Function at 0x4051d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ebp + 0x1c], 0
push esi
push edi
mov esi, ecx
jne 0x405256
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x405201
mov edi, esi
call fcn.00405880
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x40521d
call fcn.00405b80
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x14
jne 0x405238
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 2
jne 0x405260
mov ecx, dword [esi + 4]
push 0
push 0
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x116
je 0x405222
cmp eax, 0x201
jne 0x405288
mov eax, dword [ebp + 0x14]
call fcn.00406b60
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x202
jne 0x4052c8
or eax, 0xffffffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x200
jne 0x405303
cmp dword [esi + 0x24], 0xffffffff
je 0x4052ef
mov edi, dword [ebp + 0x14]
call fcn.00406b90
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x2a3
je 0x4052b2
cmp eax, 0x215
jne 0x40534c
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 4]
je 0x405336
or eax, 0xffffffff
push 0x7f00
push 0
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x111
jne 0x405256
mov eax, dword [ebp + 0x10]
cmp ax, 0x65
jne 0x405392
shr eax, 0x10
test ax, ax
jne 0x405256
mov edx, dword [esi + 4]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ax, 0x66
jne 0x4053ca
shr eax, 0x10
test ax, ax
jne 0x405256
push 0
push 0
mov ecx, str.WipeDriveWizard.exe
mov edi, esi
call fcn.00406be0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ax, 0x67
jne 0x405408
shr eax, 0x10
test ax, ax
jne 0x405256
push str.WipeDrive_SystemSaver_X64.exe
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsSystemSaver.exe
mov ecx, str.WipeDrive_SystemSaver.exe
mov edi, esi
call fcn.00406be0
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ax, 0x68
jne 0x405443
shr eax, 0x10
test ax, ax
jne 0x405256
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsMediaWiper.exe
mov ecx, str.MediaWiper.exe
mov edi, esi
call fcn.00406be0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ax, 0x69
jne 0x405482
shr eax, 0x10
test ax, ax
jne 0x405256
push 1
push 0
push 0
add esi, 0x34
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 0x18]
pop edi
mov dword [ecx], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ax, 0x6a
jne 0x405256
shr eax, 0x10
test ax, ax
jne 0x405256
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsActiveClean.exe
mov ecx, str.ActiveClean_Setup.exe
jmp 0x4053eb