Function at 0x40c990
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6234d7
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x6b9538]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00438670
mov esi, eax
call fcn.00401730
mov ecx, eax
test ecx, ecx
je 0x40cf40
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4e4], eax
push esi
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 1
call fcn.0040da60
test al, al
jne 0x40ca2b
push esi
lea ecx, [ebp - 0x4e4]
call fcn.0040dd00
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 3
call fcn.00438420
mov esi, dword [ebp - 0x4e4]
mov ecx, str.sysclosebutton
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ca6d
test dx, dx
je 0x40ca69
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ca6d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ca47
xor eax, eax
jmp 0x40ca72
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cef1
mov ecx, str.btn_cancel
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40caa7
test dx, dx
je 0x40caa3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40caa7
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ca81
xor eax, eax
jmp 0x40caac
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cef1
mov ecx, str.sysminbutton
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cae6
test dx, dx
je 0x40cae2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cae6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cac0
xor eax, eax
jmp 0x40caeb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cafa
push eax
push 0xf020
jmp 0x40cef8
mov ecx, str.btn_inst
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cb27
test dx, dx
je 0x40cb23
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cb27
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cb01
xor eax, eax
jmp 0x40cb2c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cc6f
mov ecx, dword [edi + 0x77c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x218]
mov ecx, dword [edi + 0x774]
push 0
mov eax, dword [ecx]
call dword [eax + 0x118]
mov ecx, dword [edi + 0x778]
test ecx, ecx
je 0x40cb68
mov eax, dword [ecx]
push 0
call dword [eax + 0x118]
push 0
mov ecx, edi
call fcn.0040c8d0
lea eax, [edi + 0x78c]
push eax
call fcn.0041b8bb
add esp, 4
test eax, eax
jne 0x40cb94
push 0x6a5850
lea ecx, [edi + 0x78c]
call fcn.004066f0
cmp dword [edi + 0x7a0], 8
lea eax, [edi + 0x78c]
jb 0x40cba5
mov eax, dword [eax]
push eax
call fcn.00406580
mov ecx, eax
call fcn.0041f332
push 0
push 0x6c4ae0
push 0x6c490c
push 0
push str.opt_startService
lea ecx, [edi + 0x30]
call fcn.0042c9e0
push eax
call fcn.00528e0f
add esp, 0x14
test eax, eax
je 0x40cbf1
mov ecx, eax
call fcn.00436d90
movzx eax, al
push eax
call fcn.00406580
mov ecx, eax
call fcn.0041f2ae
lea eax, [edi + 0x76c]
mov dword [edi + 0x7a4], 1
mov dword [ebp - 0x4dc], eax
call fcn.0040b820
lea edx, [edi + 0x76c]
lea ecx, [eax + 4]
mov dword [ebp - 0x4e0], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ecx, eax
je 0x40cc30
cmp dword [ecx], edx
je 0x40cc50
add ecx, 4
cmp ecx, eax
jne 0x40cc25
mov ecx, dword [ebp - 0x4e0]
cmp dword [ecx + 8], eax
je 0x40cc43
mov dword [eax], edx
add dword [ecx + 4], 4
jmp 0x40cc50
lea edx, [ebp - 0x4dc]
push edx
push eax
call fcn.0040e170
push 0
push 0
push edi
push 0x40c120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x7a8], eax
jmp 0x40cf04
mov ecx, str.btn_browser
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cc9c
test dx, dx
je 0x40cc98
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cc9c
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cc76
xor eax, eax
jmp 0x40cca1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ce13
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.00438670
push eax
lea ecx, [ebp - 0x4dc]
call fcn.0040d850
mov eax, dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x42a]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x454]
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x43c], eax
xor eax, eax
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x42c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x440], 0x40d930
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
mov byte [ebp - 4], 5
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x454]
test ecx, ecx
push dword [ebp - 0x18]
cmove ecx, eax
xor eax, eax
mov dword [ebp - 0x454], ecx
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40cdfd
test byte [ebp - 0x444], 1
je 0x40cdca
lea ecx, [ebp - 0x222]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40cdfa
lea eax, [ebp - 0x222]
mov ecx, edi
push eax
call fcn.0040c2e0
test eax, eax
je 0x40cdfa
mov ecx, dword [edi + 0x770]
test ecx, ecx
je 0x40cdfa
add edi, 0x78c
cmp dword [edi + 0x14], 8
jb 0x40cdf4
mov edi, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4dc]
jmp 0x40ced7
mov ecx, str.btn_ok
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ce46
test dx, dx
je 0x40ce42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ce46
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ce20
xor eax, eax
jmp 0x40ce4b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ce58
push eax
push eax
push 0x10
jmp 0x40cefd
mov ecx, str.btn_license
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ce86
test dx, dx
je 0x40ce82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ce86
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ce60
xor eax, eax
jmp 0x40ce8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cf04
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.00438670
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0040d850
push 1
push 0
push 0
push dword [ebp - 0x4e0]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x4e0]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cf04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40cf04
push 0
push 0xf060
push 0x112
mov ecx, edi
call fcn.0043bf90
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40cf23
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ea72
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040baf0
int3