Function at 0x40a121
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1054
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x104c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x297f
jg 0x40a0c2
je 0x40a083
add ecx, 0xffffd8e3
cmp ecx, 0x36
ja case.default.0x40a0d1
movzx eax, byte [ecx + 0x40a360]
jmp dword [eax*4 + 0x40a308]
push 7
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.default.0x40a0d1
push 8
jmp 0x409aed
push 9
jmp 0x409aed
xor ecx, ecx
call fcn.004772d0
jmp case.default.0x40a0d1
mov eax, dword [0x4dde8c]
cmp eax, 1
jne 0x409b45
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40a0d1
cmp eax, 0x3b2
jl 0x409b53
cmp eax, 0x3b4
jle 0x409b71
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor ecx, ecx
call fcn.00402c50
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x402d40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40a0d1
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0x20
push 0
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x58]
push 0x400
push eax
push 0x272f
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 0x58], 0
je 0x409be8
mov dword [esp + 0x20], 0
jmp 0x40a1a5
mov edx, 0x4ade2c
mov ecx, 0x4ad090
call fcn.00477440
push eax
lea eax, [esp + 0x85c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ade34
lea eax, [esp + 0x858]
mov ecx, 0x4ad090
push 0x30
push eax
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x40a0d1
mov eax, dword [0x4dde8c]
cmp eax, 1
je 0x409b22
cmp eax, 0x3b2
jl 0x409c4d
cmp eax, 0x3b4
jle 0x409c6b
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor ecx, ecx
call fcn.00402c50
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x4072f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.default.0x40a0d1
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
jmp case.default.0x40a0d1
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
push 0x4ded80
push 0
push 0x4ad350
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x409cd9
push 0x4ad0e0
jmp 0x409cde
push 0x4ad0a4
push 0x4ad350
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.default.0x40a0d1
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
mov edx, 0x4ade3c
mov ecx, 0x4ad090
call fcn.00477440
lea edx, [esp + 0x858]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.default.0x40a0d1
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0x31
push 0
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x858]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0xa
push 0xa
lea eax, [esp + 0x860]
push eax
push 0
push 0
push 0x1004
push 0x274c
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.0048f70e
add esp, 0x10
lea eax, [esp + 0x58]
push 0x4ded80
push eax
lea eax, [esp + 0x860]
push eax
push str.UNINSTALLFOLDERS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.00403330
jmp case.default.0x40a0d1
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
mov edx, str.UNINSTALLFOLDERS
mov ecx, 0x274c
call fcn.00401380
jmp case.default.0x40a0d1
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
push 0
push 0x401200
push dword [0x4def88]
push 0x4ade44
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40a0d1
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
mov edx, 0x4ad0a8
mov ecx, 0x2751
call fcn.00401380
jmp case.default.0x40a0d1
call fcn.004098c0
jmp case.default.0x40a0d1
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x1073
push 0x2745
push dword [0x4def88]
mov dword [esp + 0x40], 0x400
call edi
push eax
call esi
cmp word [esp + 0x58], 0
jne 0x409ed9
mov edx, 0x4ad0cc
mov ecx, 0x4ad090
call fcn.00477440
push eax
lea eax, [esp + 0x85c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad9c4
jmp 0x409c0b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x4ade88
mov ecx, 0x4ad090
mov ebp, eax
call fcn.00477440
mov ebx, dword [sym.imp.USER32.dll_AppendMenuW]
push eax
push 0x2984
push 0
push ebp
call ebx
mov edi, dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
push 0x755a
push dword [0x4deb64]
call edi
mov esi, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x2984
push ebp
call esi
mov edx, 0x4ade90
mov ecx, 0x4ad090
call fcn.00477440
push eax
push 0x2982
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [0x4deb64]
call edi
push eax
push 0
push 0x2982
push ebp
call esi
mov edx, 0x4ade98
mov ecx, 0x4ad090
call fcn.00477440
push eax
push 0x2983
push 0
push ebp
call ebx
push 0
push 0x7549
push dword [0x4deb64]
call edi
push eax
push 0
push 0x2983
push ebp
call esi
push 0
push 0
push 0x800
push ebp
call ebx
mov edx, 0x4ad8c0
mov ecx, str.MAINMENU
call fcn.00477440
push eax
push 0x7540
push 0
push ebp
call ebx
push 0
push 0x7540
push dword [0x4deb64]
call edi
push eax
push 0
push 0x7540
push ebp
call esi
cmp dword [0x4de950], 0
jne 0x409fe4
mov edx, str.View
mov ecx, ebp
call fcn.00461b10
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push dword [0x4def88]
push 0
push dword [esp + 0x60]
push dword [esp + 0x60]
push 2
push ebp
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebp
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, esi
jmp 0x40a2ed
call fcn.00408140
jmp case.default.0x40a0d1
call fcn.00407a10
jmp case.default.0x40a0d1
mov edx, 0x4cd5d0
mov ecx, 0x2740
call fcn.00407f20
jmp case.default.0x40a0d1
mov edx, 0x4cddd0
mov ecx, 0x2745
call fcn.00407f20
jmp case.default.0x40a0d1
call fcn.00409530
jmp case.default.0x40a0d1
push 0
push 0x408530
push dword [0x4def88]
push str.CUNINST
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x40a0d1
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x297f
push dword [0x4def88]
mov dword [0x4c5184], 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x272c
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40a0d1
add ecx, 0xffffd680
cmp ecx, 4
ja case.default.0x40a0d1
jmp dword [ecx*4 + 0x40a398]
call fcn.00402fb0
jmp case.default.0x40a0d1
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x2980
push dword [0x4def88]
mov dword [0x4c4974], 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x272e
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40a0d1
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
mov dword [esp + 0x30], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x2745
push dword [0x4def88]
call edi
push eax
call esi
mov dword [esp + 0x20], str.properties
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4c1440]
push eax
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x18], 0x3c
movups xmmword [esp + 0x2c], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x40a0d1
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2745
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
mov dword [esp + 0x30], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x2745
push dword [0x4def88]
call edi
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], str.notepad.exe
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x40a0d1
mov ecx, 0x2745
call fcn.00475ce0
mov eax, 1
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x1054
ret