Function at 0x499840
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov ebx, dword [esp + 0x7c]
mov esi, eax
and ebx, 0xffff
mov eax, ebx
cmp eax, 0xa02f
jg case.default.0x49a23d
cmp eax, 0xa028
jge 0x49a614
sub eax, 0x9c44
cmp eax, 0x45
ja case.default.0x49a23d
xor ecx, ecx
mov cl, byte [eax + 0x49a754]
jmp dword [ecx*4 + 0x49a69c]
push 0
push 0x258
push 0x320
mov dword [0xc93c60], 1
call fcn.004985c0
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
add esp, 0xc
push 1
push 0x9c44
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c44
push esi
call ebx
push 0
push 0x9c45
push esi
call edi
push 0
push 0x9c45
push esi
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [0xc93c60], 0
call fcn.004985c0
add esp, 0xc
call fcn.004940d0
mov ebx, dword [sym.imp.USER32.dll_EnableMenuItem]
mov ebp, dword [sym.imp.USER32.dll_CheckMenuItem]
test eax, eax
je 0x499946
mov eax, dword [0xc93f88]
test eax, eax
jle 0x49995a
mov edi, 0xa028
push 0
push edi
push esi
call ebx
push 0
push edi
push esi
call ebp
mov eax, dword [0xc93f88]
inc edi
lea edx, [edi - 0xa028]
cmp edx, eax
jl 0x499928
jmp 0x49995a
push 0
push 0x9c44
push esi
call ebx
push 0
push 0x9c44
push esi
call ebp
push 1
push 0x9c45
push esi
call ebx
push 8
push 0x9c45
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c56
push esi
mov dword [0x4c37e8], 0xf
call edi
push 0
push 0x9c5a
push esi
call edi
push 0
push 0x9c57
push esi
call edi
push 0
push 0x9c61
push esi
call edi
push 0
push 0x9c58
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c56
push esi
mov dword [0x4c37e8], 0x14
call edi
push 8
push 0x9c5a
push esi
call edi
push 0
push 0x9c57
push esi
call edi
push 0
push 0x9c61
push esi
call edi
push 0
push 0x9c58
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c56
push esi
mov dword [0x4c37e8], 0x1e
call edi
push 0
push 0x9c5a
push esi
call edi
push 8
push 0x9c57
push esi
call edi
push 0
push 0x9c61
push esi
call edi
push 0
push 0x9c58
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c56
push esi
mov dword [0x4c37e8], 0x2d
call edi
push 0
push 0x9c5a
push esi
call edi
push 0
push 0x9c57
push esi
call edi
push 8
push 0x9c61
push esi
call edi
push 0
push 0x9c58
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c56
push esi
mov dword [0x4c37e8], 0x3c
call edi
push 0
push 0x9c5a
push esi
call edi
push 0
push 0x9c57
push esi
call edi
push 0
push 0x9c61
push esi
call edi
push 8
push 0x9c58
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c47
push esi
mov dword [0x4c37f0], 1
call edi
push 0
push 0x9c48
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c47
push esi
mov dword [0x4c37f0], 0
call edi
push 8
push 0x9c48
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c50
push esi
mov dword [0x4c37ec], 0
call edi
push 0
push 0x9c51
push esi
call edi
push 0
push 0x9c52
push esi
call edi
push 0
push 0x9c53
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c50
push esi
mov dword [0x4c37ec], 1
call edi
push 8
push 0x9c51
push esi
call edi
push 0
push 0x9c52
push esi
call edi
push 0
push 0x9c53
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c50
push esi
mov dword [0x4c37ec], 2
call edi
push 0
push 0x9c51
push esi
call edi
push 8
push 0x9c52
push esi
call edi
push 0
push 0x9c53
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c50
push esi
mov dword [0x4c37ec], 4
call edi
push 0
push 0x9c51
push esi
call edi
push 0
push 0x9c52
push esi
call edi
push 8
push 0x9c53
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [0x4c37fc]
test eax, eax
je 0x499c69
push 8
push 0x9c5b
push esi
mov dword [0x4c37fc], 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0
push 0x9c5b
push esi
mov dword [0x4c37fc], 1
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c75
push esi
mov dword [0x4c3808], 0
call edi
push 0
push 0x9c77
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c75
push esi
mov dword [0x4c3808], 1
call edi
push 8
push 0x9c77
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c7e
push esi
mov dword [0x4c380c], 0
call edi
push 0
push 0x9c7f
push esi
call edi
push 0
push 0x9c81
push esi
call edi
push 0
push 0x9c83
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c7e
push esi
mov dword [0x4c380c], 1
call edi
push 8
push 0x9c7f
push esi
call edi
push 0
push 0x9c81
push esi
call edi
push 0
push 0x9c83
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c7e
push esi
mov dword [0x4c380c], 2
call edi
push 0
push 0x9c7f
push esi
call edi
push 8
push 0x9c81
push esi
call edi
push 0
push 0x9c83
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c7e
push esi
mov dword [0x4c380c], 3
call edi
push 0
push 0x9c7f
push esi
call edi
push 0
push 0x9c81
push esi
call edi
push 8
push 0x9c83
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c84
push esi
mov dword [0x4c3810], 1
call edi
push 0
push 0x9c49
push esi
mov dword [0x4c3814], 0
call edi
push 0
push 0x9c4a
push esi
call edi
push 0
push 0x9c4b
push esi
call edi
push 0
push 0x9c4c
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
xor ebx, ebx
push ebx
push 0x9c84
push esi
mov dword [0x4c3810], ebx
call edi
push 8
push 0x9c49
push esi
mov dword [0x4c3814], ebx
call edi
push ebx
push 0x9c4a
push esi
call edi
push ebx
push 0x9c4b
push esi
call edi
push ebx
push 0x9c4c
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c84
push esi
mov dword [0x4c3810], 0
call edi
push 0
push 0x9c49
push esi
mov dword [0x4c3814], 1
call edi
push 8
push 0x9c4a
push esi
call edi
push 0
push 0x9c4b
push esi
call edi
push 0
push 0x9c4c
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c84
push esi
mov dword [0x4c3810], 0
call edi
push 0
push 0x9c49
push esi
mov dword [0x4c3814], 2
call edi
push 0
push 0x9c4a
push esi
call edi
push 8
push 0x9c4b
push esi
call edi
push 0
push 0x9c4c
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c84
push esi
mov dword [0x4c3810], 0
call edi
push 0
push 0x9c49
push esi
mov dword [0x4c3814], 3
call edi
push 0
push 0x9c4a
push esi
call edi
push 0
push 0x9c4b
push esi
call edi
push 8
push 0x9c4c
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [0x4c3818]
test eax, eax
je 0x499fa4
push 0
push 0x9c4e
push esi
mov dword [0x4c3818], 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 8
push 0x9c4e
push esi
mov dword [0x4c3818], 1
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0
mov dword [0x4c381c], 0
call fcn.00476270
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
add esp, 4
push 8
push 0x9c5c
push esi
call edi
push 0
push 0x9c5d
push esi
call edi
push 0
push 0x9c5e
push esi
call edi
push 0
push 0x9c66
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 1
mov dword [0x4c381c], 1
call fcn.00476270
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
add esp, 4
push 0
push 0x9c5c
push esi
call edi
push 8
push 0x9c5d
push esi
call edi
push 0
push 0x9c5e
push esi
call edi
push 0
push 0x9c66
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 2
mov dword [0x4c381c], 2
call fcn.00476270
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
add esp, 4
push 0
push 0x9c5c
push esi
call edi
push 0
push 0x9c5d
push esi
call edi
push 8
push 0x9c5e
push esi
call edi
push 0
push 0x9c66
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 3
mov dword [0x4c381c], 3
call fcn.00476270
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
add esp, 4
push 0
push 0x9c5c
push esi
call edi
push 0
push 0x9c5d
push esi
call edi
push 0
push 0x9c5e
push esi
call edi
push 8
push 0x9c66
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x9c55
push esi
mov dword [0x4c3800], 0
call edi
push 0
push 0x9c54
push esi
call edi
push 0
push 0x9c59
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c55
push esi
mov dword [0x4c3800], 1
call edi
push 8
push 0x9c54
push esi
call edi
push 0
push 0x9c59
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c55
push esi
mov dword [0x4c3800], 2
call edi
push 0
push 0x9c54
push esi
call edi
push 8
push 0x9c59
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 1
call fcn.004785b0
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
add esp, 4
push 8
push 0x9c5f
push esi
call edi
push 0
push 0x9c60
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0
call fcn.004785b0
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
add esp, 4
push 0
push 0x9c5f
push esi
call edi
push 8
push 0x9c60
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c67
push esi
call edi
push 0
push 0x9c68
push esi
call edi
push 0
push 0x9c69
push esi
call edi
push 0
push 0x9c6a
push esi
call edi
push 0
push 0x9c6b
push esi
call edi
push 0
push 0x9c6c
push esi
call edi
push 8
push ebx
push esi
call edi
add ebx, 0xffff6399
cmp ebx, 5
ja case.default.0x49a23d
jmp dword [ebx*4 + 0x49a79c]
push 0x10
push 0xac44
push 2
call fcn.0046f280
add esp, 0xc
mov dword [0x4c3830], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0x10
push 0x5622
push 2
call fcn.0046f280
add esp, 0xc
mov dword [0x4c3830], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0x10
push 0x2b11
push 2
call fcn.0046f280
add esp, 0xc
mov dword [0x4c3830], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 8
push 0xac44
push 2
call fcn.0046f280
add esp, 0xc
mov dword [0x4c3830], 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 8
push 0x5622
push 2
call fcn.0046f280
add esp, 0xc
mov dword [0x4c3830], 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 8
push 0x2b11
push 2
call fcn.0046f280
add esp, 0xc
mov dword [0x4c3830], 5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [0x4c3824]
xor eax, eax
test edi, edi
sete al
push eax
call fcn.00478570
mov eax, dword [0x4c3824]
add esp, 4
test eax, eax
je 0x49a34b
push 8
push 0x9c85
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0
push 0x9c85
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [0x4c382c]
xor ecx, ecx
test edi, edi
sete cl
push ecx
call fcn.00478b60
mov eax, dword [0x4c382c]
add esp, 4
test eax, eax
je 0x49a396
push 8
push 0x9c86
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0
push 0x9c86
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 6
call edi
push 0x37
mov esi, eax
call edi
push 0x1f
lea esi, [eax + esi*2]
call edi
push 8
add esi, eax
call edi
push 7
add esi, eax
call edi
xor edx, edx
mov ebx, eax
mov dword [esp + 0x10], edx
mov ecx, 0x11
mov dword [esp + 0x14], edx
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x18], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 0x101
mov word [esp + 0x60], 5
call fcn.00491d30
mov ecx, dword [0xc93c60]
mov dword [0xc93f8c], eax
test ecx, ecx
je 0x49a438
mov eax, dword [0xc93c70]
push 0
push 0x9c45
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0xc93f8c]
test eax, eax
jne 0x49a4df
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push edx
push eax
push eax
push 0x20
push 1
push eax
push eax
push str.SNDVOL32.EXE
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x49a482
push 0x4c71c0
push 0x4c7198
push 0x10000
push eax
call fcn.004917a0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
call fcn.00491d30
push eax
mov dword [0xc93f8c], eax
call fcn.00491d90
mov edx, dword [0xc93c70]
add esp, 4
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [0xc93f8c]
push 1
push 0
add eax, esi
push 0
add ecx, ebx
push eax
push ecx
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push eax
call fcn.00491d90
mov ecx, dword [0xc93c70]
add esp, 4
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [0xc93f8c]
push 1
push 0
add edx, esi
push 0
add eax, ebx
push edx
push eax
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edx, dword [0xc93c70]
mov eax, dword [0xc93f50]
push 0
push 0x4982b0
push edx
push 0x71
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [0x4c5d40]
test eax, eax
je 0x49a569
call fcn.00490b50
pop edi
pop esi
pop ebp
mov dword [0xc93f7c], 1
pop ebx
add esp, 0x64
ret
mov ecx, dword [0xc93c70]
push 0x4c70ec
push 0x4c7174
push 0x4c716c
push 0x11004
push ecx
call fcn.004917a0
add esp, 0x14
cmp eax, 6
jne case.default.0x49a23d
call fcn.00490b50
pop edi
pop esi
pop ebp
mov dword [0xc93f7c], 1
pop ebx
add esp, 0x64
ret
mov edx, dword [0xc93c70]
push 0
push 0
push 0
push str.helphelp.html
push 0
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [0xc93c70]
mov ecx, dword [0xc93f50]
push 0
push 0x498440
push eax
push 0x69
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edx, dword [0xc93c70]
push 0
push 0
push 0
push str.http:__leaf.aquaplus.co.jp
push 0
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, dword [ebx*4 + 0xc6be58]
lea eax, [ebx - 0xa027]
push ecx
push 0x258
push 0x320
mov dword [0xc93c60], eax
call fcn.004985c0
mov eax, dword [0xc93f88]
mov ebp, dword [sym.imp.USER32.dll_EnableMenuItem]
add esp, 0xc
test eax, eax
jle 0x49a66d
mov edi, 0xa028
push 0
push edi
push esi
call ebp
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0xc93f88]
inc edi
lea edx, [edi - 0xa028]
cmp edx, eax
jl 0x49a64d
push 1
push ebx
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push ebx
push esi
call edi
push 0
push 0x9c45
push esi
call ebp
push 0
push 0x9c45
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret