Function at 0x4040d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472e99
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x108]
test eax, eax
je 0x40410b
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
jne 0x40417d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x128]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x684]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call sub.mfc90.dll_Ordinal_2591
mov esi, dword [esi + 0x20]
test eax, eax
je 0x40414e
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
push 0
push esi
push ecx
push edx
push 2
push eax
call fcn.00412900
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [esi + 0x60]
test eax, eax
je 0x404187
mov eax, dword [eax + 0x20]
cmp eax, ecx
jne 0x4041be
mov eax, dword [0x494088]
push 3
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [esi + 0x15c]
test eax, eax
je 0x4041cb
mov eax, dword [eax + 0x20]
cmp eax, ecx
jne 0x4041de
mov ecx, dword [0x494090]
push 3
push 0
push 0
push ecx
jmp 0x404197
lea eax, [esi + 0xb4]
test eax, eax
je 0x4041eb
mov eax, dword [eax + 0x20]
cmp eax, ecx
jne 0x4041f6
call fcn.00404b80
jmp 0x4041a4
lea eax, [esi + 0x1b0]
test eax, eax
je 0x404203
mov eax, dword [eax + 0x20]
cmp eax, ecx
jne 0x404216
mov edx, dword [0x494098]
push 1
push 0
push 0
push edx
jmp 0x404197
lea ebx, [esi + 0x300]
test ebx, ebx
jne 0x404224
xor eax, eax
jmp 0x404227
mov eax, dword [ebx + 0x20]
cmp eax, ecx
jne 0x404244
mov eax, dword [esi + 0xb68]
mov edx, dword [eax + 0x154]
lea ecx, [esi + 0xb68]
call edx
jmp 0x4041a4
lea edi, [esi + 0x354]
test edi, edi
jne 0x404252
xor eax, eax
jmp 0x404255
mov eax, dword [edi + 0x20]
cmp eax, ecx
jne 0x404298
mov eax, dword [esi + 0xb68]
mov edx, dword [eax + 0x154]
lea ecx, [esi + 0xb68]
mov byte [esi + 0xbe8], 1
call edx
push 5
mov ecx, ebx
call sub.mfc90.dll_Ordinal_6584
push 0
mov ecx, edi
call sub.mfc90.dll_Ordinal_6584
push 0
lea ecx, [esi + 0x3a8]
call sub.mfc90.dll_Ordinal_6584
jmp 0x4041a4
lea eax, [esi + 0x3fc]
test eax, eax
je 0x4042a5
mov eax, dword [eax + 0x20]
cmp eax, ecx
jne 0x404303
lea eax, [esp + 0x18]
push eax
call sub.HZDKernel.dll_public:_static_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_HZD::Kernel::Helper::CBaseHelper::BinPath_void_
add esp, 4
push eax
lea ecx, [esp + 0x18]
push ecx
mov edi, str.HZDHelper.exe
mov dword [esp + 0x48], 0
call fcn.00407810
mov edx, dword [eax]
add esp, 8
push 1
push 0
push 0x480878
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4041a4
mov eax, dword [ebp + 8]
push ecx
push eax
mov ecx, esi
call sub.mfc90.dll_Ordinal_4688
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8