Function at 0x40247c
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x15e8]
mov eax, 0x1668
call fcn.004059f0
mov eax, dword [0x40806c]
xor eax, ebp
mov dword [ebp + 0x15e4], eax
push ebx
push esi
push edi
push dword [0x408088]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ebx
jle 0x402582
mov edi, 0x406694
mov esi, 0x104
push 0x400
push 0x208
lea eax, [ebp + 0x1d4]
push eax
push dword [ebp - 0x28]
push dword [0x408088]
call dword [sym.imp.USER32.dll_GetMenuStringA]
lea eax, [ebp + 0x14e0]
push eax
push ebx
lea eax, [ebp + 0x1d4]
push edi
push eax
call fcn.0040112c
lea eax, [ebp + 0x13dc]
push eax
push 1
lea eax, [ebp + 0x1d4]
push edi
push eax
call fcn.0040112c
lea eax, [ebp + 0x14e0]
push esi
push eax
call fcn.004012bb
lea eax, [ebp + 0x13dc]
push esi
push eax
call fcn.004012bb
lea eax, [ebp + 0x14e0]
push eax
call fcn.004018e6
lea eax, [ebp + 0x13dc]
push eax
call fcn.004018e6
lea eax, [ebp + 0x14e0]
push eax
call fcn.0040175c
lea eax, [ebp + 0x13dc]
push eax
call fcn.0040175c
add esp, 0x40
lea eax, [ebp + 0x13dc]
push eax
lea eax, [ebp + 0x14e0]
push ebx
push eax
call fcn.00405905
add esp, 0xc
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jl 0x4024c4
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, 0x40bc60
cmp byte [0x4085b8], bl
je 0x402821
push esi
call fcn.004018e6
lea eax, [ebp + 0x3dc]
mov dword [esp], 0x4085b8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0x3dc]
push 0x1000
push eax
call fcn.004012bb
lea eax, [ebp + 0x3dc]
push eax
call fcn.004018e6
lea eax, [ebp + 0x3dc]
push 0x406690
push eax
call fcn.004011a4
add esp, 0x14
test eax, eax
jne 0x402754
lea eax, [ebp + 0x3dc]
push 0x40668c
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402754
lea eax, [ebp + 0x3dc]
push 0x406688
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402754
lea eax, [ebp + 0x3dc]
push 0x406684
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406680
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x40667c
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406678
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406674
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406670
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x40666c
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406668
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406664
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x406660
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
jne 0x402737
lea eax, [ebp + 0x3dc]
push 0x40665c
push eax
call fcn.004011a4
pop ecx
pop ecx
test eax, eax
je 0x402821
push 0xa
push esi
push ebx
lea eax, [ebp + 0x3dc]
push eax
push str.open
push dword [0x408080]
call edi
jmp 0x402821
cmp byte [ebp + 0x3dc], 0x22
je 0x40278f
lea eax, [ebp + 0x3dc]
push eax
call fcn.00401916
pop ecx
test eax, eax
jne 0x40278f
push esi
mov dword [0x40b3d8], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 5
lea eax, [ebp + 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x402821
push 0x40
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x44
call fcn.00401864
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x3dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4027f1
push ebx
push dword [0x408080]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402821
lea eax, [ebp + 0x3dc]
push eax
lea eax, [ebp - 0x24]
push str._s_could_not_be_executed.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push str.Error
lea eax, [ebp - 0x24]
push eax
push dword [0x408080]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x4086bc], ebx
je 0x402836
push 5
push ebx
push ebx
push esi
push str.explore
push ebx
call edi
mov ecx, dword [ebp + 0x15e4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004059de
add ebp, 0x15e8
leave
ret