Function at 0x40a181
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1054
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x297f
jg 0x40a122
je 0x40a0e3
add ecx, 0xffffd8e3
cmp ecx, 0x36
ja case.default.0x40a131
movzx eax, byte [ecx + 0x40a3c0]
jmp dword [eax*4 + 0x40a368]
push 7
push 0xf
push 0x4e5a00
push dword [0x4e6030]
call fcn.00401149
jmp case.default.0x40a131
push 8
jmp 0x409b4d
push 9
jmp 0x409b4d
xor ecx, ecx
call fcn.004784d0
jmp case.default.0x40a131
mov eax, dword [0x4e4f30]
cmp eax, 1
jne 0x409ba5
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40a131
cmp eax, 0x3b2
jl 0x409bb3
cmp eax, 0x3b4
jle 0x409bd1
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor ecx, ecx
call fcn.00402c80
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x402d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40a131
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0x20
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x58]
push 0x400
push eax
push 0x272f
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 0x58], 0
je 0x409c48
mov dword [esp + 0x20], 0
jmp 0x40a205
mov edx, 0x4b406c
mov ecx, 0x4b32d0
call fcn.00478640
push eax
lea eax, [esp + 0x85c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b4074
lea eax, [esp + 0x858]
mov ecx, 0x4b32d0
push 0x30
push eax
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x40a131
mov eax, dword [0x4e4f30]
cmp eax, 1
je 0x409b82
cmp eax, 0x3b2
jl 0x409cad
cmp eax, 0x3b4
jle 0x409ccb
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor ecx, ecx
call fcn.00402c80
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x407350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40a131
mov ecx, 0x4e5c20
call fcn.004028e0
call fcn.004034e0
jmp case.default.0x40a131
mov ecx, 0x4e5c20
call fcn.004028e0
call fcn.004034e0
push 0x4e5e28
push 0
push 0x4b3590
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4e5e28
test eax, eax
je 0x409d39
push 0x4b3320
jmp 0x409d3e
push 0x4b32e4
push 0x4b3590
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40a131
mov ecx, 0x4e5c20
call fcn.004028e0
call fcn.004034e0
mov edx, 0x4b407c
mov ecx, 0x4b32d0
call fcn.00478640
lea edx, [esp + 0x858]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.default.0x40a131
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0x31
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x858]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0xa
push 0xa
lea eax, [esp + 0x860]
push eax
push 0
push 0
push 0x1004
push 0x274c
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x58]
push 0x4e5e28
push eax
lea eax, [esp + 0x860]
push eax
push str.UNINSTALLFOLDERS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.00403360
jmp case.default.0x40a131
mov ecx, 0x4e5c20
call fcn.004028e0
call fcn.004034e0
mov edx, str.UNINSTALLFOLDERS
mov ecx, 0x274c
call fcn.00401380
jmp case.default.0x40a131
mov ecx, 0x4e5c20
call fcn.004028e0
call fcn.004034e0
push 0
push 0x401200
push dword [0x4e6030]
push 0x4b4084
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40a131
mov ecx, 0x4e5c20
call fcn.004028e0
call fcn.004034e0
mov edx, 0x4b32e8
mov ecx, 0x2751
call fcn.00401380
jmp case.default.0x40a131
call fcn.00409920
jmp case.default.0x40a131
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x1073
push 0x2745
push dword [0x4e6030]
mov dword [esp + 0x40], 0x400
call edi
push eax
call esi
cmp word [esp + 0x58], 0
jne 0x409f39
mov edx, 0x4b330c
mov ecx, 0x4b32d0
call fcn.00478640
push eax
lea eax, [esp + 0x85c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b3c04
jmp 0x409c6b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x4b40c8
mov ecx, 0x4b32d0
mov ebp, eax
call fcn.00478640
mov ebx, dword [sym.imp.USER32.dll_AppendMenuW]
push eax
push 0x2984
push 0
push ebp
call ebx
mov edi, dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
push 0x755a
push dword [0x4e5c0c]
call edi
mov esi, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x2984
push ebp
call esi
mov edx, 0x4b40d0
mov ecx, 0x4b32d0
call fcn.00478640
push eax
push 0x2982
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [0x4e5c0c]
call edi
push eax
push 0
push 0x2982
push ebp
call esi
mov edx, 0x4b40d8
mov ecx, 0x4b32d0
call fcn.00478640
push eax
push 0x2983
push 0
push ebp
call ebx
push 0
push 0x7549
push dword [0x4e5c0c]
call edi
push eax
push 0
push 0x2983
push ebp
call esi
push 0
push 0
push 0x800
push ebp
call ebx
mov edx, 0x4b3b00
mov ecx, str.MAINMENU
call fcn.00478640
push eax
push 0x7540
push 0
push ebp
call ebx
push 0
push 0x7540
push dword [0x4e5c0c]
call edi
push eax
push 0
push 0x7540
push ebp
call esi
cmp dword [0x4e59f8], 0
jne 0x40a044
mov edx, str.View
mov ecx, ebp
call fcn.00462c70
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push dword [0x4e6030]
push 0
push dword [esp + 0x60]
push dword [esp + 0x60]
push 2
push ebp
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebp
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, esi
jmp 0x40a34d
call fcn.004081a0
jmp case.default.0x40a131
call fcn.00407a70
jmp case.default.0x40a131
mov edx, 0x4d4610
mov ecx, 0x2740
call fcn.00407f80
jmp case.default.0x40a131
mov edx, 0x4d4e10
mov ecx, 0x2745
call fcn.00407f80
jmp case.default.0x40a131
call fcn.00409590
jmp case.default.0x40a131
push 0
push 0x408590
push dword [0x4e6030]
push str.CUNINST
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40a131
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x297f
push dword [0x4e6030]
mov dword [0x4cc1c4], 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x272c
push dword [0x4e6030]
call edi
push eax
call esi
jmp case.default.0x40a131
add ecx, 0xffffd680
cmp ecx, 4
ja case.default.0x40a131
jmp dword [ecx*4 + 0x40a3f8]
call fcn.00402fe0
jmp case.default.0x40a131
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x2980
push dword [0x4e6030]
mov dword [0x4cb9b4], 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x272e
push dword [0x4e6030]
call edi
push eax
call esi
jmp case.default.0x40a131
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
mov dword [esp + 0x30], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x2745
push dword [0x4e6030]
call edi
push eax
call esi
mov dword [esp + 0x20], str.properties
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4c7840]
push eax
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x18], 0x3c
movups xmmword [esp + 0x2c], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x40a131
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
mov dword [esp + 0x30], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x2745
push dword [0x4e6030]
call edi
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], str.notepad.exe
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x40a131
mov ecx, 0x2745
call fcn.00476ef0
mov eax, 1
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1054
ret