Function at 0x402d70
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
sub esp, 0x318
push ebx
push ebp
push esi
push edi
push 0x414
call fcn.004103b0
xor esi, esi
add esp, 4
cmp eax, esi
je 0x402db0
mov word [eax + 0x410], si
mov word [eax + 0x412], si
mov byte [eax], 0
mov byte [eax + 0x104], 0
mov byte [eax + 0x208], 0
mov ebp, eax
jmp 0x402db2
xor ebp, ebp
mov ebx, dword [esp + 0x334]
mov eax, dword [esp + 0x330]
push ebx
push eax
push ebp
mov dword [0x41f1d4], esi
call fcn.00402c80
add esp, 0xc
test eax, eax
je 0x403132
mov eax, dword [esp + 0x338]
mov dword [esp + 0x14], 1
cmp eax, esi
jne 0x402f77
cmp word [ebp + 0x410], si
je 0x402f77
cmp word [ebp + 0x412], si
je 0x402f77
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [ebp + 0x104]
push ecx
call edi
lea edx, [ebp + 0x208]
mov esi, eax
push edx
mov dword [esp + 0x1c], esi
call edi
mov edi, eax
mov dword [0x41f1cc], 0
test si, si
mov dword [esp + 0x10], edi
je 0x402e66
test di, di
je 0x402e66
and eax, 0xffff
mov ecx, esi
shl eax, 0x10
and ecx, 0xffff
or eax, ecx
push eax
push ebx
push 0x3e0
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x41f1cc]
test eax, eax
je 0x402f61
mov edx, dword [esp + 0x32c]
lea eax, [esp + 0x120]
push edx
push 0x41a178
push eax
mov dword [esp + 0x20], 0
call fcn.00410860
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xa
push ecx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x402f5d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [esp + 0x334]
mov ecx, dword [0x41f1d0]
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push edi
push 0x3e8
push ecx
call esi
mov edx, dword [0x41f1d0]
push 0
push edi
push 0x3e1
push edx
call esi
mov eax, dword [0x41f1d0]
push 0x43
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x41f1d0]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
test ebp, ebp
je 0x402f57
push ebp
call fcn.004103c0
add esp, 4
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
test si, si
je 0x402f6f
push esi
call ebx
test di, di
je 0x402f77
push edi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x403118
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x14
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x334]
push ecx
call fcn.00402c50
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x32c]
mov ecx, ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x124]
push ecx
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x120]
push eax
call fcn.00403180
add esp, 4
lea ecx, [esp + 0x120]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
mov dword [0x41f1d4], eax
jg 0x403102
test eax, eax
je 0x40316c
mov edx, dword [esp + 0x334]
mov eax, dword [esp + 0x330]
push edx
push eax
push ebp
call fcn.00402ae0
add esp, 0xc
test eax, eax
je 0x40314f
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x14
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x334]
push ecx
call fcn.00402c50
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x32c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x120]
push eax
call fcn.00403180
add esp, 4
lea ecx, [esp + 0x120]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
mov dword [0x41f1d4], eax
jle 0x403031
push str.mmates.ini
push ebp
push str.browser
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test ebp, ebp
je 0x403125
push ebp
call fcn.004103c0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
cmp ebp, esi
je 0x40313f
push ebp
call fcn.004103c0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
test ebp, ebp
je 0x40315c
push ebp
call fcn.004103c0
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x318
ret