Function at 0x403020
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
sub esp, 0x318
push ebx
push ebp
push esi
push edi
push 0x414
call fcn.004104c0
xor esi, esi
add esp, 4
cmp eax, esi
je 0x403060
mov word [eax + 0x410], si
mov word [eax + 0x412], si
mov byte [eax], 0
mov byte [eax + 0x104], 0
mov byte [eax + 0x208], 0
mov ebp, eax
jmp 0x403062
xor ebp, ebp
mov ebx, dword [esp + 0x334]
mov eax, dword [esp + 0x330]
push ebx
push eax
push ebp
mov dword [0x41f5cc], esi
call fcn.00402f30
add esp, 0xc
test eax, eax
je 0x4033e2
mov eax, dword [esp + 0x338]
mov dword [esp + 0x14], 1
cmp eax, esi
jne 0x403227
cmp word [ebp + 0x410], si
je 0x403227
cmp word [ebp + 0x412], si
je 0x403227
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [ebp + 0x104]
push ecx
call edi
lea edx, [ebp + 0x208]
mov esi, eax
push edx
mov dword [esp + 0x1c], esi
call edi
mov edi, eax
mov dword [0x41f5c4], 0
test si, si
mov dword [esp + 0x10], edi
je 0x403116
test di, di
je 0x403116
and eax, 0xffff
mov ecx, esi
shl eax, 0x10
and ecx, 0xffff
or eax, ecx
push eax
push ebx
push 0x3e0
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x41f5c4]
test eax, eax
je 0x403211
mov edx, dword [esp + 0x32c]
lea eax, [esp + 0x120]
push edx
push 0x41a2b4
push eax
mov dword [esp + 0x20], 0
call fcn.00410970
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xa
push ecx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40320d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [esp + 0x334]
mov ecx, dword [0x41f5c8]
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push edi
push 0x3e8
push ecx
call esi
mov edx, dword [0x41f5c8]
push 0
push edi
push 0x3e1
push edx
call esi
mov eax, dword [0x41f5c8]
push 0x43
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x41f5c8]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
test ebp, ebp
je 0x403207
push ebp
call fcn.004104d0
add esp, 4
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
test si, si
je 0x40321f
push esi
call ebx
test di, di
je 0x403227
push edi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4033c8
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x14
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x334]
push ecx
call fcn.00402f00
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x32c]
mov ecx, ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x124]
push ecx
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x120]
push eax
call fcn.00403430
add esp, 4
lea ecx, [esp + 0x120]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
mov dword [0x41f5cc], eax
jg 0x4033b2
test eax, eax
je 0x40341c
mov edx, dword [esp + 0x334]
mov eax, dword [esp + 0x330]
push edx
push eax
push ebp
call fcn.00402d90
add esp, 0xc
test eax, eax
je 0x4033ff
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x14
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x334]
push ecx
call fcn.00402f00
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x32c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x120]
push eax
call fcn.00403430
add esp, 4
lea ecx, [esp + 0x120]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
mov dword [0x41f5cc], eax
jle 0x4032e1
push str.mmates.ini
push ebp
push str.browser
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test ebp, ebp
je 0x4033d5
push ebp
call fcn.004104d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
cmp ebp, esi
je 0x4033ef
push ebp
call fcn.004104d0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
test ebp, ebp
je 0x40340c
push ebp
call fcn.004104d0
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x318
ret