Function at 0x409a50
Capabilities:
Create process on windows
Create thread
Get graphical window text
Hide graphical window
Read .ini file
Set registry value

Disassembly:
mov eax, 0x1054
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x104c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x297f
jg 0x40a072
je 0x40a033
add ecx, 0xffffd8e3
cmp ecx, 0x36
ja case.default.0x40a081
movzx eax, byte [ecx + 0x40a310]
jmp dword [eax*4 + 0x40a2b8]
push 7
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.default.0x40a081
push 8
jmp 0x409a9d
push 9
jmp 0x409a9d
xor ecx, ecx
call fcn.00477230
jmp case.default.0x40a081
mov eax, dword [0x4dde8c]
cmp eax, 1
jne 0x409af5
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.default.0x40a081
cmp eax, 0x3b2
jl 0x409b03
cmp eax, 0x3b4
jle 0x409b21
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
xor ecx, ecx
call fcn.00402c50
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x402d40
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40a081
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0x20
push 0
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x58]
push 0x400
push eax
push 0x272f
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_GetWindowTextW]
cmp word [esp + 0x58], 0
je 0x409b98
mov dword [esp + 0x20], 0
jmp 0x40a155
mov edx, 0x4ade2c
mov ecx, 0x4ad090
call fcn.004773a0
push eax
lea eax, [esp + 0x85c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ade34
lea eax, [esp + 0x858]
mov ecx, 0x4ad090
push 0x30
push eax
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
jmp case.default.0x40a081
mov eax, dword [0x4dde8c]
cmp eax, 1
je 0x409ad2
cmp eax, 0x3b2
jl 0x409bfd
cmp eax, 0x3b4
jle 0x409c1b
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
xor ecx, ecx
call fcn.00402c50
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x4072f0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40a081
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
jmp case.default.0x40a081
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
push 0x4ded80
push 0
push 0x4ad350
push 0x4ad35c
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x409c89
push 0x4ad0e0
jmp 0x409c8e
push 0x4ad0a4
push 0x4ad350
push 0x4ad35c
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40a081
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
mov edx, 0x4ade3c
mov ecx, 0x4ad090
call fcn.004773a0
lea edx, [esp + 0x858]
mov ecx, eax
call fcn.00475e00
test eax, eax
je case.default.0x40a081
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0x31
push 0
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x858]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0xa
push 0xa
lea eax, [esp + 0x860]
push eax
push 0
push 0
push 0x1004
push 0x274c
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push eax
call fcn.0048f5fe
add esp, 0x10
lea eax, [esp + 0x58]
push 0x4ded80
push eax
lea eax, [esp + 0x860]
push eax
push 0x4ad3b8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
call fcn.00403330
jmp case.default.0x40a081
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
mov edx, 0x4ad3b8
mov ecx, 0x274c
call fcn.00401380
jmp case.default.0x40a081
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
push 0
push 0x401200
push dword [0x4def88]
push 0x4ade44
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.default.0x40a081
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
mov edx, 0x4ad0a8
mov ecx, 0x2751
call fcn.00401380
jmp case.default.0x40a081
call fcn.00409870
jmp case.default.0x40a081
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x1073
push 0x2745
push dword [0x4def88]
mov dword [esp + 0x40], 0x400
call edi
push eax
call esi
cmp word [esp + 0x58], 0
jne 0x409e89
mov edx, 0x4ad0cc
mov ecx, 0x4ad090
call fcn.004773a0
push eax
lea eax, [esp + 0x85c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad9c4
jmp 0x409bbb
call dword [sym.imp.user32.dll_CreatePopupMenu]
mov edx, 0x4ade88
mov ecx, 0x4ad090
mov ebp, eax
call fcn.004773a0
mov ebx, dword [sym.imp.user32.dll_AppendMenuW]
push eax
push 0x2984
push 0
push ebp
call ebx
mov edi, dword [sym.imp.user32.dll_LoadBitmapW]
push 0
push 0x755a
push dword [InitializeSListHead]
call edi
mov esi, dword [sym.imp.user32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x2984
push ebp
call esi
mov edx, 0x4ade90
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0x2982
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x2982
push ebp
call esi
mov edx, 0x4ade98
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0x2983
push 0
push ebp
call ebx
push 0
push 0x7549
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x2983
push ebp
call esi
push 0
push 0
push 0x800
push ebp
call ebx
mov edx, 0x4ad8c0
mov ecx, 0x4adea0
call fcn.004773a0
push eax
push 0x7540
push 0
push ebp
call ebx
push 0
push 0x7540
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x7540
push ebp
call esi
cmp dword [0x4de950], 0
jne 0x409f94
mov edx, 0x4adeb4
mov ecx, ebp
call fcn.00461aa0
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
push 0
push dword [0x4def88]
push 0
push dword [esp + 0x60]
push dword [esp + 0x60]
push 2
push ebp
call dword [sym.imp.user32.dll_TrackPopupMenu]
push ebp
mov esi, eax
call dword [sym.imp.user32.dll_DestroyMenu]
mov eax, esi
jmp 0x40a29d
call fcn.004080f0
jmp case.default.0x40a081
call fcn.004079c0
jmp case.default.0x40a081
mov edx, 0x4cd5d0
mov ecx, 0x2740
call fcn.00407ed0
jmp case.default.0x40a081
mov edx, 0x4cddd0
mov ecx, 0x2745
call fcn.00407ed0
jmp case.default.0x40a081
call fcn.004094e0
jmp case.default.0x40a081
push 0
push 0x4084e0
push dword [0x4def88]
push 0x4adec0
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.default.0x40a081
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x297f
push dword [0x4def88]
mov dword [0x4c5184], 0
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x272c
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40a081
add ecx, 0xffffd680
cmp ecx, 4
ja case.default.0x40a081
jmp dword [ecx*4 + 0x40a348]
call fcn.00402fb0
jmp case.default.0x40a081
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x2980
push dword [0x4def88]
mov dword [0x4c4974], 0
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x272e
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40a081
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
mov dword [esp + 0x30], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x2745
push dword [0x4def88]
call edi
push eax
call esi
mov dword [esp + 0x20], 0x4ade58
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4c1390]
push eax
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x18], 0x3c
movups xmmword [esp + 0x2c], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x40a081
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
mov dword [esp + 0x30], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x2745
push dword [0x4def88]
call edi
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x4ade70
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x40a081
mov ecx, 0x2745
call fcn.00475c40
mov eax, 1
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1054
ret