Function at 0x403940
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45c4e9
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x472940]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x472940]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, ecx
push str.windowinit
mov ecx, edi
call fcn.0040cfe0
test al, al
je 0x4039a2
lea ecx, [esi - 0x10]
call fcn.004034c0
jmp 0x403e37
push str.click
mov ecx, edi
call fcn.0040cfe0
test al, al
je 0x403dd4
mov ecx, dword [edi + 0x88]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x1c]
push edx
call eax
push str.closeBtn
mov ecx, eax
mov dword [esp + 0x1c4], 0
call fcn.0040cfe0
lea ecx, [esp + 0x1c]
mov bl, al
mov dword [esp + 0x1c0], 0xffffffff
call fcn.0040cc32
test bl, bl
je 0x403a26
mov esi, dword [esi + 0x2b4]
mov edx, dword [esi]
mov eax, dword [edx + 0xc8]
mov ecx, esi
call eax
test al, al
je 0x403a19
mov dword [0x47698c], 1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x403e37
mov ecx, dword [edi + 0x88]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x1c]
push eax
call edx
push str.minimizeBtn
mov ecx, eax
mov dword [esp + 0x1c4], 1
call fcn.0040cfe0
lea ecx, [esp + 0x1c]
mov bl, al
mov dword [esp + 0x1c0], 0xffffffff
call fcn.0040cc32
test bl, bl
je 0x403a82
push 0
push 0xf020
push 0x112
lea ecx, [esi - 0x10]
call fcn.004091bd
jmp 0x403e37
mov edi, dword [edi + 0x88]
cmp edi, dword [esi + 0x278]
jne 0x403aaf
mov eax, dword [esi - 0xc]
push 1
push 0
push 0
push str.http:__www.sanguosha.com_act_yhxy_regservice.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x403e37
cmp edi, dword [esi + 0x280]
jne 0x403b67
push 0x103
lea ecx, [esp + 0xa9]
push 0
push ecx
mov byte [esp + 0xb0], 0
call fcn.00445f90
add esp, 0xc
push 0
push 0x26
lea edx, [esp + 0xac]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x14]
call fcn.004013b0
lea eax, [esp + 0x10]
mov dword [esp + 0x1c0], 2
call fcn.00401ae0
lea edi, [esi - 0x10]
lea ecx, [esp + 0x10]
call fcn.00404140
push str.Sgsc_
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00404dc0
add esp, 0xc
mov byte [esp + 0x1c0], 3
mov esi, dword [esi + 0x27c]
mov edx, dword [esi]
mov eax, dword [eax]
mov edx, dword [edx + 0x2c]
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0x14]
call fcn.00401470
lea ecx, [esp + 0x10]
call fcn.00401470
jmp 0x403e37
cmp edi, dword [esi + 0x274]
jne 0x403c4d
mov ecx, dword [esi + 0x2ac]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 0
call edx
mov ecx, dword [esi + 0x2b0]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 1
call edx
mov ecx, dword [esi + 0x2c4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 1
call edx
mov ecx, dword [esi + 0x27c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x1c]
push edx
call eax
mov ecx, eax
mov dword [esp + 0x1c0], 4
call fcn.0040cc4c
push eax
lea ecx, [esp + 0x14]
call fcn.004013b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c0], 6
call fcn.0040cc32
lea eax, [esp + 0x10]
call fcn.00401ae0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x2e0]
call fcn.004027a0
mov ecx, dword [esi + 0x2bc]
mov edx, dword [ecx]
mov eax, dword [edx + 0xcc]
push 0
call eax
call fcn.004038b0
test eax, eax
jne 0x403c27
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edi, [esi + 0x2d4]
mov ecx, edi
call fcn.00405890
mov ecx, dword [esi - 0xc]
push ecx
mov esi, edi
call fcn.00405c00
lea ecx, [esp + 0x10]
call fcn.00401470
jmp 0x403e37
cmp edi, dword [esi + 0x28c]
jne 0x403d28
mov ecx, dword [esi + 0x27c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x1c]
push eax
call edx
mov ecx, eax
mov dword [esp + 0x1c0], 7
call fcn.0040cc4c
push eax
lea ecx, [esp + 0x18]
call fcn.004013b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c0], 9
call fcn.0040cc32
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00401620
lea ebx, [esi - 0x10]
lea edi, [esp + 0x14]
mov ecx, ebx
call fcn.00403e60
mov byte [esp + 0x1c0], 0xa
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], 0
je 0x403d11
mov eax, edi
call fcn.00401ae0
mov ecx, edi
mov edi, ebx
call fcn.00404140
push str.Sgsc_
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00404dc0
add esp, 0xc
mov byte [esp + 0x1c0], 0xb
mov ecx, dword [esi + 0x27c]
mov edx, dword [ecx]
mov eax, dword [eax]
mov edx, dword [edx + 0x2c]
push eax
call edx
lea ecx, [esp + 0x18]
call fcn.00401470
lea ecx, [esp + 0x10]
call fcn.00401470
lea ecx, [esp + 0x14]
call fcn.00401470
jmp 0x403e37
cmp edi, dword [esi + 0x294]
je 0x403a19
cmp edi, dword [esi + 0x298]
jne 0x403d4d
add esi, 0x2d4
push esi
call fcn.00406890
jmp 0x403a0f
cmp edi, dword [esi + 0x284]
jne 0x403d90
mov ecx, dword [esi + 0x2bc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 1
call edx
mov ecx, dword [esi + 0x284]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 0
call edx
mov ecx, dword [esi + 0x288]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 1
call edx
jmp 0x403e37
cmp edi, dword [esi + 0x288]
jne 0x403e37
mov ecx, dword [esi + 0x2bc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 0
call edx
mov ecx, dword [esi + 0x284]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 1
call edx
mov ecx, dword [esi + 0x288]
mov eax, dword [ecx]
mov edx, dword [eax + 0xcc]
push 0
call edx
jmp 0x403e37
push str.timer
mov ecx, edi
call fcn.0040cd9f
mov ecx, eax
call fcn.0040cc4c
test eax, eax
je 0x403e37
mov ecx, dword [edi + 0x88]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x60]
push edx
call eax
push str.wheel
mov ecx, eax
mov dword [esp + 0x1c4], 0xc
call fcn.0040cfe0
lea ecx, [esp + 0x60]
mov bl, al
mov dword [esp + 0x1c0], 0xffffffff
call fcn.0040cc32
test bl, bl
je 0x403e37
add esi, 0xfffffff0
push esi
call fcn.004036b0
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00443100
mov esp, ebp
pop ebp
ret 4