Function at 0x402ffa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push str..exe_..
lea ecx, [ebp - 4]
push dword [0x41ace4]
mov edi, eax
call fcn.0040108c
push eax
lea eax, [ebp - 8]
push eax
call fcn.00405d9c
push dword [eax]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
xor ebx, ebx
push 0xac53
push ebx
push edi
call esi
lea ecx, [ebp - 8]
call fcn.00401a9f
lea ecx, [ebp - 4]
call fcn.00401a9f
push str..ini_..
lea ecx, [ebp - 8]
push dword [0x41ace4]
call fcn.0040108c
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push dword [eax]
push 0xac54
push ebx
push edi
call esi
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 8]
call fcn.00401a9f
push str..ini
lea ecx, [ebp - 8]
push dword [0x41ace4]
call fcn.0040108c
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push dword [eax]
push 0xac55
push ebx
push edi
call esi
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 8]
call fcn.00401a9f
push ebx
push ebx
push 0xc00
push edi
call esi
push 0xcc
call fcn.0040a18d
pop ecx
push eax
push 0xac52
push 0x400
push edi
call esi
push str._____________________________________
lea ecx, [ebp - 4]
call fcn.0040108c
push dword [eax]
push ebx
push 0x403
push edi
call esi
lea ecx, [ebp - 4]
call fcn.00401a9f
push ebx
push 0x4163
call fcn.00402f9b
pop ecx
pop ecx
push ebx
push eax
call fcn.00402ec7
mov esi, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
pop ecx
push eax
push ebx
push 0xac52
push edi
call esi
push ebx
push 4
call fcn.00402f9b
pop ecx
mov dword [ebp - 4], eax
pop ecx
push ebx
push eax
call fcn.00402ec7
pop ecx
push eax
push ebx
push 0xac53
push edi
call esi
push ebx
push dword [ebp - 4]
call fcn.00402ec7
pop ecx
push eax
push ebx
push 0xac54
push edi
call esi
push ebx
push 0x97
call fcn.00402f9b
pop ecx
pop ecx
push ebx
push eax
call fcn.00402ec7
pop ecx
push eax
push ebx
push 0xac55
push edi
call esi
push 0x3f8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00401000
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x18]
call fcn.0040103d
mov ecx, eax
push ebx
push dword [ebp + 8]
mov eax, dword [ecx]
push ebx
mov ecx, dword [ecx + 4]
push ecx
push eax
push 0x108
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp eax, 0xac52
jne 0x403259
lea eax, [ebp - 0x158]
push 0x104
push eax
push dword [0x42b380]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x158]
lea ecx, [ebp - 8]
push eax
mov dword [ebp - 0x54], 0x3c
call fcn.0040108c
push ebx
lea ecx, [ebp - 8]
mov dword [ebp - 0x50], ebx
call fcn.004019f3
mov esi, 0x41e164
lea ecx, [ebp + 8]
push esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x38], 1
call fcn.0040108c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40324c
push 0xfefe
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp + 8]
call fcn.00401a9f
lea ecx, [ebp - 8]
jmp 0x4032d5
cmp eax, 0xac55
jne 0x403277
push 5
push ebx
push ebx
push 0x42dc2c
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4032da
cmp eax, 0xac53
jne 0x4032a0
lea eax, [ebp + 8]
push eax
call fcn.0040bbaa
pop ecx
push 5
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp + 8]
jmp 0x4032d5
cmp eax, 0xac54
jne 0x4032da
push ecx
mov ecx, esp
push 0x42dc2c
call fcn.0040108c
lea eax, [ebp + 8]
push eax
call fcn.0040bc6e
pop ecx
pop ecx
push 5
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp + 8]
call fcn.00401a9f
pop edi
pop esi
pop ebx
leave
ret