Function at 0x40cf50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
cmp eax, 0x83
jne 0x40cf85
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x85
je 0x40cf7a
cmp eax, 0x86
jne 0x40cfb6
call fcn.004484d0
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x40d42f
cmp dword [ebp + 0xc], ebx
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x117
jne 0x40cfe6
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00411df0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x2c
jne 0x40d029
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x40d00d
lea ecx, [esp + 0xc]
mov esi, eax
mov eax, dword [esp + 0x14]
push ecx
call fcn.00411e60
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
jmp 0x40d014
xor ecx, ecx
mov eax, 1
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 1
jne 0x40d03c
call fcn.00414b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x10
jne 0x40d05d
lea eax, [esp + 0xc]
call fcn.00414dc0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 2
jne 0x40d06f
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [esp + 0x10], ebx
jmp 0x40d0d0
cmp eax, 0x84
jne 0x40d087
mov eax, dword [ebp + 0x10]
call fcn.00414e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 5
jne 0x40d0ac
lea edx, [esp + 0xc]
push edx
mov ebx, esi
call fcn.004150f0
cmp dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x24
jne 0x40d0fc
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0xc]
push eax
call fcn.004151e0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
jne 0x40dd72
mov esi, dword [esp + 0x14]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push edi
push edx
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x14]
lea ebx, [esp + 0x18]
call fcn.0041e3d0
test eax, eax
je 0x40dd47
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x112
jne 0x40d12f
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push 0x112
mov eax, esi
call fcn.00415290
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x464
jne 0x40d161
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
push ecx
push edx
mov edx, dword [ebp + 0x10]
push eax
mov ecx, esi
call fcn.00415400
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x465
jne 0x40d18d
mov eax, dword [ebp + 0xc]
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.004157c0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x4c8
jne 0x40d1bd
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push esi
call fcn.0041a3c0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x401
jne 0x40d1e7
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0xc]
call fcn.00417620
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x233
jne 0x40d212
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push eax
call fcn.004177a0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x47d
jne 0x40d239
lea eax, [esp + 0xc]
call fcn.00418cb0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x47e
jne 0x40d25b
cmp dword [esi + 0xde8], ebx
jne 0x40cf7a
push esi
call fcn.00418fb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x47f
jne 0x40d282
lea eax, [esp + 0xc]
call fcn.00419280
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x487
jne 0x40d2ae
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
mov edx, esi
call fcn.004192d0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x312
jne 0x40d2d5
lea eax, [esp + 0xc]
call fcn.004195e0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x590
jne 0x40d2f1
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0041d400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x20a
jne 0x40d31b
mov ecx, dword [ebp + 0xc]
lea edi, [esp + 0xc]
call fcn.00415a60
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x46e
jne 0x40d349
mov edx, dword [ebp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00415c00
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x4a
jne 0x40d373
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 0xc]
push edx
push esi
call fcn.00415fe0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x46f
jne 0x40d3a0
mov eax, dword [ebp + 0x10]
push eax
lea esi, [esp + 0x10]
mov eax, ecx
call fcn.004162d0
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0cc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x470
jne 0x40d3cf
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00419d80
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x47b
jne 0x40d3fb
mov eax, dword [ebp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call fcn.00419f00
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], ebx
je 0x40d0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x47c
jne 0x40d411
mov eax, dword [esi + 0x530]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x111
jne 0x40d0d0
mov eax, dword [ebp + 0xc]
mov ecx, 0x8002
cmp cx, ax
jne 0x40d43d
push esi
call fcn.0041bef0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8003
cmp dx, ax
jne 0x40d45c
mov ecx, esi
call fcn.0041c100
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8018
cmp cx, ax
jne 0x40d47b
mov eax, ecx
call fcn.0041c230
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8019
cmp dx, ax
jne 0x40d49a
mov eax, edx
call fcn.0041c230
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x801a
cmp cx, ax
je 0x40d466
mov edx, 0x801b
cmp dx, ax
je 0x40d485
mov ecx, 0x801c
cmp cx, ax
je 0x40d466
mov edx, 0x801d
cmp dx, ax
je 0x40d485
mov ecx, 0x801e
cmp cx, ax
je 0x40d466
mov edx, 0x801f
cmp dx, ax
je 0x40d485
mov ecx, 0x8020
cmp cx, ax
je 0x40d466
mov edx, 0x8021
cmp dx, ax
je 0x40d485
mov ecx, 0x8022
cmp cx, ax
jne 0x40d509
mov edi, esi
call fcn.004164b0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8023
cmp dx, ax
jne 0x40d547
mov eax, dword [esi + 0x548]
push eax
call fcn.0040cab0
mov ecx, dword [esi + 0x548]
push 1
push 1
call fcn.00432550
mov ecx, dword [esi + 0x548]
call fcn.004325a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8024
cmp cx, ax
jne 0x40d576
mov edx, dword [esi + 0x53c]
mov ecx, dword [edx + 0x1c]
push 1
call fcn.0042c930
mov edi, esi
call fcn.00417140
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8025
cmp cx, ax
je 0x40d561
mov edx, 0x8026
cmp dx, ax
jne 0x40d5b3
mov eax, dword [esi + 0x5a8]
push 1
push ebx
push 0x47ba34
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8027
cmp cx, ax
je 0x40d42f
mov edx, 0x8028
cmp dx, ax
jne 0x40d5d6
mov eax, dword [esi + 0x53c]
mov ecx, dword [eax + 0x18]
jmp 0x40d55a
mov ecx, 0x8029
cmp cx, ax
jne 0x40d5f5
mov eax, esi
call fcn.00417690
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x802b
cmp dx, ax
jne 0x40d614
mov eax, esi
call fcn.0041c350
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x802c
cmp cx, ax
jne 0x40d631
call fcn.00418990
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8055
cmp dx, ax
jne 0x40d652
xor ecx, ecx
mov eax, esi
call fcn.0041c3f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8056
cmp cx, ax
jne 0x40d676
mov ecx, 1
mov eax, esi
call fcn.0041c3f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8057
cmp dx, ax
jne 0x40d69a
mov ecx, 2
mov eax, esi
call fcn.0041c3f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8058
cmp cx, ax
jne 0x40d6be
mov ecx, 3
mov eax, esi
call fcn.0041c3f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8059
cmp dx, ax
jne 0x40d6df
xor ecx, ecx
mov eax, esi
call fcn.0041c460
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x805a
cmp cx, ax
jne 0x40d703
mov ecx, 1
mov eax, esi
call fcn.0041c460
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x805b
cmp dx, ax
jne 0x40d727
mov ecx, 2
mov eax, esi
call fcn.0041c460
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x805c
cmp cx, ax
jne 0x40d74b
mov ecx, 3
mov eax, esi
call fcn.0041c460
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x805d
cmp dx, ax
jne 0x40d768
call fcn.0041c4d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x805e
cmp cx, ax
jne 0x40d785
call fcn.0041c540
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x805f
cmp dx, ax
jne 0x40d7a2
call fcn.0041c590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8060
cmp cx, ax
je 0x40d42f
mov edx, 0x8061
cmp dx, ax
jne 0x40d7cd
call fcn.0041c5e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8062
cmp cx, ax
jne 0x40d7ea
call fcn.0041c620
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x80a8
cmp dx, ax
jne 0x40d807
call fcn.0041c660
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8063
cmp cx, ax
jne 0x40d826
mov eax, ecx
call fcn.0041c6a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8064
cmp dx, ax
jne 0x40d845
mov eax, edx
call fcn.0041c6a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8065
cmp cx, ax
je 0x40d811
mov edx, 0x8066
cmp dx, ax
je 0x40d830
mov ecx, 0x8067
cmp cx, ax
jne 0x40d877
push ecx
call fcn.0041c730
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8068
cmp dx, ax
jne 0x40d895
push edx
call fcn.0041c730
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8069
cmp cx, ax
jne 0x40d8b3
push ecx
call fcn.0041c730
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x806a
cmp dx, ax
jne 0x40d8cb
mov eax, dword [esi + 0x53c]
mov ecx, dword [eax + 0x30]
jmp 0x40d55a
mov ecx, 0x8071
cmp cx, ax
jne 0x40d8f1
mov esi, dword [esi + 0x510]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push esi
call eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8072
cmp cx, ax
jne 0x40d917
mov esi, dword [esi + 0x510]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
push esi
call eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8073
cmp cx, ax
jne 0x40d93d
mov esi, dword [esi + 0x510]
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
push esi
call eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8074
cmp cx, ax
jne 0x40d95b
push esi
call fcn.00416770
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8075
cmp dx, ax
jne 0x40d979
push esi
call fcn.00416970
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8076
cmp cx, ax
jne 0x40d998
mov edi, esi
call fcn.0041c900
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x808d
cmp dx, ax
jne 0x40d9b7
mov edi, esi
call fcn.0041c9c0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x808e
cmp cx, ax
jne 0x40d9d4
call fcn.0041c950
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x808f
cmp dx, ax
jne 0x40d9f3
mov edi, esi
call fcn.0041ca40
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8090
cmp cx, ax
jne 0x40da12
mov eax, esi
call fcn.0041cb20
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8091
cmp dx, ax
jne 0x40da31
mov eax, esi
call fcn.0041cb50
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8092
cmp cx, ax
jne 0x40da4f
push esi
call fcn.0041cb80
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8093
cmp dx, ax
jne 0x40da6e
mov eax, esi
call fcn.0041ce00
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8094
cmp cx, ax
jne 0x40da8d
mov eax, esi
call fcn.0041ce90
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8095
cmp dx, ax
jne 0x40daac
mov edi, esi
call fcn.0041cf20
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8096
cmp cx, ax
jne 0x40dacd
mov eax, ecx
mov ecx, esi
call fcn.0041d1e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x8097
cmp dx, ax
jne 0x40daee
mov eax, edx
mov ecx, esi
call fcn.0041d1e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8098
cmp cx, ax
je 0x40dab6
mov edx, 0x8099
cmp dx, ax
je 0x40dad7
mov ecx, 0x809a
cmp cx, ax
jne 0x40db2c
mov edx, dword [esi + 0x4ac]
push ebx
push ebx
push ebx
push edx
lea ecx, [esi + 0x78]
call fcn.004356b0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x809b
cmp cx, ax
jne 0x40db72
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40db59
mov eax, dword [esi + 4]
push ebx
push 0xf120
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 1
mov ecx, esi
call fcn.00432550
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x809d
cmp cx, ax
jne 0x40db9f
push 1
push ebx
push ebx
push 0x47cfa4
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x809e
cmp dx, ax
je 0x40d5cb
mov ecx, 0x80ae
cmp cx, ax
jne 0x40dbda
push 1
push ebx
push ebx
push str.http:__www.ttkvod.com_help.html
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x80af
cmp dx, ax
jne 0x40dc07
push 1
push ebx
push ebx
push str.http:__bbs.ttkvod.com
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x80a0
cmp cx, ax
jne 0x40dc28
xor eax, eax
mov ecx, esi
call fcn.0041d250
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x80a1
cmp dx, ax
jne 0x40dc4c
mov eax, 1
mov ecx, esi
call fcn.0041d250
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x80a2
cmp cx, ax
jne 0x40dc70
mov eax, 2
mov ecx, esi
call fcn.0041d250
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x80a3
cmp dx, ax
jne 0x40dc94
mov eax, 3
mov ecx, esi
call fcn.0041d250
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x80a4
cmp cx, ax
jne 0x40dcb8
mov eax, 4
mov ecx, esi
call fcn.0041d250
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x80a5
cmp dx, ax
jne 0x40dcdc
mov eax, 5
mov ecx, esi
call fcn.0041d250
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x80a6
cmp cx, ax
jne 0x40dcf9
call fcn.0041d350
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x80a7
cmp dx, ax
jne 0x40dd11
mov eax, dword [esi + 0x53c]
mov ecx, dword [eax + 0x2c]
jmp 0x40d55a
mov ecx, 0x80b5
cmp cx, ax
jne 0x40d0d0
mov ecx, dword [esi + 0x54c]
call fcn.004325a0
mov ecx, dword [esi + 0x54c]
push 1
push 1
call fcn.00432550
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push ecx
lea ecx, [esi + 0x78]
call fcn.00436ec0
test al, al
jne 0x40d0ef
mov edx, dword [ebp + 8]
push edi
push ebx
push edx
mov ecx, esi
call fcn.00432900
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc