Function at 0x401c10
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
mov eax, dword [0x412464]
sub esp, 0x104
test eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
je 0x4011dd
mov ecx, dword [0x412818]
dec eax
mov dword [0x412464], eax
mov edx, dword [ecx + eax*4]
push edx
call fcn.004010c0
mov eax, dword [0x412818]
mov ecx, dword [0x412464]
add esp, 4
mov edx, dword [eax + ecx*4]
push edx
call esi
push eax
call edi
mov eax, dword [0x412464]
mov ecx, dword [0x412818]
mov edx, dword [ecx + eax*4]
push edx
call esi
push eax
call ebx
mov eax, dword [0x412464]
test eax, eax
jne 0x401194
mov eax, dword [0x412818]
test eax, eax
je 0x401201
push eax
call esi
push eax
call edi
mov eax, dword [0x412818]
push eax
call esi
push eax
call ebx
mov dword [0x412818], 0
mov eax, dword [0x41281c]
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40120c
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x40f0a0]
repne scasb al, byte es:[edi]
mov ecx, dword [str.proshow.phd]
mov eax, dword [0x40f0a4]
dec edi
mov dword [edi], ecx
lea ecx, [esp + 0xc]
push ecx
mov dword [edi + 4], edx
mov dword [edi + 8], eax
call fcn.004010c0
mov eax, dword [0x41281c]
lea edx, [esp + 0x10]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401253
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str.assoc.cfg]
repne scasb al, byte es:[edi]
mov eax, dword [0x40f0ac]
mov cx, word [0x40f0b0]
dec edi
mov dword [edi], edx
lea edx, [esp + 0xc]
push edx
mov dword [edi + 4], eax
mov word [edi + 8], cx
call fcn.004010c0
mov eax, dword [0x41281c]
lea edx, [esp + 0x10]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40129c
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x40f0bc]
repne scasb al, byte es:[edi]
mov eax, dword [str.proshow.opt]
mov ecx, dword [0x40f0b8]
dec edi
mov dword [edi], eax
lea eax, [esp + 0xc]
push eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
call fcn.004010c0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 4
xor esi, esi
mov ecx, dword [0x41281c]
push esi
push ecx
lea edx, [esp + 0x14]
push str._sdeleteme._d
push edx
call edi
lea eax, [esp + 0x1c]
push eax
call fcn.004010c0
add esp, 0x14
test eax, eax
jne 0x40130e
inc esi
cmp esi, 0x186a0
jl 0x4012e0
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov eax, dword [0x41281c]
lea edx, [esp - 0x208]
sub esp, 0x228
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401c24
mov eax, dword [0x40f030]
push ebx
mov ebx, dword [0x412438]
push ebp
lea ecx, [eax + eax*2]
push esi
push edi
lea edx, [esp + 0x30]
lea ecx, [ecx + ecx*4]
lea edi, [ecx + ecx*8]
or ecx, 0xffffffff
add edi, edi
sub edi, eax
xor eax, eax
add edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [esp + eax + 0x30]
mov byte [esp + eax + 0x134], cl
inc eax
test cl, cl
jne 0x401c75
or ecx, 0xffffffff
lea edi, [esp + 0x30]
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
mov eax, dword [str.__stub]
mov ecx, dword [0x40f0dc]
dec edi
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ecx
mov edi, dword [0x412814]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x30]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x40f0e0]
mov cl, byte [0x40f0e2]
dec edi
mov word [edi], ax
xor eax, eax
mov byte [edi + 2], cl
mov edi, dword [esp + 0x240]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x40f0e4]
mov word [edi - 1], ax
call fcn.00401b60
mov ecx, dword [0x412820]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
mov ebp, dword [esp + 0x23c]
push 0
push 0x412450
push ebp
mov dword [0x412820], 0xffffffff
mov dword [0x41244c], 0xfffffffe
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebp
call dword [sym.imp.USER32.dll_UpdateWindow]
lea edx, [esp + 0x30]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [esp + 0x134]
push 0x401b10
mov dword [0x412810], eax
push 0x1f4
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebp
je 0x401dc7
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call esi
test eax, eax
je 0x401e02
cmp dword [esp + 0x18], 0x12
je 0x401e0a
lea edx, [esp + 0x14]
push edx
call edi
lea eax, [esp + 0x14]
push eax
call ebx
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call esi
test eax, eax
jne 0x401dda
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x401db4
mov edx, dword [esp + 0x10]
mov byte [0x40f03a], 0
push edx
push 0
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x228
jmp 0x401170