Function at 0x406961
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413247
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x85c
mov dword [ebp - 0x84c], ecx
mov eax, dword [ebp + 8]
and eax, 0xffff
cmp eax, 0x1800
jl 0x4069ce
mov ecx, dword [ebp + 8]
and ecx, 0xffff
sub ecx, 0x1800
cmp ecx, 0x400
jge 0x4069ce
mov edx, dword [ebp + 8]
and edx, 0xffff
sub edx, 0x1800
push edx
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0x60]
call fcn.0040b3ab
jmp case.0x406a0a.14
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov dword [ebp - 0x850], ecx
mov edx, dword [ebp - 0x850]
sub edx, 0x9c45
mov dword [ebp - 0x850], edx
cmp dword [ebp - 0x850], 0x18
ja case.0x406a0a.14
mov ecx, dword [ebp - 0x850]
xor eax, eax
mov al, byte [ecx + 0x407203]
jmp dword [eax*4 + 0x4071c7]
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0xb0]
xor eax, 0x100
mov ecx, dword [ebp - 0x84c]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0xb0]
and eax, 0x100
test eax, eax
je 0x406a55
push 1
mov ecx, dword [ebp - 0x84c]
add ecx, 0x64
call fcn.00411667
jmp 0x406a65
push 0
mov ecx, dword [ebp - 0x84c]
add ecx, 0x64
call fcn.00411667
mov ecx, dword [ebp - 0x84c]
call fcn.00407e7e
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb0]
and edx, 1
test edx, edx
je 0x406aa5
push 3
push 0
push 0
push 0
push 0
mov eax, dword [sym.imp.MFC42u.DLL_CWndconstCWnd::wndNoTopMost]
push eax
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::SetWindowPos
jmp 0x406ac1
push 3
push 0
push 0
push 0
push 0
mov ecx, dword [sym.imp.MFC42u.DLL_CWndconstCWnd::wndTopMost]
push ecx
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::SetWindowPos
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0xb0]
xor eax, 1
mov ecx, dword [ebp - 0x84c]
mov dword [ecx + 0xb0], eax
mov ecx, dword [ebp - 0x84c]
call fcn.00407e7e
jmp case.0x406a0a.14
mov edx, dword [ebp - 0x84c]
cmp dword [edx + 0xa8], 0
jne 0x406b9a
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [ebp - 0x828], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x828], 0
je 0x406b32
mov ecx, dword [ebp - 0x828]
call fcn.004105e0
mov dword [ebp - 0x854], eax
jmp 0x406b3c
mov dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x824], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ebp - 0x824]
mov dword [ecx + 0xa8], edx
call fcn.004041a0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x138]
push ecx
push 2
push 0x41f
push 0x89
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0x20]
push eax
mov ecx, dword [ebp - 0x84c]
mov ecx, dword [ecx + 0xa8]
call fcn.0041061d
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0xb0]
and eax, 0x10
test eax, eax
je 0x406bbc
push 6
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
jmp 0x406bc9
push 0
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb0]
xor edx, 8
mov eax, dword [ebp - 0x84c]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb0]
and edx, 8
test edx, edx
je 0x406cb0
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0xa8], 0
jne 0x406cae
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [ebp - 0x830], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x830], 0
je 0x406c46
mov ecx, dword [ebp - 0x830]
call fcn.004105e0
mov dword [ebp - 0x858], eax
jmp 0x406c50
mov dword [ebp - 0x858], 0
mov ecx, dword [ebp - 0x858]
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x84c]
mov eax, dword [ebp - 0x82c]
mov dword [edx + 0xa8], eax
call fcn.004041a0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x138]
push edx
push 2
push 0x41f
push 0x89
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp - 0x84c]
mov ecx, dword [edx + 0xa8]
call fcn.0041061d
jmp 0x406d1a
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0xa8], 0
je 0x406d1a
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xa8]
mov dword [ebp - 0x838], edx
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x406d00
push 1
mov ecx, dword [ebp - 0x834]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x834]
call dword [edx]
mov dword [ebp - 0x85c], eax
jmp 0x406d0a
mov dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x84c]
mov dword [eax + 0xa8], 0
mov ecx, dword [ebp - 0x84c]
call fcn.00407e7e
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb0]
xor edx, 0x10
mov eax, dword [ebp - 0x84c]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb0]
and edx, 0x10
test edx, edx
je 0x406d88
push 0
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
push 0
push 0
push 0x80
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ModifyStyleEx
push 5
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
jmp 0x406db6
push 0
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
push 0
push 0x80
push 0
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ModifyStyleEx
push 5
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
mov ecx, dword [ebp - 0x84c]
call fcn.00407e7e
jmp case.0x406a0a.14
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0xb0]
xor ecx, 0x20
mov edx, dword [ebp - 0x84c]
mov dword [edx + 0xb0], ecx
mov ecx, dword [ebp - 0x84c]
call fcn.00407e7e
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
call fcn.00407e7e
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0xa8], 0
je 0x406e1a
push 0
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
jmp 0x406e2b
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x84c]
call dword [edx + 0x60]
jmp case.0x406a0a.14
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString_1
mov dword [ebp - 4], 2
push 0x104
push 0x104
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::ReverseFind
add eax, 1
push eax
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Left
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x864], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x864]
push edx
lea ecx, [ebp - 0x18]
call fcn.004125e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x83c]
call sub.MFC42u.DLL_CString::CString
push 0x41805c
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::operator
push 0x418068
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::operator
push 1
lea ecx, [ebp - 0x18]
call fcn.00404130
push eax
push 0
lea ecx, [ebp - 0x18]
call fcn.00404130
push eax
push 0x41807c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString
jmp case.0x406a0a.14
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0x60], 0
je 0x406ffa
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::CString_1
mov dword [ebp - 4], 4
push 0
push 0
lea ecx, [ebp - 0x81c]
push ecx
push 0
push 1
push 0x25e4
mov ecx, dword [ebp - 0x84c]
add ecx, 0x80
call fcn.00411829
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
je 0x406fd4
lea edx, [ebp - 0x81c]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004125b0
push 0x418088
lea ecx, [ebp - 0x840]
call sub.MFC42u.DLL_CString::CString_3
mov byte [ebp - 4], 5
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::operator_1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x840]
call sub.MFC42u.DLL_CString::CString
push 0
push 0
lea ecx, [ebp - 0x81c]
push ecx
push 0
push 1
push 0x25e5
mov ecx, dword [ebp - 0x84c]
add ecx, 0x80
call fcn.00411829
mov dword [ebp - 0x820], eax
lea edx, [ebp - 0x81c]
push edx
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::operator
lea ecx, [ebp - 0x1c]
call fcn.00404130
push eax
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0x60]
call fcn.0040e598
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::CString
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb8]
push edx
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0x60]
call fcn.0040b3ab
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0xb8]
push edx
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0x60]
call fcn.0040add8
mov ecx, dword [ebp - 0x84c]
call fcn.00405ce8
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x84c]
call dword [edx + 0x60]
jmp case.0x406a0a.14
mov ecx, dword [ebp - 0x84c]
call fcn.004087f0
mov ecx, dword [ebp - 0x84c]
call fcn.00408810
push 9
mov ecx, dword [ebp - 0x84c]
call sub.MFC42u.DLL_CWnd::ShowWindow
jmp case.0x406a0a.14
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0xa0], 0
jne 0x407137
push 0xe0
call fcn.00404080
mov dword [ebp - 0x848], eax
mov dword [ebp - 4], 6
cmp dword [ebp - 0x848], 0
je 0x4070d5
mov ecx, dword [ebp - 0x84c]
push ecx
mov ecx, dword [ebp - 0x848]
call fcn.00401000
mov dword [ebp - 0x868], eax
jmp 0x4070df
mov dword [ebp - 0x868], 0
mov edx, dword [ebp - 0x868]
mov dword [ebp - 0x844], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x84c]
mov ecx, dword [ebp - 0x844]
mov dword [eax + 0xa0], ecx
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0x60]
push eax
mov ecx, dword [ebp - 0x84c]
mov ecx, dword [ecx + 0xa0]
call fcn.00401581
push 0
push 0x84
mov edx, dword [ebp - 0x84c]
mov ecx, dword [edx + 0xa0]
call fcn.00404f50
push 0
push 0
push 0xf120
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0xa0]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0xa0]
call fcn.00404450
test eax, eax
jne 0x407182
call fcn.00404470
push eax
mov ecx, dword [ebp - 0x84c]
mov ecx, dword [ecx + 0xa0]
call sub.MFC42u.DLL_CWnd::CenterWindow
mov edx, dword [ebp - 0x84c]
mov ecx, dword [edx + 0xa0]
call fcn.004087f0
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0xa0]
call fcn.00408810
push 9
mov ecx, dword [ebp - 0x84c]
mov ecx, dword [ecx + 0xa0]
call sub.MFC42u.DLL_CWnd::ShowWindow
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4