Function at 0x4096e0
Capabilities:
Create process on windows
Get common file path
Get program files directory
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44f2ac
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x4655f0]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4655f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1d0]
xor ebx, ebx
mov dword [esp + 0x1c8], ebx
mov eax, 0xf
mov dword [esp + 0x98], eax
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
push 7
push str.method
lea ecx, [esp + 0x50]
mov byte [esp + 0x1d0], 4
call fcn.004071b0
mov eax, dword [esp + 0x4c]
mov edi, 0x10
cmp dword [esp + 0x60], edi
jae 0x40979d
lea eax, [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
push ecx
push eax
lea edx, [esp + 0x1dc]
push edx
xor eax, eax
call fcn.0040d230
mov esi, eax
cmp esi, 0xffffffff
je 0x409fd1
push 1
push 0x457f98
lea eax, [esp + 0x1dc]
push eax
mov eax, esi
call fcn.0040d230
mov ecx, dword [esp + 0x5c]
sub eax, ecx
sub eax, esi
add ecx, esi
push eax
lea esi, [esp + 0x24]
lea edx, [esp + 0x1d8]
call fcn.0040d1b0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1d4], 5
call fcn.00406fe0
mov byte [esp + 0x1c8], 4
cmp dword [esp + 0x38], edi
jb 0x409821
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004181cf
add esp, 4
push 4
push str.idx
lea ecx, [esp + 0x50]
call fcn.004071b0
cmp dword [esp + 0x60], edi
mov eax, dword [esp + 0x4c]
jae 0x40983f
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x5c]
push edx
push eax
lea eax, [esp + 0x1dc]
push eax
xor eax, eax
call fcn.0040d230
mov esi, eax
cmp esi, 0xffffffff
je 0x409eee
push 1
push 0x457f98
lea ecx, [esp + 0x1dc]
push ecx
call fcn.0040d230
mov ecx, dword [esp + 0x5c]
sub eax, ecx
sub eax, esi
add ecx, esi
push eax
lea esi, [esp + 0x24]
lea edx, [esp + 0x1d8]
call fcn.0040d1b0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1d4], 6
call fcn.00406fe0
mov byte [esp + 0x1c8], 4
cmp dword [esp + 0x38], edi
jb 0x4098c1
mov edx, dword [esp + 0x24]
push edx
call fcn.004181cf
add esp, 4
push 0xd
push str.purchase_idx
lea ecx, [esp + 0x50]
call fcn.004071b0
cmp dword [esp + 0x60], edi
mov eax, dword [esp + 0x4c]
jae 0x4098df
lea eax, [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
push ecx
push eax
lea edx, [esp + 0x1dc]
push edx
xor eax, eax
call fcn.0040d230
cmp eax, 0xffffffff
je 0x409e0b
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x1e8]
sub edx, ecx
sub edx, eax
push edx
add ecx, eax
lea esi, [esp + 0x24]
lea edx, [esp + 0x1d8]
call fcn.0040d1b0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x1d4], 7
call fcn.00406fe0
mov byte [esp + 0x1c8], 4
cmp dword [esp + 0x38], edi
jb 0x40994f
mov eax, dword [esp + 0x24]
push eax
call fcn.004181cf
add esp, 4
push ebx
push str.FileHam_class_down
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
jne 0x409be6
lea ecx, [esp + 0x18]
call fcn.00401d80
lea ecx, [esp + 0x14]
call fcn.00401d80
push 0x103
lea ecx, [esp + 0xbd]
push ebx
mov byte [esp + 0x1d0], 9
push ecx
mov byte [esp + 0xc4], bl
call fcn.0043b390
add esp, 0xc
push ebx
push 0x26
lea edx, [esp + 0xc0]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0xb8]
push 0x456f6e
push eax
call fcn.004369f3
add esp, 8
test eax, eax
jne 0x4099df
push str.C:Program_Files
lea ecx, [esp + 0xbc]
push 0x104
push ecx
call fcn.00437c78
add esp, 0xc
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x20]
call fcn.004017a0
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x1cc], 0xa
call fcn.00406d30
mov ecx, dword [esp + 0x1c]
push str.Fileham.comFileHam_fast_
push ecx
lea edx, [esp + 0x20]
push str._s_sFileHamDown.exe
push edx
call fcn.00401d60
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.00426805
mov byte [esp + 0x1c8], 0xb
mov eax, dword [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x28]
call fcn.00426876
test eax, eax
jne 0x409b72
push ebx
push 4
push 0x458020
call fcn.004208e8
cmp eax, 6
jne 0x409adc
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
lea esi, [ebp + 0xd98]
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi], eax
call edi
push ebx
push ebx
push ebx
push ebx
push ebp
push 0x40be90
mov dword [ebp + 0xd9c], eax
call fcn.00424e6d
mov edx, dword [ebp + 0x924]
mov eax, dword [edx + 0x144]
lea ecx, [ebp + 0x924]
call eax
push 0xffffffffffffffff
push ebx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov edi, eax
call esi
mov edx, dword [ebp + 0xd9c]
push edx
call esi
cmp edi, 1
jne 0x409b6d
lea ecx, [ebp + 0xd0]
mov eax, str.http:__www.fileham.com_mmsv_FileHamDownloaderSetup.exe
call fcn.00407870
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c8], 0xa
call fcn.00426829
lea ecx, [esp + 0x1c]
call fcn.00401600
lea ecx, [esp + 0x14]
call fcn.00401600
lea ecx, [esp + 0x18]
call fcn.00401600
lea ecx, [esp + 0x48]
mov byte [esp + 0x1c8], 3
call fcn.00406fb0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1c8], 2
call fcn.00406fb0
lea ecx, [esp + 0x64]
mov byte [esp + 0x1c8], 1
call fcn.00406fb0
lea ecx, [esp + 0x80]
mov byte [esp + 0x1c8], bl
call fcn.00406fb0
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x1c8], 0xffffffff
call fcn.00406fb0
jmp 0x40a0b3
mov edi, 0x10
mov eax, dword [ebp + 0x910]
mov ecx, dword [ebp + 0x908]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s__s
push edx
call fcn.00401d60
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 1
push ebx
push eax
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c8], 0xa
call fcn.00426829
lea ecx, [esp + 0x1c]
call fcn.00401600
lea ecx, [esp + 0x14]
call fcn.00401600
lea ecx, [esp + 0x18]
mov byte [esp + 0x1c8], 4
call fcn.00401600
mov dword [esp + 0x14], ebx
lea ebx, [ebx]
push ebx
push str.FileHam_class_down
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
jne 0x409c1f
cmp dword [esp + 0x14], 5
jg 0x409d16
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [esp + 0x14], 1
jmp 0x409bf0
lea ecx, [esp + 0x14]
call fcn.00401d80
mov ecx, str._free
lea edi, [esp + 0x9c]
mov byte [esp + 0x1c8], 0xc
call fcn.0040d1e0
mov ecx, dword [esp + 0x84]
test eax, eax
mov eax, 0x10
jne 0x409c96
cmp dword [esp + 0x98], eax
jae 0x409c61
lea ecx, [esp + 0x84]
cmp dword [esp + 0x7c], eax
mov eax, dword [esp + 0x68]
jae 0x409c6f
lea eax, [esp + 0x68]
push 0x457614
push 0x4580c0
push ecx
push 0x4580c0
push eax
push 0x4580c0
push 0x456f70
push str._s_s_s_s_s_s_s
lea edx, [esp + 0x34]
push edx
jmp 0x409cd9
cmp dword [esp + 0x98], eax
jae 0x409ca6
lea ecx, [esp + 0x84]
cmp dword [esp + 0x7c], eax
mov eax, dword [esp + 0x68]
jae 0x409cb4
lea eax, [esp + 0x68]
push 0x456f70
push 0x4580c0
push ecx
push 0x4580c0
push eax
push 0x4580c0
push 0x456f70
push str._s_s_s_s_s_s_s
lea eax, [esp + 0x34]
push eax
call fcn.00401d60
mov eax, dword [esp + 0x38]
mov dword [esp + 0x60], ebx
mov ecx, dword [eax - 0xc]
add ecx, 1
add esp, 0x24
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x3c]
push ecx
push ebp
push 0x4a
push esi
mov dword [esp + 0x54], eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x14]
call fcn.00401600
mov edi, 0x10
jmp 0x409d22
push ebx
push ebx
push 0x4580d8
call fcn.004208e8
mov byte [esp + 0x1c8], 3
cmp dword [esp + 0x60], edi
jb 0x409d3d
mov edx, dword [esp + 0x4c]
push edx
call fcn.004181cf
add esp, 4
mov esi, 0xf
mov byte [esp + 0x1c8], 2
cmp dword [esp + 0xb4], edi
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x409d6f
mov eax, dword [esp + 0xa0]
push eax
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], 1
cmp dword [esp + 0x7c], edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x409d9f
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], bl
cmp dword [esp + 0x98], edi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
jb 0x409dcb
mov edx, dword [esp + 0x84]
push edx
call fcn.004181cf
add esp, 4
mov dword [esp + 0x1c8], 0xffffffff
cmp dword [esp + 0x1ec], edi
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
jb 0x409e04
mov eax, dword [esp + 0x1d8]
push eax
call fcn.004181cf
add esp, 4
mov al, 1
jmp 0x40a0b5
mov byte [esp + 0x1c8], 3
cmp dword [esp + 0x60], edi
jb 0x409e26
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.004181cf
add esp, 4
mov esi, 0xf
mov byte [esp + 0x1c8], 2
cmp dword [esp + 0xb4], edi
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x409e58
mov edx, dword [esp + 0xa0]
push edx
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], 1
cmp dword [esp + 0x7c], edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x409e88
mov eax, dword [esp + 0x68]
push eax
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], bl
cmp dword [esp + 0x98], edi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
jb 0x409eb4
mov ecx, dword [esp + 0x84]
push ecx
call fcn.004181cf
add esp, 4
mov dword [esp + 0x1c8], 0xffffffff
cmp dword [esp + 0x1ec], edi
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
jb 0x40a0b3
mov edx, dword [esp + 0x1d8]
push edx
jmp 0x40a0ab
mov byte [esp + 0x1c8], 3
cmp dword [esp + 0x60], edi
jb 0x409f09
mov eax, dword [esp + 0x4c]
push eax
call fcn.004181cf
add esp, 4
mov esi, 0xf
mov byte [esp + 0x1c8], 2
cmp dword [esp + 0xb4], edi
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x409f3b
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], 1
cmp dword [esp + 0x7c], edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x409f6b
mov edx, dword [esp + 0x68]
push edx
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], bl
cmp dword [esp + 0x98], edi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
jb 0x409f97
mov eax, dword [esp + 0x84]
push eax
call fcn.004181cf
add esp, 4
mov dword [esp + 0x1c8], 0xffffffff
cmp dword [esp + 0x1ec], edi
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
jb 0x40a0b3
mov ecx, dword [esp + 0x1d8]
push ecx
jmp 0x40a0ab
mov byte [esp + 0x1c8], 3
cmp dword [esp + 0x60], edi
jb 0x409fec
mov edx, dword [esp + 0x4c]
push edx
call fcn.004181cf
add esp, 4
mov esi, 0xf
mov byte [esp + 0x1c8], 2
cmp dword [esp + 0xb4], edi
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x40a01e
mov eax, dword [esp + 0xa0]
push eax
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], 1
cmp dword [esp + 0x7c], edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x40a04e
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004181cf
add esp, 4
mov byte [esp + 0x1c8], bl
cmp dword [esp + 0x98], edi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
jb 0x40a07a
mov edx, dword [esp + 0x84]
push edx
call fcn.004181cf
add esp, 4
mov dword [esp + 0x1c8], 0xffffffff
cmp dword [esp + 0x1ec], edi
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
jb 0x40a0b3
mov eax, dword [esp + 0x1d8]
push eax
call fcn.004181cf
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00437030
add esp, 0x1b8
ret 0x20