Function at 0x407d20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a0710
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8a00]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov dword [esp + 0x44], 1
mov eax, dword [esp + 0x50]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x40815d
call fcn.0044d2b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407d78
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, 0x26
lea esi, [esp + 0x18]
mov byte [esp + 0x44], 2
call fcn.00407750
push 0x1f
push 0x4ac220
mov ecx, esi
call fcn.004026b0
call fcn.0044d2b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407dc3
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov ecx, 0x19
lea esi, [esp + 0x2c]
mov byte [esp + 0x44], 3
call fcn.00407750
mov edi, dword [esp + 0x18]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x34], esp
mov esi, esp
push edi
mov dword [esp + 0x30], edi
call fcn.00402640
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0042fa70
add esp, 4
test eax, eax
je 0x40811a
call fcn.0044d2b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407e30
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x44], 4
call fcn.0044d2b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407e5f
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x44], 5
mov ecx, dword [esp + 0x50]
mov ebp, dword [esp + 0x2c]
push ecx
push ebp
lea edx, [esp + 0x24]
push str._s_s.lnk
push edx
call fcn.00402850
mov edi, dword [esp + 0x2c]
add esp, 0xc
lea ebx, [edi - 0x10]
mov dword [esp + 0x28], esp
mov esi, esp
push ebx
call fcn.00402640
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x4c], 6
add ebp, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push ebp
call fcn.00402640
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x4c], 5
call fcn.004079d0
add esp, 8
test eax, eax
je 0x407eed
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x18]
push eax
push edi
xor edi, edi
call fcn.004077f0
mov edi, dword [esp + 0x24]
add esp, 8
cmp dword [esp + 0x54], 0
jne 0x407f85
mov byte [esp + 0x44], 4
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407f16
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov byte [esp + 0x44], 3
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407f3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 2
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407f5a
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov eax, dword [esp + 0x28]
mov byte [esp + 0x44], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40815d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40815d
call fcn.0044d2b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407f9f
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x44], 7
call fcn.0044d2b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407fce
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
mov byte [esp + 0x44], 8
call fcn.0041f270
push str.MicrosoftInternet_ExplorerQuick_Launch
mov ecx, esi
call fcn.00401da0
mov ecx, dword [esp + 0x50]
mov ebp, dword [esp + 0x20]
push ecx
push ebp
lea edx, [esp + 0x2c]
push str._s_s.lnk
push edx
call fcn.00402850
add esp, 0x10
call fcn.00407cc0
test eax, eax
je 0x408033
push 1
push 0
push 0
push edi
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40808d
mov edi, dword [esp + 0x24]
push ecx
lea eax, [edi - 0x10]
mov dword [esp + 0x38], esp
mov esi, esp
push eax
call fcn.00402640
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x40], esp
mov esi, esp
push eax
mov byte [esp + 0x50], 9
call fcn.00402640
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x4c], 8
call fcn.004079d0
add esp, 8
test eax, eax
je 0x40808d
mov ecx, dword [esp + 0x18]
push 0x4ab640
push edi
xor edi, edi
call fcn.004077f0
add esp, 8
mov byte [esp + 0x44], 7
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4080b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x44], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4080d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 4
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4080f1
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov byte [esp + 0x44], 3
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408116
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x28]
mov byte [esp + 0x44], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40813f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 1
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40815d
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408182
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4081aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret