Function at 0x405010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2fc
mov eax, dword [0x40d078]
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x304], eax
call fcn.004037f0
test eax, eax
jne 0x405971
call fcn.004059f0
test al, al
je 0x405971
xor eax, eax
mov byte [esp + 0x1f8], 0
mov ecx, 0x40
lea edi, [esp + 0x1f9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x1fc]
push eax
push 0
call dword [0x40a0c4]
push eax
call dword [0x40a048]
lea ecx, [esp + 0x1f8]
push 0x5c
push ecx
call dword [0x40a208]
add esp, 8
test eax, eax
je 0x40509b
mov byte [eax], 0
lea edx, [esp + 0x1f8]
push edx
lea ecx, [esp + 0x18c]
call dword [0x40a174]
push str._netconfig.ini
lea ecx, [esp + 0x18c]
call dword [0x40a18c]
lea esi, [esp + 0x24]
call fcn.00407230
mov eax, dword [esp + 0x1a0]
mov edx, dword [esp + 0x18c]
mov esi, 0x10
cmp eax, esi
jae 0x4050e9
lea edx, [esp + 0x18c]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00401e10
push str.SETTING.INI
lea ecx, [esp + 0xe4]
call dword [0x40a174]
lea ecx, [esp + 0x28]
push ecx
lea edi, [esp + 0xe4]
call fcn.004022a0
push eax
lea ecx, [esp + 0x100]
call dword [0x40a178]
mov ecx, edi
call dword [0x40a170]
mov edx, dword [0x40a184]
mov eax, dword [edx]
push 1
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x108]
mov byte [esp + 0x18], 0x2e
call dword [0x40a1a4]
mov ecx, dword [0x40a184]
mov ecx, dword [ecx]
cmp ecx, eax
je 0x40516d
push ecx
push eax
lea ecx, [esp + 0x104]
call dword [0x40a180]
mov eax, dword [esp + 0x110]
test eax, eax
jne 0x4051b5
lea ecx, [esp + 0xfc]
call dword [0x40a170]
lea ecx, [esp + 0x24]
call fcn.00407280
lea ecx, [esp + 0x188]
call dword [0x40a170]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2f8]
xor ecx, ebp
call fcn.004092bc
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x114], esi
mov eax, dword [esp + 0x100]
jae 0x4051cc
lea eax, [esp + 0x100]
push eax
call dword [0x40a24c]
add esp, 4
push str.RsProduct
lea ecx, [esp + 0xe4]
call dword [0x40a174]
lea edx, [esp + 0x28]
push edx
lea edi, [esp + 0xe4]
call fcn.004022a0
lea ecx, [esp + 0xfc]
push ecx
mov ecx, eax
call dword [0x40a19c]
mov ecx, edi
call dword [0x40a170]
cmp dword [esp + 0x114], esi
mov ecx, dword [esp + 0x100]
jae 0x405228
lea ecx, [esp + 0x100]
lea edx, [esp + 0x24]
push edx
call fcn.004038c0
add esp, 4
push str.Global_
lea ecx, [esp + 0x1a8]
call dword [0x40a174]
push str.RsProduct
lea ecx, [esp + 0xe4]
call dword [0x40a174]
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0xe4]
call fcn.004022a0
cmp dword [eax + 0x18], esi
jb 0x405274
mov eax, dword [eax + 4]
jmp 0x405277
add eax, 4
push eax
lea ecx, [esp + 0x11c]
call dword [0x40a174]
lea ecx, [esp + 0xe0]
call dword [0x40a170]
push 0x40aa14
lea ecx, [esp + 0x11c]
call dword [0x40a18c]
push str.F27F1D42_80AE_441d_B866_88B116BE14A0
lea ecx, [esp + 0x11c]
call dword [0x40a18c]
cmp dword [esp + 0x130], esi
mov eax, dword [esp + 0x11c]
jae 0x4052cd
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x1a8]
call dword [0x40a18c]
lea ecx, [esp + 0x118]
push ecx
push str.LocalLocal_
lea ecx, [esp + 0x13c]
call dword [0x40a174]
push eax
lea edx, [esp + 0xe8]
push edx
call fcn.00401d50
add esp, 0xc
push eax
lea ecx, [esp + 0x11c]
call dword [0x40a19c]
lea ecx, [esp + 0xe0]
call dword [0x40a170]
lea ecx, [esp + 0x134]
call dword [0x40a170]
push str._Rsinstallpath_RavMonD.exe
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x158]
call fcn.00407390
push str._Rsinstallpath_
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0xe8]
call fcn.00407390
cmp dword [eax + 0x18], esi
jb 0x405364
mov eax, dword [eax + 4]
jmp 0x405367
add eax, 4
push eax
lea ecx, [esp + 0x1e0]
call dword [0x40a174]
lea ecx, [esp + 0xe0]
call dword [0x40a170]
cmp byte [ebx], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov edi, ebx
jne 0x40539e
mov edi, str._srv_setup
push 0
call dword [0x40a2ec]
mov ebx, dword [0x40a2b0]
lea esp, [esp]
cmp dword [esp + 0x114], 0x10
mov eax, dword [esp + 0x100]
jae 0x4053c8
lea eax, [esp + 0x100]
push eax
lea esi, [esp + 0x18]
call fcn.00404eb0
add esp, 4
test eax, eax
jne 0x405475
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405475
call fcn.00407d80
test eax, eax
mov esi, 0x10
je 0x405423
cmp dword [esp + 0x168], esi
mov edx, dword [esp + 0x154]
jae 0x40540e
lea edx, [esp + 0x154]
push edi
push 0
push 1
xor ecx, ecx
call fcn.00407ff0
add esp, 0xc
test eax, eax
je 0x40547a
jmp 0x405461
cmp dword [esp + 0x1f4], esi
mov ecx, dword [esp + 0x1e0]
jae 0x40543a
lea ecx, [esp + 0x1e0]
cmp dword [esp + 0x168], esi
mov eax, dword [esp + 0x154]
jae 0x405451
lea eax, [esp + 0x154]
push 0xa
push ecx
push edi
push eax
push 0
push 0
call ebx
cmp eax, 0x20
jg 0x40547a
push 0x1f4
call dword [0x40a0c8]
dec dword [esp + 0x10]
jmp 0x4053b0
mov esi, 0x10
call dword [0x40a2e8]
mov eax, dword [esp + 0x14]
xor edi, edi
cmp eax, edi
je 0x405491
push eax
call dword [0x40a050]
cmp dword [esp + 0x1bc], esi
mov eax, dword [esp + 0x1a8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
jae 0x4054b0
lea eax, [esp + 0x1a8]
mov edi, dword [0x40a088]
push eax
push 0
push 0
call edi
mov ebx, dword [0x40a08c]
mov esi, eax
mov dword [esp + 0x10], esi
call ebx
cmp eax, 0xb7
je 0x4054d6
test esi, esi
jne 0x4054e2
test esi, esi
mov dword [esp + 0x14], 1
je 0x4054f0
cmp esi, 0xffffffff
je 0x4054f0
push 0xffffffffffffffff
push esi
call dword [0x40a0cc]
mov eax, dword [esp + 0x130]
mov esi, 0x10
cmp eax, esi
mov eax, dword [esp + 0x11c]
jae 0x40550e
lea eax, [esp + 0x11c]
push eax
push 0
push 0
call edi
test eax, eax
mov dword [esp + 0x20], eax
je 0x40552e
call ebx
cmp eax, 0xb7
je 0x40552e
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405542
cmp eax, 0xffffffff
je 0x405542
push eax
call dword [0x40a084]
push str.Rsdatapath
lea ecx, [esp + 0x138]
call dword [0x40a174]
push str.RsProduct
lea ecx, [esp + 0xe4]
call dword [0x40a174]
lea edx, [esp + 0x28]
push edx
lea edi, [esp + 0x138]
call fcn.004022a0
cmp dword [eax + 0x18], esi
jb 0x405581
mov ebx, dword [eax + 4]
jmp 0x405584
lea ebx, [eax + 4]
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0xe4]
call fcn.004022a0
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x4055a6
mov eax, dword [eax + 4]
jmp 0x4055a9
add eax, 4
push ebx
push eax
push 2
push 0x44d
lea ecx, [esp + 0x98]
push ecx
call fcn.00401330
lea ecx, [esp + 0xe0]
call dword [0x40a170]
lea ecx, [esp + 0x134]
call dword [0x40a170]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405735
push 0
push 0
push 0
push 2
push 0x44d
xor ebx, ebx
lea edi, [esp + 0x9c]
call fcn.00401630
mov eax, dword [esp + 0x18]
test eax, eax
je 0x405704
push str.Application_run_in_other_account_
lea ecx, [esp + 0xe4]
call dword [0x40a174]
push str.Rising
lea ecx, [esp + 0x138]
call dword [0x40a174]
push str.rslang
lea ecx, [esp + 0x1fc]
lea ebx, [esp + 0x60]
call fcn.00406120
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x40569f
mov edx, dword [ecx]
push 0
call dword [edx + 0x40]
mov ecx, dword [esp + 0x84]
mov eax, dword [ecx]
push str.Cant_load_string_300119_
push 0x49457
call dword [eax + 0x44]
push eax
lea ecx, [esp + 0x138]
call dword [0x40a198]
mov ecx, dword [esp + 0x84]
mov edx, dword [ecx]
push str.Cant_load_string_3500100_
push 0x356844
call dword [edx + 0x44]
push eax
lea ecx, [esp + 0xe4]
call dword [0x40a198]
mov ecx, dword [esp + 0x14c]
mov eax, 0x10
cmp ecx, eax
mov ecx, dword [esp + 0x138]
jae 0x4056bd
lea ecx, [esp + 0x138]
cmp dword [esp + 0xf8], eax
mov eax, dword [esp + 0xe4]
jae 0x4056d4
lea eax, [esp + 0xe4]
push 0
push ecx
push eax
push 0
call dword [0x40a2e0]
lea eax, [esp + 0x5c]
push eax
call fcn.004062a0
lea ecx, [esp + 0x134]
call dword [0x40a170]
lea ecx, [esp + 0xe0]
call dword [0x40a170]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x405714
push eax
call dword [0x40a050]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40590e
cmp eax, 0xffffffff
je 0x40590e
push eax
call dword [0x40a050]
jmp 0x40590e
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40575b
push 0
push 0
push 0
push 2
mov ebx, 0x1212
lea edi, [esp + 0x98]
call fcn.00401680
mov edi, 0x10
lea ecx, [esp + 0x1f8]
push ecx
lea ecx, [esp + 0x1c4]
call dword [0x40a174]
push str.combase.dll
lea ecx, [esp + 0x1c4]
call dword [0x40a18c]
lea edx, [esp + 0x1f8]
push edx
lea ecx, [esp + 0x170]
call dword [0x40a174]
push str.Scan.xml
lea ecx, [esp + 0x170]
call dword [0x40a18c]
lea eax, [esp + 0x34]
call fcn.00407070
lea eax, [esp + 0x3c]
call fcn.00405990
cmp dword [esp + 0x184], edi
mov ecx, dword [esp + 0x170]
jae 0x4057d2
lea ecx, [esp + 0x170]
cmp dword [esp + 0x1d8], edi
mov eax, dword [esp + 0x1c4]
jae 0x4057e9
lea eax, [esp + 0x1c4]
push ecx
push eax
lea ecx, [esp + 0x44]
call fcn.00406360
test eax, eax
jl 0x4058a2
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x58]
push 0x40a7b0
xor ebx, ebx
push ebx
push 0x40adf8
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x405890
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00406e70
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x405887
cmp dword [esp + 0x184], edi
mov ecx, dword [esp + 0x170]
jae 0x40584f
lea ecx, [esp + 0x170]
mov edx, dword [eax]
push ecx
push ebx
push str._app_rsmain
push ebx
push eax
call dword [edx + 0xc]
test eax, eax
jl 0x405887
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
call dword [edx + 0x10]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x405887
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
call fcn.00407060
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x4058a2
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esp + 0x34], ebx
cmp esi, 0xffffffff
je 0x4058ae
push esi
call dword [0x40a050]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4058c2
cmp eax, 0xffffffff
je 0x4058c2
push eax
call dword [0x40a050]
push 0
push 0
push 0
push 2
mov ebx, 0x1211
lea edi, [esp + 0x98]
call fcn.00401680
mov esi, edi
call fcn.004016d0
lea ecx, [esp + 0x3c]
call fcn.00406530
lea eax, [esp + 0x34]
call fcn.00407060
lea ecx, [esp + 0x16c]
call dword [0x40a170]
lea ecx, [esp + 0x1c0]
call dword [0x40a170]
lea ecx, [esp + 0x88]
call fcn.00401520
lea ecx, [esp + 0x1dc]
call dword [0x40a170]
lea ecx, [esp + 0x150]
call dword [0x40a170]
lea ecx, [esp + 0x118]
call dword [0x40a170]
lea ecx, [esp + 0x1a4]
call dword [0x40a170]
lea ecx, [esp + 0xfc]
call dword [0x40a170]
lea ecx, [esp + 0x24]
call fcn.00407280
lea ecx, [esp + 0x188]
call dword [0x40a170]
mov ecx, dword [esp + 0x304]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004092bc
mov esp, ebp
pop ebp
ret 0x10