Function at 0x40c6c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a5720
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push edi
mov eax, dword [0x4d32ac]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
cmp ebp, 0x3fa
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
je 0x40c706
cmp ebp, 0x3fc
jne 0x40c826
cmp dword [esi + 0x2008], 0
jne 0x40c721
push 0
call dword [0x4a73d8]
mov dword [esi + 0x2008], 1
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [0x4a7484]
mov edx, dword [esi + 4]
push 0
push 0x3e8
push 1
push edx
call dword [0x4a7424]
lea ebx, [esp + 0x14]
call fcn.0042af80
mov dword [esp + 0x28], 0
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
test eax, eax
jle 0x40c782
lea ecx, [eax - 1]
test ecx, ecx
jl 0x40c857
cmp ecx, eax
jg 0x40c857
movzx eax, word [edx + ecx*2]
cmp ax, 0x5c
je 0x40c782
push 0x5c
mov edi, ebx
call fcn.00404820
push 0xe
push str.QQPYConfig.exe
lea eax, [esp + 0x1c]
push eax
call fcn.0040ddc0
mov edx, dword [0x4dbc78]
mov eax, dword [edx + 0xc]
mov ecx, 0x4dbc78
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push str._focuspage_23
mov ebx, 0xd
lea eax, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call fcn.00404880
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 1
push 0
push edi
push ecx
push 0x4ba7d8
push 0
call dword [0x4a7340]
lea eax, [edi - 0x10]
mov byte [esp + 0x28], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c7fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c826
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, 2
jne 0x40c861
mov ecx, dword [esi + 4]
push ecx
call dword [0x4a73e4]
test eax, eax
je 0x40c848
mov edx, dword [esi + 4]
push 0x3e9
push edx
call dword [0x4a7484]
mov eax, dword [esi + 4]
push eax
call dword [0x4a7414]
jmp 0x40c9ed
push 0x80070057
call fcn.00404ef0
cmp ebp, 0x3ed
je 0x40c82b
cmp ebp, 0x3ec
jne 0x40c8aa
mov ecx, dword [esi + 0x98]
push 0
push 0
push 0x41c
push ecx
call dword [0x4a7410]
mov edx, dword [esi + 4]
push edx
call dword [0x4a73e4]
test eax, eax
je 0x40c9ed
mov eax, dword [esi + 4]
push 2
push eax
call dword [0x4a73ec]
jmp 0x40c9ed
cmp ebp, 0x3ee
jne 0x40c8bd
push esi
call fcn.0040cbc0
jmp 0x40c9ed
cmp ebp, 0x3f2
jne 0x40c8d1
mov eax, esi
call fcn.0040cd60
jmp 0x40c9ed
cmp ebp, 0x3ef
jne 0x40c8e4
push esi
call fcn.0040ce10
jmp 0x40c9ed
cmp ebp, 0x3f0
jne 0x40c8f7
push esi
call fcn.0040cfb0
jmp 0x40c9ed
cmp ebp, 0x3f3
jne 0x40c90a
push esi
call fcn.0040d2c0
jmp 0x40c9ed
cmp ebp, 0x3f4
jne 0x40c91d
push esi
call fcn.0040d150
jmp 0x40c9ed
cmp ebp, 0x3f8
jne 0x40c9c3
call fcn.0041bd30
mov edi, dword [0x4dd53c]
lea ecx, [esi + 0x25c]
test ecx, ecx
mov dword [0x4dd538], 1
je 0x40c950
lea eax, [esi + 0x260]
jmp 0x40c952
xor eax, eax
cmp dword [esi + 0x1d2c], eax
jne 0x40c96b
xor edx, edx
cmp dword [edi + 0xc1c], edx
sete dl
mov dword [edi + 0xc1c], edx
lea eax, [esi + 0x1bf0]
test eax, eax
je 0x40c97d
lea eax, [esi + 0x1bf4]
jmp 0x40c97f
xor eax, eax
cmp dword [esi + 0x1d2c], eax
jne 0x40c998
xor ecx, ecx
cmp dword [edi + 0xc24], ecx
sete cl
mov dword [edi + 0xc24], ecx
call fcn.0041bd30
call fcn.0041f630
test eax, eax
jne 0x40c9ac
push edi
call fcn.0041bdd0
cmp dword [0x4dad18], 0
je 0x40c9ba
call fcn.0042bbc0
mov edi, esi
call fcn.0040d430
jmp 0x40c9ed
cmp ebp, 0x3f9
jne 0x40c9ed
lea ecx, [esi + 0x1c68]
test ecx, ecx
je 0x40c9dd
lea eax, [esi + 0x1c6c]
jmp 0x40c9df
xor eax, eax
cmp dword [esi + 0x1d2c], eax
jne 0x40c9ed
push ecx
call fcn.004099c0
mov edx, dword [esp + 0x1c]
mov dword [edx], 0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 8