 5
jmp 0x4099f4
mov esi, 0x5a
mov eax, dword [0x41d21c]
mov dword [eax + 0xb0], esi
mov dword [0x41d24c], 6
mov eax, ebx
jmp 0x409b93
mov eax, dword [0x41d25c]
xor esi, esi
cmp eax, esi
jne 0x409b50
cmp dword [0x41d17c], esi
jne 0x409b8e
cmp dword [0x41c214], esi
jne 0x409b8e
push 1
push str.IsShowSavescreenimagesTips
call sub.REDCOMM.dll_Ordinal_27
or ebp, 0xffffffff
test eax, eax
je 0x409a61
cmp dword [esp + 0x6bc], ebp
je 0x409a61
push esi
call fcn.0040cea0
test eax, eax
je 0x409b8e
mov ebx, dword [esp + 0x6b4]
push 0xb005
push 0x351
push str.Hotkey_StopSavescreenimages
push ebx
call sub.REDCOMM.dll_Ordinal_122
mov edx, dword [0x41d21c]
mov dword [0x41d24c], 6
cmp edx, esi
mov dword [0x41d17c], 1
jne 0x409ad2
push 0x580
call fcn.0040e920
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, esi
mov dword [esp + 0x6ac], esi
je 0x409ac1
mov ecx, eax
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CDibCapture::constructor_void_]
jmp 0x409ac3
xor eax, eax
mov edx, eax
mov dword [esp + 0x6ac], ebp
mov dword [0x41d21c], edx
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x24]
push esi
rep stosd dword es:[edi], eax
mov ecx, dword [0x41c1ac]
mov dword [esp + 0x44], edx
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x10000
mov dword [esp + 0x30], ebp
mov dword [esp + 0x48], 0x41d17c
mov eax, dword [edx + 0x40]
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], eax
push ecx
mov dword [esp + 0x54], 0x41d24c
call sub.REDCOMM.dll_Ordinal_109
test eax, eax
je 0x409b8e
push str._notray
push 0x41d1b0
mov dword [0x41d25c], 1
call fcn.0040e8a0
add esp, 8
test eax, eax
jne 0x409b8e
push ebx
call fcn.00402950
add esp, 4
jmp 0x409b8e
push str._notray
push 0x41d1b0
mov dword [0x41d17c], esi
mov dword [0x41d25c], esi
call fcn.0040e8a0
mov esi, dword [esp + 0x6bc]
add esp, 8
test eax, eax
jne 0x409b82
push esi
call fcn.00402950
add esp, 4
push 0xb005
push esi
call dword [sym.imp.USER32.dll_UnregisterHotKey]
mov eax, 1
mov ecx, dword [esp + 0x6a4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x6a0
ret