Function at 0x401480
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x478
mov eax, dword [str.notepad]
mov ecx, dword [0x407254]
mov dl, byte [0x407258]
push ebx
push ebp
mov ebp, dword [esp + 0x484]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
push esi
push edi
mov byte [esp + 0x88], dl
xor eax, eax
mov ecx, 0x3d
lea edi, [esp + 0x89]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [0x407618], ebp
call sub.cimit.dll_CimatronWndClassName
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, 0x4073e4
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebx, ebx
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
push 0x105
lea ecx, [esp + 0x284]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x280]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
cmp eax, ebx
jne 0x401558
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x280]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x407500
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401587
lea edi, [eax + 1]
cmp byte [edi], bl
je 0x401581
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x407500
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401587
mov byte [0x407500], bl
mov esi, dword [esp + 0x494]
push esi
call dword [sym.imp.MSVCRT.dll__strlwr]
push 0x40724c
push esi
call fcn.00401960
add esp, 0xc
test eax, eax
je 0x401666
call sub.cimit.dll_GetDatDir
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
or ecx, 0xffffffff
mov esi, edi
lea edx, [esp + 0x80]
mov edi, edx
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.clargs.dat
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
or ecx, 0xffffffff
mov esi, edi
lea edx, [esp + 0x80]
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
lea eax, [esp + 0x70]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
lea edx, [esp + 0xa0]
push edx
push ebx
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x58], ebx
mov dword [esp + 0x88], ebx
mov word [esp + 0x86], bx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x478
ret 0x10
push str._rls
push esi
call fcn.00401960
add esp, 8
test eax, eax
je 0x4016df
lea eax, [esp + 0x80]
push eax
call sub.cimit.dll_prgblc
lea ecx, [esp + 0x38c]
push ecx
call sub.cimit.dll_prgvpc
lea edx, [esp + 0x390]
push edx
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x190]
push str.Build_date:__s_n_nVersion_number:__s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
push ebx
push str.Cimatron_IT_Program_Information
lea edx, [esp + 0x188]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x478
ret 0x10
push 0x4071f0
push esi
call fcn.00401960
add esp, 8
test eax, eax
je 0x401743
lea eax, [esp + 0x80]
push eax
call sub.cimit.dll_prgvpc
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x188]
push str.Version_number:__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push ebx
push str.Cimatron_IT_Program_Information
lea eax, [esp + 0x188]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x478
ret 0x10
push 0x4071d8
push esi
call fcn.00401960
add esp, 8
test eax, eax
jne 0x401767
push str._smlscr
push esi
call fcn.00401960
add esp, 8
test eax, eax
je 0x401771
mov dword [0x40760c], 1
push 0x4071cc
push esi
call fcn.00401960
add esp, 8
test eax, eax
jne 0x401795
push str._rootw
push esi
call fcn.00401960
add esp, 8
test eax, eax
je 0x4017a2
mov edi, 1
mov dword [0x407638], edi
jmp 0x4017a7
mov edi, 1
push 0x4071c0
push esi
call fcn.00401960
add esp, 8
test eax, eax
jne 0x4017cb
push str._magic_number
push esi
call fcn.00401960
add esp, 8
test eax, eax
je 0x4017d1
mov dword [0x40763c], edi
push 0x4071ac
push esi
call fcn.00401960
add esp, 8
test eax, eax
jne 0x4017f5
push str._run_minimized
push esi
call fcn.00401960
add esp, 8
test eax, eax
je 0x4017fb
mov dword [0x407634], edi
push esi
call fcn.00401370
add esp, 4
call sub.cimit.dll_IsCimAlreadyRun
mov dword [0x407608], eax
cmp dword [esp + 0x490], ebx
jne 0x401831
push ebp
call fcn.00401a70
add esp, 4
test eax, eax
jne 0x401831
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x478
ret 0x10
mov ecx, dword [esp + 0x498]
push ecx
push ebp
call fcn.00401b10
add esp, 8
test eax, eax
jne 0x401853
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x478
ret 0x10
push str.CimSpace.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x40764c], eax
je 0x4018b4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartSpaceWare
push eax
call edi
mov edx, dword [0x40764c]
push str.SpaceMessage
push edx
mov esi, eax
call edi
cmp esi, ebx
mov dword [0x407650], eax
je 0x4018a1
cmp eax, ebx
je 0x4018a1
mov eax, dword [0x407614]
push eax
call esi
add esp, 4
cmp eax, ebx
jne 0x4018b4
mov ecx, dword [0x40764c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x40764c], ebx
mov edx, dword [0x407614]
push edx
call fcn.00402830
cmp eax, ebx
mov dword [0x407654], eax
je 0x4018fc
push 5
push 0x6c32
push eax
call fcn.004027e0
mov eax, dword [0x407654]
push 0xfa
push 0x6c31
push eax
call fcn.004027e0
mov ecx, dword [0x407654]
push 1
push ecx
call sub.cimit.dll_GetSetMagellanHandle
add esp, 8
mov edx, dword [0x407614]
push edx
call fcn.00401460
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
add esp, 4
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
je 0x401947
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
call ebp
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x40192b
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x478
ret 0x10