Function at 0x412447
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 4], eax
add ecx, 0xffffdc91
push esi
push edi
cmp ecx, 0x69
ja case.0x41222b.9072
movzx eax, byte [ecx + 0x412db8]
jmp dword [eax*4 + 0x412cc4]
cmp dword [0x4435a0], 0
jne case.0x41222b.9072
push 0
push 0x415cd0
push dword [0x443fd4]
push 0x23b9
push dword [0x443fd0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x818]
push eax
push dword [0x443498]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je case.0x41222b.9072
cmp byte [0x443591], 0
push 1
jne 0x4122ab
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x814]
sub eax, ecx
push eax
push dword [0x443594]
push ecx
jmp 0x4122bd
push dword [0x4434f4]
push dword [0x4434f0]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [0x443498]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp byte [0x443591], 0
sete byte [0x443591]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
push dword [0x443fd4]
call dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, eax
push 3
push 0x23bc
push edi
call esi
push 3
push 0x23bd
push edi
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
call fcn.00410840
push dword [0x443e2c]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
cmp byte [0x4434a0], 0
jne 0x4123aa
mov esi, dword [0x46f928]
mov edi, dword [0x443fd4]
push 8
push 0x23ba
push dword [0x443498]
mov byte [0x4434a0], 1
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push dword [0x443498]
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x415550
push esi
push 0x23bb
push edi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
push 0x23bb
push dword [0x443fd4]
mov byte [0x4434a0], 0
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x23ba
push dword [0x443498]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push dword [0x443498]
call dword [sym.imp.USER32.dll_DrawMenuBar]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 3
push 0
push 0
push str.http:__twenkid.com_software_toshko2
push str.open
push dword [0x443fd4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 3
push 0
push 0
push str.http:__research.twenkid.com_bulgarian_about_
jmp 0x41240e
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp byte [0x443590], 0
je 0x41249c
lea eax, [ebp - 0x808]
push 0x400
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
cmp dword [0x44358c], 0x10
mov eax, 0x443578
cmovae eax, dword [0x443578]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push 0x41e554
push eax
call fcn.004016a0
add esp, 0x18
push 3
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push str.open
push dword [0x443498]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x408]
push ecx
push eax
push str.err2___d___s_
push dword [0x46fbe0]
call fcn.004016a0
add esp, 0xc
mov ecx, 0x46fba8
push dword [0x46fbe0]
call fcn.00401c30
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetMenu]
push 8
push 0x23bf
push dword [0x443498]
mov word [0x4434a1], 1
mov byte [0x4434a3], 0
call edi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
push 0
push 0x23c0
push dword [0x443498]
call edi
push eax
call esi
push 0
push 0x23c1
push dword [0x443498]
call edi
push eax
call esi
push dword [0x443498]
mov dword [0x4434a4], 0x40
call dword [sym.imp.USER32.dll_DrawMenuBar]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0x23bf
push dword [0x443498]
mov word [0x4434a1], 0x100
mov byte [0x4434a3], 0
call edi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
push 8
push 0x23c0
push dword [0x443498]
call edi
push eax
call esi
push 0
push 0x23c1
push dword [0x443498]
call edi
push eax
call esi
push dword [0x443498]
mov dword [0x4434a4], 0x30
call dword [sym.imp.USER32.dll_DrawMenuBar]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0x23bf
push dword [0x443498]
mov word [0x4434a1], 0
mov byte [0x4434a3], 1
call edi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
push 0
push 0x23c0
push dword [0x443498]
call edi
push eax
call esi
push 8
push 0x23c1
push dword [0x443498]
call edi
push eax
call esi
push dword [0x443498]
mov dword [0x4434a4], 0x20
call dword [sym.imp.USER32.dll_DrawMenuBar]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
push 0x41dc7c
push dword [0x443e2c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [0x443484], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [0x443488], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3f4ccccd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3f28f5c3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3ef5c28f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3ebd70a4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3e2e147b
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 0
mov dword [edx + 0x2aebc], 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3fa66666
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x3fe66666
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x402ccccd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x40800000
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2addc], 1
mov dword [edx + 0x2aec8], 0x40e00000
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f8ccccd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3fa00000
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3fb5c28f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3fd9999a
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x40066666
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f733333
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f666666
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f4f5c29
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f3851ec
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f1c28f6
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2adf0], 1
mov dword [edx + 0x2adcc], 0x3f028f5c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2add8], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2add8], 0
mov dword [edx + 0x2aec0], 0xbdcccccd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2add8], 0
mov dword [edx + 0x2aec0], 0x3df5c28f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2add8], 0
mov dword [edx + 0x2aec0], 0x3d75c28f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2add8], 0
mov dword [edx + 0x2aec0], 0x3ca3d70a
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aed0], 0x1e
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aed0], 0x3c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aed0], 0x78
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aed0], 0xf0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aed0], 0xf
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 5
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 7
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 0xa
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 0xd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 0x11
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
mov dword [edx + 0x2aebc], 0x15
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
cmp dword [0x46f970], 0
push dword [0x443494]
mov dword [0x46fc28], 1
mov dword [0x46f3e8], 1
mov byte [0x46fbc4], 1
mov dword [0x46f920], 0
jne 0x412c5b
push 0x424078
push dword [0x443e2c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x412c6e
mov ecx, dword [0x443e2c]
mov edx, 0x424078
call fcn.004165d0
add esp, 4
push 0x424068
push 1
push dword [0x443fd4]
push 0x415090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x46fbc4], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a150
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
push dword [0x443fd4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041a150
mov esp, ebp
pop ebp
ret