Function at 0x401270
Capabilities:
Create process on windows
Delete file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x3b0
cmp eax, 0x6ab
push ebx
push ebp
push esi
push edi
jg 0x401543
je 0x401467
sub eax, 2
je 0x401447
sub eax, 0x6a8
jne 0x40154a
mov esi, dword [esp + 0x3c4]
push 0x6a9
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ebp, eax
push 0
push 0x1032
push ebp
call edi
test eax, eax
ja 0x4012eb
push 0x30
push str.Please_select_one_or_more_history_records_firstly__then_to_continue.
push esi
call sub.REDCOMM.dll_Ordinal_54
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret
push 0
push 0
push 0x1004
push ebp
call edi
xor ebx, ebx
mov dword [esp + 0x10], eax
test eax, eax
jle 0x40169b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 2
push ebx
push 0x102c
push ebp
call edi
cmp eax, 2
jne 0x40142a
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
push eax
push 0
push 0x1005
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
je 0x40142a
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40142a
lea ecx, [esp + 0x4c]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::constructor_void_]
mov eax, dword [esp + 0x68]
test eax, eax
je 0x401408
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x3c], ecx
lea edi, [esp + 0x74]
mov dword [esp + 0x40], ecx
lea edx, [esp + 0xb8]
mov dword [esp + 0x44], ecx
push str.WORDPAD.EXE
mov dword [esp + 0x4c], ecx
mov ecx, 0x11
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x7c], 0x44
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xb8]
push 0x41a140
push eax
call esi
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0xb8]
push ecx
push edx
call esi
lea eax, [esp + 0xb8]
push 0x41a13c
push eax
call esi
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xd4]
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x401420
mov edx, dword [esp + 0x34]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x4c]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::destructor_void_]
mov eax, dword [esp + 0x10]
inc ebx
cmp ebx, eax
jl 0x40130b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret
mov eax, dword [esp + 0x3c4]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret
mov esi, dword [esp + 0x3c4]
push 0x6a9
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edi, eax
push 0
push 0x1032
push edi
call ebx
test eax, eax
ja 0x4014af
push 0x30
push str.Please_select_one_or_more_history_records_firstly__then_to_continue.
push esi
call sub.REDCOMM.dll_Ordinal_54
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret
push 0x124
push str.Are_you_sure_to_delete_these_history_records_you_selected_
push esi
call sub.REDCOMM.dll_Ordinal_54
cmp eax, 7
je 0x40169b
push 0
push 0
push 0x1004
push edi
call ebx
mov esi, eax
dec esi
js 0x40169b
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 2
push esi
push 0x102c
push edi
call ebx
cmp eax, 2
jne 0x401530
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 4
push ecx
push 0
push 0x1005
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x401530
mov eax, dword [esp + 0x34]
test eax, eax
je 0x401530
push eax
call ebp
push 0
push esi
push 0x1008
push edi
call ebx
dec esi
jns 0x4014e3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret
cmp eax, 0x6ac
je 0x401557
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3b0
ret
mov edi, dword [esp + 0x3c4]
push 0x6a9
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ebx, eax
push 0
push 0x1032
push ebx
call esi
cmp eax, 1
je 0x4015a0
push 0x30
push str.Please_select_one_history_record_firstly__then_to_continue.
push edi
call sub.REDCOMM.dll_Ordinal_54
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call esi
mov ebp, eax
test ebp, ebp
jl 0x40169b
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 4
push edx
push 0
push 0x1005
push ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 0
call esi
test eax, eax
je 0x40169b
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40169b
lea ecx, [esp + 0xb8]
push ecx
push eax
call dword [sym.imp.RSCLASS.dll_int___stdcall_FUN_GetHistoryDataFileHeader_char_const___struct__HISTORYDATAFILE_HEADER__]
test eax, eax
je 0x401619
lea edx, [esp + 0xbc]
push edx
push edi
call fcn.00401f60
add esp, 8
test eax, eax
je 0x40169b
mov ecx, 0x40
mov eax, 0x20202020
lea edi, [esp + 0x2c0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xbc]
lea ecx, [esp + 0x2c0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0xb8]
mov ecx, 0x40
lea esi, [esp + 0x2c0]
lea edi, [esp + 0xbc]
push edx
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.RSCLASS.dll_int___stdcall_FUN_SetHistoryDataFileHeader_char_const___struct__HISTORYDATAFILE_HEADER__]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x4c]
push edx
push ebp
lea ecx, [esp + 0xc4]
push 0x102e
push ebx
mov dword [esp + 0x64], 0
mov dword [esp + 0x70], ecx
call esi
push ebp
push ebp
push 0x1015
push ebx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3b0
ret