Function at 0x404590
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ceef7
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x30c]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 0
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00417d50
push eax
lea ecx, [ebp - 0x220]
call fcn.00408680
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 2
call fcn.00417c3d
mov eax, dword [ebp - 0x220]
mov edx, str.closebtn
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x404646
test si, si
je 0x404642
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x404646
add ecx, 4
add edx, 4
test si, si
jne 0x404620
xor ecx, ecx
jmp 0x40464b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete dl
test dl, dl
je 0x404662
push 2
mov ecx, edi
call fcn.0041fc47
jmp 0x4049c6
mov edx, str.opt_user
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x404696
test si, si
je 0x404692
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x404696
add ecx, 4
add edx, 4
test si, si
jne 0x404670
xor ecx, ecx
jmp 0x40469b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
je 0x4046db
mov ecx, dword [ebp - 0x21c]
mov ecx, dword [ecx + 0x108]
call fcn.00420c8e
mov ecx, dword [edi + 0x474]
test al, al
mov eax, dword [ecx]
je 0x4046ce
push 0
call dword [eax + 0x104]
jmp 0x4049c6
push 1
call dword [eax + 0x104]
jmp 0x4049c6
mov ecx, str.btn_user
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404706
test dx, dx
je 0x404702
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404706
add eax, 4
add ecx, 4
test dx, dx
jne 0x4046e0
xor eax, eax
jmp 0x40470b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x40471f
push ecx
call fcn.00404c70
jmp 0x4049c6
mov edx, str.btn_selpath
lea ecx, [ebp - 0x220]
call fcn.004065b0
test al, al
je 0x404840
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
call fcn.00408ab0
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push 0x4f5c24
push eax
call fcn.00407520
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a7a60
add esp, 0x14
mov dword [ebp - 0x288], 0
xorps xmm0, xmm0
mov dword [ebp - 0x26c], 0
mov ecx, edi
movq qword [ebp - 0x274], xmm0
movups xmmword [ebp - 0x284], xmm0
call fcn.0044c821
mov esi, dword [ebp - 0x21c]
mov ecx, 1
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x280], eax
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x4047de
push 0
lea ecx, [ebp - 0x21c]
call fcn.00408460
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x288]
mov dword [ebp - 0x27c], esi
push eax
mov dword [ebp - 0x278], 0x40
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40481b
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00403bb0
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4049c6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4049c6
mov edx, str.btn_install1
lea ecx, [ebp - 0x220]
call fcn.004065b0
test al, al
jne 0x40498e
mov edx, str.btn_install2
lea ecx, [ebp - 0x220]
call fcn.004065b0
test al, al
jne 0x40498e
mov edx, str.openmain
lea ecx, [ebp - 0x220]
call fcn.004065b0
test al, al
je 0x4049c6
push 0x4f5c50
lea edx, [edi + 0x498]
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x224]
call fcn.00406600
add esp, 4
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
call fcn.00408ab0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x21c]
push dword [ebp - 0x224]
push 0x4f5ae0
push eax
call fcn.00407520
mov esi, dword [ebp - 0x21c]
mov ecx, 1
add esp, 0xc
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x404906
push 0
lea ecx, [ebp - 0x21c]
call fcn.00408460
mov esi, dword [ebp - 0x21c]
push 0x44
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.004a7a60
add esp, 0xc
mov dword [ebp - 0x268], 0x44
mov eax, 1
mov dword [ebp - 0x23c], 1
mov word [ebp - 0x238], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push esi
push 0
movups xmmword [ebp - 0x278], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 1
mov ecx, edi
mov byte [edi + 0x4a8], 1
call fcn.0041fc47
lea ecx, [ebp - 0x21c]
call fcn.004064e0
lea ecx, [ebp - 0x224]
call fcn.004064e0
jmp 0x4049c6
mov ecx, dword [ebp - 0x21c]
push 0
mov ecx, dword [ecx + 0x108]
mov dword [edi + 0x470], ecx
mov eax, dword [ecx]
call dword [eax + 0x104]
push 0
push 0
push edi
push 0x4025a0
push 0
push 0
call fcn.004aebcb
add esp, 0x18
mov dword [edi + 0x4a4], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4049eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret 4