Function at 0x40ba56
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4ac
mov eax, dword [0x424210]
xor eax, esp
mov dword [esp + 0x4a8], eax
push ebx
push esi
push edi
xor ebx, ebx
movzx edi, dx
mov eax, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ecx
mov esi, ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c], 1
cmp eax, 0x301
ja 0x40c44a
cmp eax, 0x300
jae 0x40c45d
cmp eax, 0x18
ja 0x40bfc1
je 0x40bf88
cmp eax, 7
ja 0x40be56
je 0x40be4d
sub eax, 1
je 0x40be39
sub eax, 1
je 0x40bd15
sub eax, 1
je 0x40bbb1
sub eax, 1
je 0x40bbe6
sub eax, 1
je 0x40bb1c
sub eax, 1
jne case.0x40bfdc.30
inc word [0x424e06]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
xor ecx, ecx
mov edi, eax
call fcn.0041d715
push edi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
jmp 0x40c54a
mov edi, 0x424e40
jmp 0x40bb4f
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
cmp eax, 0x100b
je 0x40bb3e
cmp eax, 0x1009
je 0x40bb3e
cmp eax, 0x100c
jne 0x40bba7
call fcn.0040ae2d
mov dword [0x424e4c], ebx
mov dword [0x424e48], ebx
mov ecx, edi
call fcn.0040e1c1
test eax, eax
je 0x40bb23
push 0x425018
push 0x28
pop edx
mov ecx, 0x424f78
call fcn.00406454
push 0x425068
push 0x28
pop edx
mov ecx, 0x424fc8
call fcn.00406454
mov eax, dword [esp + 0x1c]
mov dword [0x425bdc], eax
cmp word [0x424f78], bx
jne 0x40bb99
cmp word [0x424fc8], bx
je 0x40bb9b
mov ebx, eax
mov ecx, ebx
call fcn.0041ec86
jmp 0x40c54a
call fcn.0040dcc7
jmp 0x40c54a
inc word [0x424e02]
mov eax, dword [0x424ebc]
mov dword [0x424e3c], eax
cmp dword [0x424314], ebx
jne 0x40bbe6
push ebx
push ebx
mov edx, 0x425970
call fcn.0040fed6
test al, al
je 0x40bbe6
mov cl, 1
call fcn.0040d7c7
jmp 0x40c54a
cmp edi, 4
jne 0x40bbf2
inc word [0x424e04]
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
call fcn.0040e232
mov edx, 0x401da8
cmp dword [0x424314], ebx
jne 0x40bc1b
mov edx, dword [0x425970]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0040b84c
mov edi, eax
test edi, edi
jns 0x40bc6c
cmp edi, 0x800704c7
je 0x40bc5f
mov ecx, 0x401da8
cmp dword [0x424314], ebx
jne 0x40bc4f
mov ecx, dword [0x425970]
lea edx, [esp + 0x10]
call fcn.0040b676
mov edi, eax
mov byte [esp + 0xf], 1
test edi, edi
jns 0x40bc6c
mov ecx, edi
call fcn.0040dca1
jmp 0x40bce0
push 0x1fa
lea eax, [esp + 0x2b4]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test ecx, ecx
je 0x40bc99
push ecx
lea edx, [esp + 0x2b4]
call fcn.0041f918
mov edi, eax
test edi, edi
js 0x40bcaa
lea eax, [esp + 0x2b0]
cmp byte [esp + 0xf], bl
je 0x40bcac
mov eax, ebx
push eax
push 1
lea edx, [esp + 0x18]
call fcn.0040fed6
test al, al
je 0x40bcd7
push dword [esp + 0x10]
mov ecx, 0x425970
call fcn.0040e232
mov cl, 1
mov dword [esp + 0x10], ebx
call fcn.0040d7c7
jmp 0x40bce0
mov ecx, dword [esp + 0x10]
call fcn.00410e32
cmp dword [esp + 0x10], ebx
je 0x40bcf0
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x40c54a
mov dword [esp + 0x20], ebx
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x426478]
call edi
jmp 0x40c54a
call fcn.0040c7f4
test eax, eax
je 0x40c54a
mov eax, dword [0x424ebc]
lea ecx, [esp + 0x18]
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], eax
call fcn.0040e232
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
call fcn.0040b54e
mov dword [esp + 0x14], eax
test eax, eax
jns 0x40bd6a
cmp eax, 0x800704c7
je 0x40bd62
lea ecx, [esp + 0x18]
call fcn.0040b3e5
mov dword [esp + 0x14], eax
test eax, eax
js 0x40be0f
mov eax, dword [0x424e30]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [esp + 0x30]
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [0x425bfc]
mov ebx, dword [0x425bf0]
mov dword [0x424e30], eax
lea eax, [esp + 0x8c]
push eax
push 0
push dword [0x425970]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
mov ecx, 0x424e00
push edi
sbb eax, eax
and eax, dword [esp + 0xb0]
push ebx
mov edx, eax
call fcn.0041e907
call fcn.0040d110
mov ecx, eax
call fcn.0041ea60
mov edx, dword [0x424ebc]
lea ecx, [esp + 0x18]
push 0
call fcn.00410463
test al, al
jne 0x40be07
mov ecx, dword [esp + 0x18]
call fcn.00410e32
mov eax, dword [esp + 0x1c]
mov dword [0x424e30], eax
mov eax, 0x80004005
jmp 0x40be0b
mov eax, dword [esp + 0x14]
test eax, eax
jns 0x40be20
mov ecx, dword [esp + 0x28]
mov dword [0x424ebc], ecx
mov ecx, eax
call fcn.0040dca1
cmp dword [esp + 0x18], esi
je 0x40c54a
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0x40c54a
inc word [0x424e00]
xor ecx, ecx
inc ecx
call fcn.00410cec
jmp 0x40c54a
push ebx
push ebx
push 0x10
jmp 0x40c543
sub eax, 8
je 0x40bf42
sub eax, 7
je 0x40c54a
sub eax, 1
je 0x40bf2f
sub eax, 5
je 0x40c030
sub eax, 1
je case.0x40bfdc.29
sub eax, 1
jne case.0x40bfdc.30
inc word [0x424e14]
mov eax, dword [0x425e00]
mov dword [0x425bd4], 1
test eax, eax
je 0x40beb1
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push ecx
push 1
mov ecx, 0x425f38
mov dword [0x424ea0], 0x10001
call fcn.0040eb09
movzx eax, byte [0x425e12]
xor ecx, ecx
cmp byte [0x425e11], cl
sete cl
dec ecx
and ecx, 0x100000
add ecx, 0x40000
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
or dword [0x424ea0], ecx
call fcn.0041c3de
push 0x424e94
mov dword [0x424ea8], 0x425c00
mov dword [0x424eac], 0x800080
mov dword [0x424ea4], 0x425d00
call dword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov dword [0x425e00], eax
jmp 0x40c54a
inc word [0x424e08]
push ebx
push ebx
push 0xc7
jmp 0x40bffe
lea eax, [esp + 0x2c]
push eax
call fcn.0040f1f3
mov edi, eax
test edi, edi
jns 0x40bf6e
mov ecx, dword [ebp + 4]
mov edx, 0x353
push edi
push 0x401e3c
call fcn.00406f90
mov esi, dword [esp + 0x2c]
jmp 0x40c54d
mov esi, dword [esp + 0x2c]
push 5
push ebx
push 0x401f94
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40c54a
inc word [0x424e16]
push ebx
push 0x40dd60
push dword [0x425e0c]
push 0xe
push dword [0x424f30]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
jne 0x40c54a
mov ecx, dword [0x424f48]
call fcn.0040af8b
jmp 0x40c54a
cmp eax, 0x40
ja 0x40c3e7
je 0x40c3cc
sub eax, 0x19
cmp eax, 0xb
ja case.0x40bfdc.30
jmp dword [eax*4 + 0x40c572]
push 0xffffffffffffffff
push ebx
push 0xb1
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40c54a
cmp dword [0x425bd4], ebx
je 0x40c030
cmp word [0x425d00], bx
je 0x40c030
cmp edi, 0x1d
sete dl
call fcn.0041c1d9
jmp 0x40c54a
mov dword [0x425bd4], 1
cmp edi, 0x15
jne 0x40c046
inc word [0x424e12]
mov eax, dword [0x425e00]
test eax, eax
je 0x40c05a
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push ecx
push 1
mov ecx, 0x425f38
mov dword [0x424ea0], 0x10000
call fcn.0040eb09
xor ecx, ecx
cmp byte [0x425e10], cl
sete cl
xor eax, eax
cmp byte [0x425e11], al
sete al
dec eax
and eax, 0x100000
add eax, 0x40000
or ecx, eax
movzx eax, byte [0x425e12]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
or dword [0x424ea0], ecx
call fcn.0041c3de
push 0x424e94
mov dword [0x424ea8], ebx
mov dword [0x424eac], 0x80
mov dword [0x424ea4], 0x425d00
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x40bf25
xor ecx, ecx
call fcn.0040fc04
jmp 0x40c54a
mov ecx, dword [0x425bf0]
neg ecx
sbb ecx, ecx
and ecx, 0x100000
add ecx, 0x50200104
call fcn.0041c472
test eax, eax
je 0x40c121
xor eax, eax
mov dword [0x425be0], 1
cmp dword [0x425bf0], eax
sete al
mov dword [0x425bf0], eax
jmp 0x40c13b
push 0x30
push dword [0x4242f0]
push dword [0x4242d4]
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_MessageBoxW]
push ecx
push ecx
push 1
mov ecx, 0x424db0
call fcn.0040e9ca
jmp 0x40c54a
lea eax, [esp + 0x7c]
push eax
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x425bfc], ebx
je 0x40c19a
push ebx
push dword [0x425e08]
mov dword [0x425bfc], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
sub edx, dword [esp + 0x80]
sub ecx, dword [esp + 0x7c]
call fcn.0040af1f
jmp 0x40c1d5
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
sub edx, dword [esp + 0x80]
sub ecx, dword [esp + 0x7c]
mov dword [0x425bfc], 1
call fcn.0040af1f
call fcn.0040d3e0
push 5
push dword [0x425e08]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x425be0], 1
jmp 0x40c54a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
push eax
push 0x4e0
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40c20f
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40c21d
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x30], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
mov ecx, 0x1f4
add eax, 0xa
cmp eax, ecx
jb 0x40c232
mov eax, ecx
push 0x64
push eax
push 0x4e1
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0040d6ab
jmp 0x40c54a
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
push 0x4e0
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40c27b
mov ecx, dword [esp + 0x34]
test ecx, ecx
jne 0x40c289
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
sub eax, 0xa
cmp eax, 0xa
ja 0x40c232
push 0xa
pop eax
jmp 0x40c232
push 0x64
push 0x64
jmp 0x40c235
inc word [0x424e18]
lea eax, [esp + 0x40]
push 0x3c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x40c54a
mov eax, dword [esp + 0x14]
push 0x5a
push edi
mov dword [esp + 0x48], 0x3c
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], 0x424ed0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x2d0
push eax
push dword [0x424318]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [esp + 0x54], 0x1010041
mov dword [0x424ed0], eax
mov eax, 0x2000
push edi
push ebx
mov word [esp + 0x78], ax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov ebx, eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
test edi, edi
je 0x40c54a
push dword [0x424f38]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x2d0
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push eax
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 0x424ed0
mov dword [0x424ed0], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edi, eax
test edi, edi
je 0x40c3b1
push dword [0x424f2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 1
push edi
push 0x30
push dword [0x425e04]
mov dword [0x424f2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x50]
mov dword [0x424318], eax
push dword [0x424f3c]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x425bd8], 1
jmp 0x40c54a
push 1
push ebx
push ebx
push 0x401eb8
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.0041ec2f
jmp 0x40c54a
sub eax, 0x41
je 0x40c3ff
sub eax, 1
jne case.0x40bfdc.30
push 1
push ebx
push ebx
push 0x401e68
jmp 0x40bf7b
mov eax, dword [0x424f30]
mov edi, ebx
mov dword [esp + 0x38], eax
mov eax, dword [0x424f34]
mov dword [esp + 0x3c], eax
push 2
push dword [esp + edi*4 + 0x3c]
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x40c42b
inc edi
cmp edi, 2
jb 0x40c413
jmp 0x40c42d
mov ebx, eax
push ebx
push 0x401f94
push dword [0x4242f0]
push dword [0x425e0c]
call dword [sym.imp.SHELL32.dll_ShellAboutW]
jmp 0x40c54a
sub eax, 0x302
je 0x40c4c9
sub eax, 1
je 0x40c45d
mov edi, ebx
jmp 0x40c54d
mov eax, 0x300
cmp di, ax
jne 0x40c470
inc word [0x424e0a]
jmp 0x40c48a
mov eax, 0x301
cmp di, ax
jne 0x40c483
inc word [0x424e0c]
jmp 0x40c48a
inc word [0x424e10]
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], ebx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], ebx
push eax
push 0xb0
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x1c]
je 0x40c54a
mov edx, dword [esp + 0x24]
cmp edi, 0x1c
jne 0x40c4c9
mov edx, 0x150f
movzx edi, dx
mov eax, 0x302
cmp di, ax
jne 0x40c528
inc word [0x424e0e]
cmp dword [0x425bd0], ebx
jne 0x40c528
push 0x1fa
lea eax, [esp + 0xb4]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea ecx, [esp + 0xb0]
call fcn.0041fa0b
test eax, eax
js 0x40c528
cmp word [esp + 0xb0], bx
je 0x40c528
lea ecx, [esp + 0xb0]
call fcn.0040e109
inc word [0x424e1e]
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [0x425e04]
cmp eax, ecx
je 0x40c540
cmp eax, dword [0x425e0c]
jne 0x40c54a
push ebx
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
inc edi
test esi, esi
je 0x40c558
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x4b4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421870
mov esp, ebp
pop ebp
ret 4