Function at 0x41a137
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
add edx, 0xfffffc7b
push edi
mov edi, ecx
cmp edx, 0x11
ja case.0x419fbf.905
movzx eax, byte [edx + 0x41a1ec]
jmp dword [eax*4 + 0x41a1d4]
mov ecx, dword [0x43e0a0]
push str.About_DLNow
call fcn.00411640
push 0x400
mov ebx, eax
mov eax, dword [0x43e0b8]
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je case.0x419fbf.905
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41a034
xor ecx, ecx
mov dword [eax], 0x80c808c0
mov dword [eax + 4], 0
mov dword [eax + 0xa], ecx
mov dword [eax + 0xe], 0x780104
mov dword [eax + 0x12], ecx
test ebx, ebx
je 0x41a02d
push ebx
add eax, 0x16
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0x4194d0
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x43e0a0]
push str.Options
call fcn.00411640
push 0x400
mov ebx, eax
mov eax, dword [0x43e0b8]
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je case.0x419fbf.905
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41a0c2
xor ecx, ecx
mov dword [eax], 0x80c808c0
mov dword [eax + 4], 0
mov dword [eax + 0xa], ecx
mov dword [eax + 0xe], 0xfa00e0
mov dword [eax + 0x12], ecx
test ebx, ebx
je 0x41a0bb
push ebx
add eax, 0x16
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0x4182a0
jmp 0x41a03b
mov ebx, dword [0x43e0b8]
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je case.0x419fbf.905
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41a119
xor ecx, ecx
mov dword [eax], 0x80c808c0
push esi
mov dword [eax + 4], 0
mov dword [eax + 0xa], ecx
mov dword [eax + 0xe], 0xb4012c
mov dword [eax + 0x12], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0x417080
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x43e0ac]
test eax, eax
je case.0x419fbf.905
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x41a162
mov ecx, dword [eax + ecx*4 + 0xae8]
test ecx, ecx
je 0x41a162
call fcn.00404be0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xe0
cmp word [eax], 0
je case.0x419fbf.905
push 1
push 0
push eax
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x43e0ac]
test ebx, ebx
je case.0x419fbf.905
mov esi, dword [ebx + 0x2c]
test esi, esi
jle case.0x419fbf.905
lea edi, [ebx + 0xae8]
lea edi, [edi + esi*4]
mov eax, dword [edi - 4]
lea edi, [edi - 4]
dec esi
test eax, eax
je 0x41a1c7
mov eax, dword [eax + 0x88]
test eax, eax
je 0x41a1c7
cmp eax, 3
je 0x41a1c7
push esi
mov ecx, ebx
call fcn.004018b0
test esi, esi
jg 0x41a1a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret