Function at 0x40a730
Capabilities:
Check for foreground window switch
Check os version
Create process on windows
Get common file path
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x416281
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2f8
mov eax, dword [0x41b0e0]
push ebx
mov dword [esp + 0x2f4], eax
mov eax, dword [ebp + 8]
push esi
xor ebx, ebx
cmp eax, 5
push edi
mov esi, ecx
jne 0x40a774
mov dword [esi + 0x1597d4], ebx
jmp 0x40a7f0
cmp eax, 4
jne 0x40a7e4
push eax
mov eax, dword [esi + 0x1934]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push str.programfiles
call fcn.0040c78c
mov edx, eax
mov byte [esp + 0xec], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xed]
rep stosd dword es:[edi], eax
push edx
stosw word es:[edi], ax
lea ecx, [esp + 0xf0]
push str._sInternet_ExplorerIEXPLORE.EXE
push ecx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 4
push ebx
lea edx, [esi + 0x1db0]
push edx
lea eax, [esp + 0xf4]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40a7f0
cmp eax, 3
jne 0x40a7f0
mov ecx, esi
call fcn.00407960
cmp byte [esi + 0x159fd8], bl
je 0x40a8fe
mov edx, dword [esi + 0x159fdc]
mov byte [esp + 0xe8], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0xe9]
rep stosd dword es:[edi], eax
push pe_nt_image_headers32
lea ecx, [esp + 0xec]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esi + 0x1597d4]
cmp edx, 3
jge 0x40a8fe
lea eax, [esp + 0xe8]
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a850
sub eax, edi
mov dword [esp + 0xc], eax
jne 0x40a8fe
mov eax, dword [esi + 0x159fe0]
inc edx
cmp eax, ebx
mov dword [esi + 0x1597d4], edx
je 0x40a8cf
push str.programfiles
call fcn.0040c78c
mov edx, eax
xor eax, eax
mov byte [esp + 0x1f4], bl
mov ecx, 0x40
lea edi, [esp + 0x1f5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1f8]
push str._sInternet_ExplorerIEXPLORE.EXE
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0xa
push ebx
lea ecx, [esi + 0x1597d8]
push ecx
lea edx, [esp + 0x1fc]
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x1597d4], 4
mov byte [esi + 0x159fd8], bl
jl 0x40a8fe
mov eax, dword [esi + 0x1934]
push ebx
push 0x36ee80
push 5
push eax
call dword [sym.imp.USER32.dll_SetTimer]
cmp byte [esi + 0x1591bf], bl
je 0x40aa13
mov edx, dword [esi + 0x1591c0]
mov byte [esp + 0xe8], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0xe9]
rep stosd dword es:[edi], eax
push pe_nt_image_headers32
lea ecx, [esp + 0xec]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0xe8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a948
sub eax, edx
mov dword [esp + 0xc], eax
jne 0x40aa13
mov byte [esi + 0x1591bf], bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
xor eax, eax
mov byte [esp + 0x98], bl
mov ecx, 0x13
lea edi, [esp + 0x99]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x50
lea eax, [esp + 0x9c]
push eax
push edx
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0x98]
push str.IEFrame
push ecx
call fcn.0040bc42
add esp, 8
test eax, eax
jne 0x40aa13
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x40a9d2
mov edi, 0x32
push ebx
push 0x417368
call dword [sym.imp.USER32.dll_FindWindowA]
xor ecx, ecx
cmp eax, ebx
je 0x40a9e9
mov ecx, 0x78
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
sub eax, ecx
add edx, 0xf
sub eax, edi
push edx
sub eax, 0x64
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [esi + 0x1934]
push 1
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebp + 8], 2
jne 0x40aa4b
push 0x3e7
mov ecx, esi
mov byte [esi + 0x1591bf], bl
call fcn.00406680
mov edx, dword [esi + 0x1934]
push 2
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [esi + 0x22bc], bl
mov byte [esi + 0x24cc], bl
jmp 0x40ad41
cmp byte [esi + 0x24cc], bl
jne 0x40accc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
xor eax, eax
mov byte [esp + 0x98], bl
mov ecx, 0x13
lea edi, [esp + 0x99]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x50
lea eax, [esp + 0x9c]
push eax
push edx
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0x98]
push str.IEFrame
push ecx
call fcn.0040bc42
add esp, 8
test eax, eax
jne 0x40ad25
cmp byte [esi + 0x158786], bl
je 0x40ac59
xor edx, edx
mov dword [esp + 0x59], edx
xor eax, eax
mov byte [esp + 0x1f0], bl
mov dword [esp + 0x5d], edx
mov ecx, 0x40
lea edi, [esp + 0x1f1]
rep stosd dword es:[edi], eax
mov dword [esp + 0x61], edx
mov dword [esp + 0x65], edx
stosw word es:[edi], ax
mov dword [esp + 0x69], edx
mov dword [esp + 0x6d], edx
stosb byte es:[edi], al
lea eax, [esp + 0x1f0]
mov dword [esp + 0x71], edx
push eax
mov word [esp + 0x79], dx
push 0x104
mov byte [esi + 0x158786], bl
mov byte [esp + 0x60], bl
mov byte [esp + 0x7f], dl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x78]
call fcn.0040afd0
push str.toption.dat
lea ecx, [esp + 0x40]
mov dword [esp + 0x310], ebx
call fcn.004024b0
lea ecx, [esp + 0x1f0]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x310], 1
call fcn.004024b0
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x314], 2
call fcn.0040b040
lea ecx, [esp + 0x20]
call fcn.00401dd0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30c], bl
call fcn.00401dd0
push pe_nt_image_headers32
lea ecx, [esi + 0x158788]
push ecx
push 0x4176a4
push str.OPTION
lea ecx, [esp + 0x88]
call fcn.0040afb0
movzx edx, byte [esi + 0x158da8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push edx
lea eax, [esp + 0x5c]
push 0x417314
push eax
call edi
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [esp + 0x5c]
push ecx
push str.GROUP
push str.OPTION
lea ecx, [esp + 0x88]
call fcn.0040afb0
movzx edx, word [esi + 0x1591bc]
push edx
lea eax, [esp + 0x5c]
push 0x417314
push eax
call edi
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [esp + 0x5c]
push ecx
push str.NUMBER
push str.OPTION
lea ecx, [esp + 0x88]
call fcn.0040afb0
cmp dword [esi + 0x1950], 0x10
jb 0x40ac2a
mov eax, dword [esi + 0x193c]
jmp 0x40ac30
lea eax, [esi + 0x193c]
push 5
push eax
push ebx
push str.TOption.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x78]
mov dword [esp + 0x30c], 0xffffffff
call fcn.0040aff0
mov edi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push edi
mov dword [esi + 0xcd20], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp byte [esi + 0x158784], bl
jne 0x40acbd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ebx
mov dword [0x41baa0], eax
mov eax, dword [esp + 0x20]
push 0x401070
mov dword [0x41baa4], ecx
push ebx
mov dword [0x41baa8], edx
mov dword [0x41baac], eax
mov byte [esi + 0x158784], 1
mov ecx, dword [0x41dc1c]
push 0x9f
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push ebx
push 0x40a5d0
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x40ad25
xor eax, eax
mov byte [esp + 0xe8], bl
mov ecx, 0x3f
lea edi, [esp + 0xe9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push pe_nt_image_headers32
lea edx, [esp + 0xec]
stosb byte es:[edi], al
mov eax, dword [esi + 0xcd20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0xe8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ad10
sub eax, edx
mov dword [esp + 0xc], eax
jne 0x40ad25
mov byte [esi + 0x24cc], bl
mov ecx, dword [esi + 0x22b8]
inc ecx
mov eax, ecx
cmp eax, 0xafc80
mov dword [esi + 0x22b8], ecx
jle 0x40ad41
mov dword [esi + 0x22b8], ebx
mov ecx, dword [esp + 0x304]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2fc]
call fcn.0040c0d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4