Function at 0x463be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9113
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xab0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push esi
mov dword [ebp - 0x28], ebx
call fcn.004ab10f
push 0x4e4ee8
push esi
call fcn.004a6d58
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x464008
push 0x4e4ef0
push esi
call fcn.004a6d58
mov edi, eax
add esp, 8
test edi, edi
jne 0x464008
push 0x4e4ef8
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463fde
push 0x4e4f00
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463fde
push 0x4e4f08
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463c8f
push 0x4e4f10
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
je 0x463ccb
add eax, 6
test eax, eax
je 0x463ccb
push eax
mov ecx, ebx
call fcn.0045ffd0
cmp eax, 0xffffffff
je 0x463cb3
push str.1Multifinger_Gestures
push eax
mov ecx, 0x515d60
call fcn.00464e80
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0x4e4f18
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463fb4
push 0x4e4f20
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463fb4
push 0x4e4f28
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f92
push 0x4e4f30
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f92
push 0x4e4f38
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f68
push 0x4e4f40
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f68
push 0x4e4f48
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f3e
push 0x4e4f50
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f3e
push 0x4e4f58
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f14
push str._REGPLUGIN
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463f14
push 0x4e4f88
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463eea
push str._PROFILES
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463eea
push 0x4e4fb0
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463ec0
push str._INFORMATION
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463ec0
push 0x4e4fe8
push esi
call fcn.004a6d58
mov edx, eax
add esp, 8
test edx, edx
jne 0x463e73
push str._SHELLEXEC
push esi
call fcn.004a6d58
mov edx, eax
add esp, 8
test edx, edx
jne 0x463e73
push 0x4e5024
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
jne 0x463e4b
push str._PROMO
push esi
call fcn.004a6d58
add esp, 8
test eax, eax
je 0x463e5b
push 0x8000
push dword [ebp + 8]
call fcn.004a0ae0
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
add edx, 0x14
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x463e80
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463e80
sub ecx, esi
sar ecx, 1
je 0x463e94
add edx, 2
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x802b
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x8028
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x800a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x47e
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x47d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov dword [ebx + 0x7cc], 0
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x800b
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x47c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
add edi, 4
xor ebx, ebx
lea ecx, [ecx]
movzx eax, word [edi]
cmp eax, 0x53
je 0x46405d
cmp eax, 0x52
je 0x464062
xor eax, eax
mov dword [ebp - 0x10], 7
push eax
push 0x4db8b8
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
call fcn.00405410
cmp word [edi], 0x5b
mov dword [ebp - 4], 0
jne 0x4640da
add edi, 2
cmp word [edi], 0
jne 0x464067
xor ecx, ecx
jmp 0x46407f
mov ebx, 1
add edi, 2
jmp 0x464010
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464070
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x24]
call fcn.00405410
push 1
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x5d
push eax
lea ecx, [ebp - 0x24]
call fcn.00405630
lea ecx, [ebp - 0x24]
cmp eax, 0xffffffff
je 0x4640d0
push eax
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.0045a5a0
push eax
lea ecx, [ebp - 0x24]
call fcn.00407130
cmp dword [ebp - 0x2c], 8
jb 0x4640da
push dword [ebp - 0x40]
call fcn.004a46e7
add esp, 4
jmp 0x4640da
push 0x4db8b8
call fcn.00404450
mov ecx, dword [0x5171ec]
test ecx, ecx
jne 0x4640e9
mov ecx, 0x5171f0
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
test eax, eax
jne 0x4640f8
lea esi, [eax + 1]
jmp 0x4640fa
xor esi, esi
push 0
push str.SynTPEnhWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push 0
push 0x8023
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
je 0x464130
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x148c]
test eax, eax
jne 0x464132
lea eax, [ecx + 0x1490]
jmp 0x464132
xor eax, eax
push 0
push eax
lea ecx, [ebp - 0xabc]
call fcn.00491810
cmp dword [ebp - 0x14], 0
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 1
mov dword [ebp - 0x66c], ebx
jne 0x464161
push 1
push 0
call fcn.00497570
jmp 0x464176
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push 0
cmovae eax, dword [ebp - 0x24]
push 0
push eax
call fcn.004978c0
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 0
call fcn.00491a90
cmp dword [ebp - 0x10], 8
jb 0x464196
push dword [ebp - 0x24]
call fcn.004a46e7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8