Function at 0x40b3ad
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x854
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x84c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2985
jg 0x40b098
je 0x40aff0
add ecx, 0xffffd897
cmp ecx, 0x39
ja case.default.0x40b0a7
movzx eax, byte [ecx + 0x40b52c]
jmp dword [eax*4 + 0x40b49c]
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 5
jne 0x40a471
push 0xb
jmp 0x40a473
push 0xa
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.default.0x40b0a7
mov dword [0x4ce7fc], 1
push 0
push 0x40e3b0
push dword [0x4def88]
push str.IDD_FILETYPE
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40b0a7
push 0
push 0x40e3b0
push dword [0x4def88]
mov dword [0x4ce7fc], 2
push str.IDD_FILETYPE
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x2778
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 0x2779
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b0a7
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x277b
push dword [0x4def88]
call edi
mov edx, str.TRASHFILES
mov ecx, eax
call fcn.0040f100
jmp 0x40a4e5
mov edx, str.TRASHFILESD
mov ecx, str.TRASHFILES
call fcn.0040f310
test eax, eax
je 0x40a4df
call fcn.0040d980
jmp 0x40a4df
mov dword [0x4ce7fc], 0xb
jmp 0x40a494
push 0
push 0x40e3b0
push dword [0x4def88]
mov dword [0x4ce7fc], 0xc
push str.IDD_FILETYPE
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x277d
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 0x277e
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b0a7
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2780
push dword [0x4def88]
call edi
mov ecx, eax
call fcn.0040ef00
jmp 0x40a58c
push 1
mov edx, str.TRASHFOLDERSD
mov ecx, str.TRASHFOLDERS
call fcn.0040f450
add esp, 4
test eax, eax
je 0x40a586
push 0
mov edx, str.TRASHCHECKDEF
mov ecx, str.TRASHCHECK
call fcn.0040f450
add esp, 4
call fcn.0040d4f0
jmp 0x40a586
mov dword [0x4ce7fc], 0x15
jmp 0x40a494
push 0
push 0x40e3b0
push dword [0x4def88]
mov dword [0x4ce7fc], 0x16
push str.IDD_FILETYPE
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x2782
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 0x2783
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b0a7
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2785
push dword [0x4def88]
call edi
mov edx, str.EXCLUDEFOLDERS
mov ecx, eax
call fcn.0040f100
jmp 0x40a64a
mov edx, str.EXCLUDEFOLDERSD
mov ecx, str.EXCLUDEFOLDERS
call fcn.0040f310
test eax, eax
je 0x40a644
call fcn.0040d7a0
jmp 0x40a644
push 0x4ded80
push 0x4ad0a4
push str.Remove
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 0x4ad374
jmp 0x40a6be
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x4ded80
push 0x4ad370
push str.Remove
push str.SFOPTIONS
call esi
mov edx, 0x4ad0e0
mov ecx, str.FILE
call fcn.00477440
lea edx, [esp + 0x58]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je 0x40a72f
push 0x4ded80
lea eax, [esp + 0x5c]
push eax
push str.Folder
push str.SFOPTIONS
call esi
call fcn.0040e310
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.Confirm
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a77e
push 0x4ad0e0
push str.Confirm
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.Confirm
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.ZeroFiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a7dd
push 0x4ad0e0
push str.ZeroFiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.ZeroFiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.EmptyFolders
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a83c
push 0x4ad0e0
push str.EmptyFolders
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.EmptyFolders
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.Logfiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a89b
push 0x4ad0e0
push str.Logfiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.Logfiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.StartMenu
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a8fa
push 0x4ad0e0
push str.StartMenu
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.StartMenu
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.ProgramFiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a959
push 0x4ad0e0
push str.ProgramFiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.ProgramFiles
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.WinSystem
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a9b8
push 0x4ad0e0
push str.WinSystem
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.WinSystem
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push str.CleanDir
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40aa17
push 0x4ad0e0
push str.CleanDir
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
push 0x4ad0a4
push str.CleanDir
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b0a7
mov eax, dword [0x4dde90]
cmp eax, 0xe7
jl 0x40aa44
cmp eax, 0xe9
jle 0x40aa62
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x2769
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x276a
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x4c]
mov dword [0x4c5188], 1
push eax
push 0
push 0
push 0x40f5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40b0a7
cmp dword [0x4c5188], 0
je case.default.0x40b0a7
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x276a
push dword [0x4def88]
mov dword [0x4c5188], 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x2769
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b0a7
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x4ade88
mov ecx, 0x4ad090
mov ebp, eax
call fcn.00477440
mov ebx, dword [sym.imp.USER32.dll_AppendMenuW]
push eax
push 0x2988
push 0
push ebp
call ebx
mov edi, dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
push 0x755a
push dword [0x4deb64]
call edi
mov esi, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x2988
push ebp
call esi
mov edx, 0x4ade90
mov ecx, 0x4ad090
call fcn.00477440
push eax
push 0x2989
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [0x4deb64]
call edi
push eax
push 0
push 0x2989
push ebp
call esi
mov edx, 0x4ade98
mov ecx, 0x4ad090
call fcn.00477440
push eax
push 0x298a
push 0
push ebp
call ebx
push 0
push 0x7549
push dword [0x4deb64]
call edi
push eax
push 0
push 0x298a
push ebp
call esi
push 0
push 0
push 0x800
push ebp
call ebx
mov edx, 0x4ad8c0
mov ecx, str.MAINMENU
call fcn.00477440
push eax
push 0x7540
push 0
push ebp
call ebx
push 0
push 0x7540
push dword [0x4deb64]
call edi
push eax
push 0
push 0x7540
push ebp
call esi
cmp dword [0x4de950], 0
jne 0x40ac10
mov edx, str.View
mov ecx, ebp
call fcn.00461b10
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push dword [0x4def88]
push 0
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 2
push ebp
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebp
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, esi
jmp 0x40b483
mov eax, dword [0x4dde90]
cmp eax, 1
jne 0x40ac73
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40b0a7
cmp eax, 0xe7
jl 0x40ac81
cmp eax, 0xe9
jle 0x40ac9f
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x276f
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x410cf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40b0a7
mov eax, dword [0x4dde90]
cmp eax, 1
je 0x40ac50
cmp eax, 0xe7
jl 0x40acf9
cmp eax, 0xe9
jle 0x40ad17
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x410ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40b0a7
mov eax, dword [0x4dde90]
cmp eax, 0xe7
jl 0x40ad47
cmp eax, 0xe9
jle 0x40ad65
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x279d
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x279e
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x4c]
mov dword [0x4c518c], 1
push eax
push 0
push 0
push 0x412b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40b0a7
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x279e
push dword [0x4def88]
mov dword [0x4c518c], 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x279d
push dword [0x4def88]
call edi
push eax
call esi
push 0
push 0x279e
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 0x279d
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b0a7
push 0x4ded80
push 6
lea eax, [esp + 0x54]
push eax
push 0
push str.ShortcutDesktop
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40ae69
push 0x4ad0e0
push str.ShortcutDesktop
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 1
jmp 0x40ae80
push 0x4ad0a4
push str.ShortcutDesktop
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0x2776
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x40b0a7
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x4ade98
mov ecx, 0x4ad090
mov ebp, eax
call fcn.00477440
mov ebx, dword [sym.imp.USER32.dll_AppendMenuW]
push eax
push 0x298c
push 0
push ebp
call ebx
mov edi, dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
push 0x7549
push dword [0x4deb64]
call edi
mov esi, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x298c
push ebp
call esi
mov edx, 0x4ade90
mov ecx, 0x4ad090
call fcn.00477440
push eax
push 0x298b
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [0x4deb64]
call edi
push eax
push 0
push 0x298b
jmp 0x40abb8
mov eax, dword [0x4dde90]
cmp eax, 1
je 0x40ac50
cmp eax, 0xe7
jl 0x40af3d
cmp eax, 0xe9
jle 0x40af5b
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x27a3
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x413820
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40b0a7
mov eax, dword [0x4dde90]
cmp eax, 1
je 0x40ac50
cmp eax, 0xe7
jl 0x40afb5
cmp eax, 0xe9
jle 0x40afd3
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x413c40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40b0a7
mov eax, dword [0x4aded8]
movq xmm0, qword [str.__C:_]
mov dword [esp + 0x60], eax
mov ax, word [0x4adedc]
push 0xba
mov word [esp + 0x68], ax
lea eax, [esp + 0x6a]
push 0
push eax
movq qword [esp + 0x64], xmm0
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2776
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x1073
push 0x2776
push dword [0x4def88]
mov dword [esp + 0x3c], 0x64
call edi
push eax
call esi
mov eax, dword [0x4def88]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x60], 0x5c
jmp 0x40b436
add ecx, 0xffffd67a
cmp ecx, 9
ja case.default.0x40b0a7
jmp dword [ecx*4 + 0x40b568]
mov eax, dword [0x4aded8]
movq xmm0, qword [str.__C:_]
mov dword [esp + 0x60], eax
mov ax, word [0x4adedc]
push 0x1fa
mov word [esp + 0x68], ax
lea eax, [esp + 0x6a]
push 0
push eax
movq qword [esp + 0x64], xmm0
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2776
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x1073
push 0x2776
push dword [0x4def88]
mov dword [esp + 0x3c], 0x104
call edi
push eax
call esi
mov eax, dword [0x4def88]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x60], 0x5c
mov dword [esp + 0x1c], str.explore
jmp 0x40b43e
mov dword [0x4c518c], 3
call fcn.00464ea0
mov dword [0x4c518c], 2
jmp case.default.0x40b0a7
call fcn.0040d7a0
jmp case.default.0x40b0a7
call fcn.0040d980
jmp case.default.0x40b0a7
call fcn.0040d4f0
jmp case.default.0x40b0a7
mov ecx, 0x276f
call fcn.00475ce0
jmp case.default.0x40b0a7
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x276f
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
mov dword [esp + 0x2c], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x276f
push dword [0x4def88]
call edi
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], str.notepad.exe
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], 0
jmp 0x40b463
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x276f
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x276f
jmp 0x40b40e
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27a3
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
mov dword [esp + 0x2c], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x27a3
push dword [0x4def88]
call edi
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], str.notepad.exe
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], 0
jmp 0x40b463
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27a3
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x27a3
push dword [0x4def88]
mov dword [esp + 0x3c], 0x400
mov dword [esp + 0x2c], 0
call edi
push eax
call esi
mov eax, dword [0x4def88]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], str.properties
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c1440]
movups xmmword [esp + 0x24], xmm0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x3c
push eax
mov dword [esp + 0x18], 0x4c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, 1
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x854
ret