Function at 0x406de4
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
cmp dword [0x425968], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x406dff
push 0x18
jmp 0x406e01
push 0x17
call fcn.004031bf
pop ecx
push eax
lea eax, [ebp - 0x830]
push eax
call sub.MSVCRT.dll_wcscpy
push dword [0x40f1e8]
lea eax, [ebp - 0xa30]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa30]
push str._FAQ
push eax
call sub.MSVCRT.dll_wcscat
push dword [0x40f1e8]
lea eax, [ebp - 0xc30]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xc30]
push 0x416438
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x630]
push eax
call sub.MSVCRT.dll_wcscpy
mov esi, 0x416434
lea eax, [ebp - 0x630]
push esi
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x630]
push str.faq_
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x40
push dword [0x40f1e8]
lea eax, [ebp - 0x630]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x630]
push str.faq0
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x430]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x430]
push esi
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x430]
push 0x416404
push eax
call sub.MSVCRT.dll_wcscat
push dword [0x40f1e8]
lea eax, [ebp - 0x430]
push eax
call sub.MSVCRT.dll_wcscat
push 0x16
call fcn.004031bf
add esp, 0x34
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [0x425968], 0
pop ecx
pop ecx
je 0x406f45
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x416400
lea eax, [ebp - 0x230]
push eax
call esi
push 0x4163fc
lea eax, [ebp - 0x230]
push eax
call esi
push 0x4163f8
jmp 0x406f5e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4163f4
lea eax, [ebp - 0x230]
push eax
call esi
push str.edmoc
lea eax, [ebp - 0x230]
push eax
call esi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [ebp - 0x230]
push ecx
push 1
mov edi, 0x400
push edi
push eax
mov dword [ebp - 4], eax
call esi
push 0
push 0
push 0xc00
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xa30]
push eax
push 2
push edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc30]
push eax
push 3
push edi
push dword [ebp - 4]
call esi
push 0x3f5
push dword [ebx + 0x824]
lea eax, [ebp - 0x30]
push eax
call fcn.004047f5
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x824]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x3f5
mov edi, 0x403
push edi
push dword [ebx + 0x824]
call esi
push 0
push dword [ebx + 0x830]
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x100
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0x3f5
push edi
push dword [ebx + 0x824]
mov dword [ebp - 8], eax
call esi
mov eax, dword [ebp - 8]
cmp eax, 1
jne 0x407062
push 5
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x830]
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4071e8
cmp eax, 2
jne 0x407075
push 5
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x630]
jmp 0x407050
cmp eax, 3
jne 0x4070e1
xor esi, esi
cmp dword [0x425968], esi
jne 0x4070a6
push str._Danke
lea ecx, [ebp - 8]
call fcn.004010d3
push dword [eax]
lea eax, [ebp - 0x430]
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea ecx, [ebp - 8]
jmp 0x4070c6
push str._Thanks
lea ecx, [ebp - 8]
call fcn.004010d3
push dword [eax]
lea eax, [ebp - 0x430]
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea ecx, [ebp - 8]
call fcn.00401911
push 5
push esi
push esi
lea eax, [ebp - 0x430]
push eax
push str.open
push esi
jmp 0x407057
cmp eax, 5
jne 0x40712a
push 0xf1
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push 0xf0
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push ecx
mov ecx, esp
push 0x42619c
call fcn.00401075
push dword [ebx + 0x830]
call fcn.0040b7cb
add esp, 0x10
jmp 0x4071e8
cmp eax, 6
jne 0x4071e8
lea ecx, [ebp - 4]
call fcn.0040102a
mov esi, 0x104
push esi
lea ecx, [ebp - 4]
call fcn.00401863
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.004018df
push dword [0x40f1e8]
lea ecx, [ebp - 4]
call fcn.00401221
push str..zip
lea ecx, [ebp - 4]
call fcn.00401221
push 0
push 0
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.00401036
call fcn.0040bc2d
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.00401036
push 0xf1
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push 0xf0
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push ecx
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.00401036
push dword [ebx + 0x830]
call fcn.0040b7cb
add esp, 0x10
lea ecx, [ebp - 8]
call fcn.00401911
lea ecx, [ebp - 4]
call fcn.00401911
pop edi
pop esi
pop ebx
leave
ret