Function at 0x404ca0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x425450]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x426a28
push 0x67
push edi
call esi
push 0x64
push 0x426af0
push 0x6d
push edi
call esi
push edi
call fcn.004021b0
add esp, 4
mov dword [0x426a20], edi
push 0
push edi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x426a28
push 0x426af0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x405122
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00407ec0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d64
sub ecx, edx
sar ecx, 1
je 0x404d91
mov eax, 0x5c
lea ebx, [ebx]
cmp ax, word [ebp + ecx*2 - 0x20c]
je 0x404f23
dec ecx
jne 0x404d80
push 0x104
lea eax, [ebp - 0x20c]
push 0x41c3d4
push eax
call fcn.004065f4
add esp, 0xc
lea ecx, [ebp - 0x380]
push 1
push 0x40
push 1
push 0x41c44c
call fcn.00401710
push 0
push 0x41c224
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x258], 0xf
mov dword [ebp - 0x25c], 0
mov byte [ebp - 0x26c], 0
mov dword [ebp - 0x210], 0xf
mov dword [ebp - 0x214], 0
mov byte [ebp - 0x224], 0
call fcn.00403710
push 1
push 0x41c474
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x228], 0xf
mov dword [ebp - 0x22c], 0
mov byte [ebp - 0x23c], 0
call fcn.00403710
jmp 0x404e40
mov eax, dword [ebp - 0x380]
lea ecx, [ebp - 0x380]
mov eax, dword [eax + 4]
add ecx, eax
lea eax, [ebp - 0x28c]
push eax
call fcn.00403e60
push eax
call fcn.004015f0
mov ecx, dword [ebp - 0x28c]
add esp, 4
mov esi, eax
test ecx, ecx
je 0x404e83
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x404e83
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [esi]
mov ecx, esi
push 0xa
mov eax, dword [eax + 0x20]
call eax
mov byte [ebp - 0x288], al
lea eax, [ebp - 0x26c]
push dword [ebp - 0x288]
push eax
lea eax, [ebp - 0x380]
push eax
call fcn.00401270
add esp, 0xc
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x404f9a
mov esi, dword [ebp - 0x22c]
lea edx, [ebp - 0x23c]
or edi, 0xffffffff
lea ecx, [ebp - 0x26c]
cmp esi, 0xffffffff
cmovb edi, esi
cmp dword [ebp - 0x228], 0x10
mov eax, edi
cmovae edx, dword [ebp - 0x23c]
cmp dword [ebp - 0x25c], esi
cmovb esi, dword [ebp - 0x25c]
cmp dword [ebp - 0x258], 0x10
cmovae ecx, dword [ebp - 0x26c]
cmp esi, edi
cmovb eax, esi
push eax
push edx
push ecx
call fcn.00403940
add esp, 0xc
test eax, eax
jne 0x404f4f
cmp esi, edi
jae 0x404f40
or eax, 0xffffffff
jmp 0x404f47
add ecx, ecx
cmp ecx, 0x208
jae 0x405136
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
jmp 0x404d91
xor eax, eax
cmp esi, edi
setne al
test eax, eax
je 0x404e40
push 0x41c478
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.00401080
add esp, 0xc
lea ecx, [ebp - 0x224]
push 0xffffffffffffffff
push 0
push eax
call fcn.004032c0
cmp dword [ebp - 0x270], 0x10
jb 0x404e40
push dword [ebp - 0x284]
call fcn.00405bd2
add esp, 4
jmp 0x404e40
cmp dword [ebp - 0x210], 0x10
lea ecx, [ebp - 0x224]
mov eax, dword [ebp - 0x214]
cmovae ecx, dword [ebp - 0x224]
push dword [ebp - 0x288]
add eax, ecx
mov dword [ebp - 0x240], 7
cmp dword [ebp - 0x210], 0x10
lea ecx, [ebp - 0x224]
push eax
cmovae ecx, dword [ebp - 0x224]
xor edx, edx
push ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], dx
call fcn.00401170
push 0x3c
lea eax, [ebp - 0x2c8]
push 0
push eax
call fcn.00407ec0
add esp, 0xc
mov dword [ebp - 0x2c8], 0x3c
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2c8]
push eax
mov dword [ebp - 0x2bc], 0x41c47c
mov dword [ebp - 0x2ac], 5
mov dword [ebp - 0x2c4], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x240], 8
jb 0x40507f
push dword [ebp - 0x254]
call fcn.00405bd2
add esp, 4
xor eax, eax
mov dword [ebp - 0x240], 7
cmp dword [ebp - 0x228], 0x10
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], ax
jb 0x4050b3
push dword [ebp - 0x23c]
call fcn.00405bd2
add esp, 4
cmp dword [ebp - 0x210], 0x10
mov dword [ebp - 0x228], 0xf
mov dword [ebp - 0x22c], 0
mov byte [ebp - 0x23c], 0
jb 0x4050e5
push dword [ebp - 0x224]
call fcn.00405bd2
add esp, 4
cmp dword [ebp - 0x258], 0x10
mov dword [ebp - 0x210], 0xf
mov dword [ebp - 0x214], 0
mov byte [ebp - 0x224], 0
jb 0x405117
push dword [ebp - 0x26c]
call fcn.00405bd2
add esp, 4
lea ecx, [ebp - 0x380]
call fcn.00401ea0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00407411
mov esp, ebp
pop ebp
ret 0x10
call fcn.00405e4f
int3