Function at 0x40d6fb
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x4291b0]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
xor ebx, ebx
movzx edi, dx
mov eax, edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
mov esi, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0xc], 0x301
cmp eax, 0x300
ja 0x40e082
je 0x40e09b
cmp eax, 0x18
ja 0x40dc4d
je 0x40dc14
cmp eax, 7
ja 0x40dac5
je 0x40dabc
sub eax, 1
je 0x40daa8
sub eax, 1
je 0x40d998
sub eax, 1
je 0x40d859
sub eax, 1
je 0x40d88c
sub eax, 1
je 0x40d7c4
sub eax, 1
jne case.0x40dc68.30
inc word [0x42a936]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
xor ecx, ecx
mov edi, eax
call fcn.0042264e
push edi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
jmp 0x40e17b
mov edi, 0x429d98
jmp 0x40d7f7
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
cmp eax, 0x100b
je 0x40d7e6
cmp eax, 0x1009
je 0x40d7e6
cmp eax, 0x100c
jne 0x40d84f
call fcn.0040ca81
mov dword [0x429da4], ebx
mov dword [0x429da0], ebx
mov ecx, edi
call fcn.0040fd83
test eax, eax
je 0x40d7cb
push 0x429f70
push 0x28
pop edx
mov ecx, 0x429ed0
call fcn.0040675d
push 0x429fc0
push 0x28
pop edx
mov ecx, 0x429f20
call fcn.0040675d
mov eax, dword [esp + 0x1c]
mov dword [0x42ab7c], eax
cmp word [0x429ed0], bx
jne 0x40d841
cmp word [0x429f20], bx
je 0x40d843
mov ebx, eax
mov ecx, ebx
call fcn.00423f14
jmp 0x40e17b
call fcn.0040f881
jmp 0x40e17b
inc word [0x42a932]
mov eax, dword [0x429e18]
mov dword [0x429e14], eax
cmp dword [0x4292c0], ebx
jne 0x40d88c
push ebx
push ebx
mov edx, 0x42a8cc
call fcn.0041080c
test al, al
je 0x40d88c
call fcn.0040f3d3
jmp 0x40e17b
cmp edi, 4
jne 0x40d898
inc word [0x42a934]
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x1f], bl
call fcn.0040c12b
mov edi, 0x402028
mov edx, edi
cmp dword [0x4292c0], ebx
jne 0x40d8c3
mov edx, dword [0x42a8cc]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0040d4e6
test eax, eax
jns 0x40d90c
cmp eax, 0x800704c7
je 0x40d903
cmp dword [0x4292c0], ebx
jne 0x40d8ef
mov edi, dword [0x42a8cc]
lea edx, [esp + 0xc]
mov ecx, edi
call fcn.0040d2dd
mov byte [esp + 0x1b], 1
test eax, eax
jns 0x40d90c
mov ecx, eax
call fcn.0040f855
jmp 0x40d97a
push 0x1fa
lea eax, [esp + 0x74]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test ecx, ecx
je 0x40d946
push ecx
lea edx, [esp + 0x74]
call fcn.0042558d
test eax, eax
js 0x40d946
cmp word [esp + 0x70], bx
je 0x40d946
lea eax, [esp + 0x70]
cmp byte [esp + 0x1b], bl
je 0x40d948
mov eax, ebx
push eax
push 1
lea edx, [esp + 0x14]
call fcn.0041080c
test al, al
je 0x40d971
push dword [esp + 0xc]
mov ecx, 0x42a8cc
call fcn.0040c12b
mov dword [esp + 0xc], ebx
call fcn.0040f3d3
jmp 0x40d97a
mov ecx, dword [esp + 0xc]
call fcn.0041170b
cmp dword [esp + 0xc], ebx
je 0x40d98a
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea ecx, [esp + 0x10]
call fcn.0040a23e
jmp 0x40e17b
call fcn.0040e45f
test eax, eax
je 0x40e17b
mov eax, dword [0x429e18]
lea ecx, [esp + 0xc]
push ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
call fcn.0040c12b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
call fcn.0040d1d6
test eax, eax
jns 0x40d9e9
cmp eax, 0x800704c7
je 0x40da7e
lea ecx, [esp + 0xc]
call fcn.0040d041
test eax, eax
js 0x40da7e
mov eax, dword [0x429d8c]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov edi, dword [0x42aba0]
mov ebx, dword [0x42ab94]
mov dword [0x429d8c], eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [0x42a8cc]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
neg eax
mov ecx, 0x42a930
push edi
sbb eax, eax
and eax, dword [esp + 0x58]
push ebx
mov edx, eax
call fcn.00423b90
call fcn.0040ed99
mov ecx, eax
call fcn.00423cea
mov edx, dword [0x429e18]
lea ecx, [esp + 0xc]
push 0
call fcn.00410da5
test al, al
jne 0x40da8f
mov ecx, dword [esp + 0xc]
call fcn.0041170b
mov eax, dword [esp + 0x1c]
mov dword [0x429d8c], eax
mov eax, 0x80004005
mov ecx, dword [esp + 0x10]
mov dword [0x429e18], ecx
mov ecx, eax
call fcn.0040f855
cmp dword [esp + 0xc], esi
je 0x40e17b
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0x40e17b
inc word [0x42a930]
xor ecx, ecx
inc ecx
call fcn.004115c1
jmp 0x40e17b
push ebx
push ebx
push 0x10
jmp 0x40e174
sub eax, 8
je 0x40dba8
sub eax, 7
je 0x40e17b
sub eax, 1
je 0x40db95
sub eax, 5
je 0x40dcbc
sub eax, 1
je case.0x40dc68.29
sub eax, 1
jne case.0x40dc68.30
inc word [0x42a944]
mov eax, dword [0x42ada8]
mov dword [0x42ab74], 1
test eax, eax
je 0x40db20
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x42adb6]
xor ecx, ecx
cmp byte [0x42adb5], cl
sete cl
dec ecx
and ecx, 0x100000
add ecx, 0x50001
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
mov dword [0x429df8], ecx
call fcn.004212d9
mov edi, 0x429dec
mov dword [0x429e00], 0x42aba8
push edi
mov dword [0x429e04], 0x800080
mov dword [0x429dfc], 0x42aca8
call dword [sym.imp.COMDLG32.dll_ReplaceTextW]
test eax, eax
jne 0x40db8b
xor edx, edx
inc edx
mov ecx, edi
call fcn.00424350
mov dword [0x42ada8], eax
jmp 0x40e17b
inc word [0x42a938]
push ebx
push ebx
push 0xc7
jmp 0x40dc8a
sub esp, 0x48
mov dword [esp + 0x5c], ebx
mov ecx, esp
mov dword [esp + 0x64], ebx
lea edx, [esp + 0x64]
lea esi, [esp + 0x5c]
lea eax, [ecx + 8]
mov dword [eax], 0x40119c
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [ecx + 0x40], eax
lea ecx, [esp + 0x58]
call fcn.0040fe6b
mov edi, eax
test edi, edi
jns 0x40dbfa
mov ecx, dword [ebp + 4]
mov edx, 0x36a
push edi
push 0x4020bc
call fcn.0040750c
mov esi, dword [esp + 0x10]
jmp 0x40e17e
mov esi, dword [esp + 0x10]
push 5
push ebx
push 0x402214
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40e17b
inc word [0x42a946]
push ebx
push 0x40f920
push dword [0x42a92c]
push 0xe
push dword [0x429e8c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
jne 0x40e17b
mov ecx, dword [0x429ea0]
call fcn.0040cc2e
jmp 0x40e17b
cmp eax, 0x40
ja 0x40e03f
je 0x40e024
sub eax, 0x19
cmp eax, 0xb
ja case.0x40dc68.30
jmp dword [eax*4 + 0x40e1a3]
push 0xffffffffffffffff
push ebx
push 0xb1
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40e17b
cmp dword [0x42ab74], ebx
je 0x40dcbc
cmp word [0x42aca8], bx
je 0x40dcbc
cmp edi, 0x1d
sete dl
call fcn.004210ce
jmp 0x40e17b
mov dword [0x42ab74], 1
cmp edi, 0x15
jne 0x40dcd2
inc word [0x42a942]
mov eax, dword [0x42ada8]
test eax, eax
je 0x40dce6
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp byte [0x42adb4], cl
sete cl
xor eax, eax
cmp byte [0x42adb5], al
sete al
dec eax
and eax, 0x100000
add eax, 0x50000
or ecx, eax
movzx eax, byte [0x42adb6]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
mov dword [0x429df8], ecx
call fcn.004212d9
mov edi, 0x429dec
mov dword [0x429e00], ebx
push edi
mov dword [0x429e04], 0x80
mov dword [0x429dfc], 0x42aca8
call dword [sym.imp.COMDLG32.dll_FindTextW]
test eax, eax
jne 0x40db8b
xor edx, edx
jmp 0x40db84
xor ecx, ecx
call fcn.00410552
jmp 0x40e17b
mov ecx, dword [0x42ab94]
neg ecx
sbb ecx, ecx
and ecx, 0x100000
add ecx, 0x50200104
call fcn.00421373
test eax, eax
je 0x40dd99
xor eax, eax
cmp dword [0x42ab94], eax
sete al
mov dword [0x42ab94], eax
jmp 0x40de2d
push 0x30
push dword [0x42929c]
push dword [0x429280]
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40e17b
lea eax, [esp + 0x24]
push eax
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x42aba0], ebx
je 0x40ddfb
push ebx
push dword [0x42adb0]
mov dword [0x42aba0], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
call fcn.0040cb8b
jmp 0x40de2d
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov dword [0x42aba0], 1
call fcn.0040cb8b
call fcn.0040f022
push 5
push dword [0x42adb0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x42ab80], 1
jmp 0x40e17b
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4e0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40de67
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40de75
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
mov ecx, 0x1f4
add eax, 0xa
cmp eax, ecx
jb 0x40de8a
mov eax, ecx
push 0x64
push eax
push 0x4e1
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0040f2ba
jmp 0x40e17b
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4e0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ded3
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40dee1
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
sub eax, 0xa
cmp eax, 0xa
ja 0x40de8a
push 0xa
pop eax
jmp 0x40de8a
push 0x64
push 0x64
jmp 0x40de8d
inc word [0x42a948]
lea eax, [esp + 0x34]
push 0x3c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x40e17b
mov eax, dword [esp + 0x14]
push 0x5a
push edi
mov dword [esp + 0x3c], 0x3c
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], 0x429e30
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x2d0
push eax
push dword [0x4292c4]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
mov dword [esp + 0x48], 0x1010041
mov dword [0x429e30], eax
mov eax, 0x2000
push edi
push ebx
mov word [esp + 0x6c], ax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov ebx, eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
test edi, edi
je 0x40e17b
push dword [0x429e90]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x2d0
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
push 0x429e30
mov dword [0x429e30], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edi, eax
test edi, edi
je 0x40e009
push dword [0x429e2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 1
push edi
push 0x30
push dword [0x42adac]
mov dword [0x429e2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x44]
mov dword [0x4292c4], eax
push dword [0x429e94]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x42ab78], 1
jmp 0x40e17b
push 1
push ebx
push ebx
push 0x402138
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00423ebc
jmp 0x40e17b
sub eax, 0x41
je 0x40e057
sub eax, 1
jne case.0x40dc68.30
push 1
push ebx
push ebx
push 0x4020e8
jmp 0x40dc07
push 2
push dword [0x429d88]
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x402214
push dword [0x42929c]
push dword [0x42a92c]
call dword [sym.imp.SHELL32.dll_ShellAboutW]
jmp 0x40e17b
mov ecx, dword [esp + 0xc]
sub eax, ecx
je 0x40e09f
sub eax, 1
je 0x40e106
sub eax, 1
je 0x40e09f
mov edi, ebx
jmp 0x40e17e
mov ecx, dword [esp + 0xc]
mov eax, 0x300
cmp di, ax
jne 0x40e0b2
inc word [0x42a93a]
jmp 0x40e0c7
cmp di, cx
jne 0x40e0c0
inc word [0x42a93c]
jmp 0x40e0c7
inc word [0x42a940]
lea eax, [esp + 0x10]
mov dword [esp + 0x14], ebx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ebx
push eax
push 0xb0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x40e17b
mov edx, dword [esp + 0x20]
cmp edi, 0x1c
jne 0x40e106
mov edx, 0x150f
movzx edi, dx
mov eax, 0x302
cmp di, ax
jne 0x40e159
inc word [0x42a93e]
cmp dword [0x42ab70], ebx
jne 0x40e159
push 0x1fa
lea eax, [esp + 0x74]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.00425661
test eax, eax
js 0x40e159
cmp word [esp + 0x70], bx
je 0x40e159
lea ecx, [esp + 0x70]
call fcn.0040fcbf
inc word [0x42a94e]
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [0x42adac]
cmp eax, ecx
je 0x40e171
cmp eax, dword [0x42a92c]
jne 0x40e17b
push ebx
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
inc edi
test esi, esi
je 0x40e189
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x274]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00426d60
mov esp, ebp
pop ebp
ret 4