Function at 0x406651
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
push ebx
xor ebx, ebx
cmp dword [0x425968], ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
je 0x40666e
push 0x18
jmp 0x406670
push 0x17
call fcn.004031bf
pop ecx
push eax
lea eax, [ebp - 0x844]
push eax
call sub.MSVCRT.dll_wcscpy
push dword [0x40f1e8]
lea eax, [ebp - 0xa44]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa44]
push str._FAQ
push eax
call sub.MSVCRT.dll_wcscat
push dword [0x40f1e8]
lea eax, [ebp - 0xc44]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xc44]
push 0x416438
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x644]
push eax
call sub.MSVCRT.dll_wcscpy
mov esi, 0x416434
lea eax, [ebp - 0x644]
push esi
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x644]
push str.faq_
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x40
push dword [0x40f1e8]
lea eax, [ebp - 0x644]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x644]
push str.faq0
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x244]
push esi
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x244]
push 0x416404
push eax
call sub.MSVCRT.dll_wcscat
push dword [0x40f1e8]
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_wcscat
push 0x16
call fcn.004031bf
add esp, 0x34
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [0x425968], ebx
pop ecx
pop ecx
je 0x4067b3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x416400
lea eax, [ebp - 0x444]
push eax
call esi
push 0x4163fc
lea eax, [ebp - 0x444]
push eax
call esi
push 0x4163f8
jmp 0x4067cc
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4163f4
lea eax, [ebp - 0x444]
push eax
call esi
push str.edmoc
lea eax, [ebp - 0x444]
push eax
call esi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [ebp - 0x444]
push ecx
push 1
mov edi, 0x400
push edi
push eax
mov dword [ebp - 4], eax
call esi
push ebx
push ebx
push 0xc00
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xa44]
push eax
push 2
push edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc44]
push eax
push 3
push edi
push dword [ebp - 4]
call esi
push ebx
push ebx
push 0xc00
push dword [ebp - 4]
call esi
lea ecx, [ebp - 8]
call fcn.0040102a
push 0xf2
call fcn.004032ee
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.004011a1
push str.AP
lea ecx, [ebp - 0xc]
call fcn.004010d3
push dword [0x40f1e8]
mov eax, dword [eax]
push eax
lea ecx, [ebp - 8]
call fcn.0040129c
lea ecx, [ebp - 0xc]
call fcn.00401911
push dword [ebp - 8]
push 4
push edi
push dword [ebp - 4]
call esi
push 0xf3
call fcn.004032ee
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.004011a1
push str.AP
lea ecx, [ebp - 0xc]
call fcn.004010d3
push dword [0x40f1e8]
mov eax, dword [eax]
push eax
lea ecx, [ebp - 8]
call fcn.0040129c
lea ecx, [ebp - 0xc]
call fcn.00401911
push dword [ebp - 8]
push 5
push edi
push dword [ebp - 4]
call esi
push 0xca
call fcn.004032ee
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.004011a1
push ebx
push ebx
push 0xc00
push dword [ebp - 4]
call esi
push dword [ebp - 8]
push 6
push edi
push dword [ebp - 4]
call esi
push str..exe
lea ecx, [ebp - 0x14]
call fcn.004010d3
push eax
push dword [0x40f1e8]
lea ecx, [ebp - 0x18]
push 0x4163dc
call fcn.004010d3
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404981
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404938
push eax
lea ecx, [ebp - 8]
call fcn.00401139
lea ecx, [ebp - 0xc]
call fcn.00401911
lea ecx, [ebp - 0x1c]
call fcn.00401911
lea ecx, [ebp - 0x18]
call fcn.00401911
lea ecx, [ebp - 0x14]
call fcn.00401911
push ebx
push ebx
push 0xc00
push dword [ebp - 4]
call esi
push dword [ebp - 8]
push 7
push edi
push dword [ebp - 4]
call esi
push str..ini
lea ecx, [ebp - 0xc]
call fcn.004010d3
push eax
push dword [0x40f1e8]
lea ecx, [ebp - 0x1c]
push 0x4163dc
call fcn.004010d3
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404981
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00404938
push eax
lea ecx, [ebp - 8]
call fcn.00401139
lea ecx, [ebp - 0x14]
call fcn.00401911
lea ecx, [ebp - 0x18]
call fcn.00401911
lea ecx, [ebp - 0x1c]
call fcn.00401911
lea ecx, [ebp - 0xc]
call fcn.00401911
push dword [ebp - 8]
push 8
push edi
push dword [ebp - 4]
call esi
push str..ini
lea ecx, [ebp - 0x18]
call fcn.004010d3
push eax
push dword [0x40f1e8]
lea eax, [ebp - 0x14]
push eax
call fcn.00406d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401139
lea ecx, [ebp - 0x14]
call fcn.00401911
lea ecx, [ebp - 0x18]
call fcn.00401911
push dword [ebp - 8]
push 9
push edi
mov edi, dword [ebp - 4]
push edi
call esi
push ebx
push ebx
push 0xc00
push edi
call esi
push ebx
push 0xe
call fcn.0040a802
pop ecx
pop ecx
push ebx
push eax
mov dword [ebp - 0xc], eax
call fcn.0040c16a
mov esi, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
pop ecx
push eax
push ebx
push 1
push edi
call esi
push ebx
push dword [ebp - 0xc]
call fcn.0040c16a
pop ecx
push eax
push ebx
push 2
push edi
call esi
push ebx
push dword [ebp - 0xc]
call fcn.0040c16a
pop ecx
push eax
push ebx
push 3
push edi
call esi
push ebx
push 0x10f
call fcn.0040a802
pop ecx
pop ecx
push ebx
push eax
call fcn.0040c16a
pop ecx
push eax
push ebx
push 6
push edi
call esi
push ebx
push 0x109
call fcn.0040a802
pop ecx
pop ecx
push ebx
push eax
mov dword [ebp - 0xc], eax
call fcn.0040c16a
pop ecx
push eax
push ebx
push 4
push edi
call esi
push ebx
push dword [ebp - 0xc]
call fcn.0040c16a
pop ecx
push eax
push ebx
push 5
push edi
call esi
push ebx
push 4
call fcn.0040a802
pop ecx
pop ecx
push ebx
push eax
mov dword [ebp - 0xc], eax
call fcn.0040c16a
pop ecx
push eax
push ebx
push 7
push edi
call esi
push ebx
push dword [ebp - 0xc]
call fcn.0040c16a
pop ecx
push eax
push ebx
push 8
push edi
call esi
push ebx
push 0x97
call fcn.0040a802
pop ecx
pop ecx
push ebx
push eax
call fcn.0040c16a
pop ecx
push eax
push ebx
push 9
push edi
call esi
mov eax, dword [ebp - 0x10]
push 0x8008
push dword [eax + 0x828]
lea eax, [ebp - 0x44]
push eax
call fcn.004047f5
mov esi, eax
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x828]
call dword [sym.imp.USER32.dll_ClientToScreen]
push 1
mov edi, 0x8008
push edi
push 0x403
push dword [esi + 0x828]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [esi + 0x830]
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x100
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push edi
push 0x403
push dword [esi + 0x828]
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x406b8d
push 5
push ebx
push ebx
lea eax, [ebp - 0x844]
jmp 0x406bfc
cmp eax, 2
jne 0x406b9e
push 5
push ebx
push ebx
lea eax, [ebp - 0x644]
jmp 0x406bfc
cmp eax, 3
jne 0x406c02
cmp dword [0x425968], ebx
jne 0x406bcd
push str._Danke
lea ecx, [ebp - 0x14]
call fcn.004010d3
push dword [eax]
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
jmp 0x406bed
push str._Thanks
lea ecx, [ebp - 0x14]
call fcn.004010d3
push dword [eax]
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00401911
push 5
push ebx
push ebx
lea eax, [ebp - 0x244]
push eax
jmp 0x406d83
cmp eax, 4
jne 0x406c4b
push 0xf1
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push 0xf0
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push ecx
mov ecx, esp
push 0x42619c
call fcn.00401075
push dword [esi + 0x830]
call fcn.0040b7cb
add esp, 0x10
jmp 0x406d8f
push 5
pop edi
cmp eax, edi
jne 0x406d0e
lea ecx, [ebp - 4]
call fcn.0040102a
mov edi, 0x104
push edi
lea ecx, [ebp - 4]
call fcn.00401863
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.004018df
push dword [0x40f1e8]
lea ecx, [ebp - 4]
call fcn.00401221
push str..zip
lea ecx, [ebp - 4]
call fcn.00401221
push ebx
push ebx
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.00401036
call fcn.0040bc2d
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401036
push 0xf1
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push 0xf0
call fcn.004032ee
mov ecx, esp
push eax
call fcn.00401075
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.00401036
push dword [esi + 0x830]
call fcn.0040b7cb
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00401911
lea ecx, [ebp - 4]
call fcn.00401911
jmp 0x406d8f
cmp eax, 6
jne 0x406d1c
mov ecx, esi
call fcn.0040acc2
jmp 0x406d8f
cmp eax, 7
jne 0x406d42
lea eax, [ebp - 0x10]
push eax
call fcn.00406599
pop ecx
push edi
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
jmp 0x406d04
cmp eax, 8
jne 0x406d76
push ecx
mov ecx, esp
push 0x42598c
call fcn.00401075
lea eax, [ebp - 0x10]
push eax
call fcn.0040652c
pop ecx
pop ecx
push edi
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
jmp 0x406d04
cmp eax, 9
jne 0x406d8f
push edi
push ebx
push ebx
push 0x42598c
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 8]
call fcn.00401911
pop edi
pop esi
pop ebx
leave
ret