Function at 0x40ab50
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push eax
movzx eax, word [esp + 0x10]
push ecx
mov ecx, dword [0x486c34]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov esi, eax
test esi, esi
je 0x405d1e
cmp esi, 0xffffffff
jne 0x405d2d
push str.falure_____DialogBoxParam
call fcn.00404b40
add esp, 4
mov eax, esi
pop esi
ret
sub esp, 0x15c
mov eax, dword [0x4834f0]
xor eax, esp
mov dword [esp + 0x158], eax
lea eax, [esp + 0x54]
push eax
call fcn.00405c60
add esp, 4
test al, al
jne 0x408b56
push edi
push 0x104
lea ecx, [esp + 0x5c]
push 0
push ecx
call fcn.00440ab0
add esp, 0xc
push 0x104
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x58]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x408b11
mov ax, word [0x46f364]
mov word [edi], ax
lea eax, [esp + 0x58]
add eax, 0xffffffff
pop edi
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x408b30
mov ecx, dword [str.AMCam.exe]
mov edx, dword [0x46f35c]
mov dword [eax], ecx
mov cx, word [0x46f360]
mov dword [eax + 4], edx
mov word [eax + 8], cx
lea eax, [esp + 0x54]
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x408b60
mov edx, dword [str.__StiDevice__StiEvent]
mov ecx, dword [0x46f344]
mov dword [eax], edx
mov edx, dword [0x46f348]
mov dword [eax + 4], ecx
mov ecx, dword [0x46f34c]
mov dword [eax + 8], edx
mov edx, dword [0x46f350]
mov dword [eax + 0xc], ecx
mov cx, word [0x46f354]
mov dword [eax + 0x10], edx
lea edx, [esp + 0x54]
push edx
push 0x46e904
mov word [eax + 0x14], cx
call fcn.00404b40
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00440ab0
add esp, 0x14
xor eax, eax
lea ecx, [esp]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x74]
push eax
push 0
mov dword [esp + 0x38], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408c08
push str.CreateProcess_failed.
call fcn.00404b40
add esp, 4
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.0043e6bd
add esp, 0x15c
ret
mov eax, dword [esp + 0xc]
cmp eax, dword [0x4856a4]
jne 0x40ab8e
push str.MONITOR_EVENT_LAUNCHAP
call fcn.00404b40
lea eax, [esp + 0x10]
push eax
push str.PlaySound
push 0x485578
call fcn.004078d0
add esp, 0x10
test byte [esp + 0xc], 1
je 0x40ab89
call fcn.00405be0
jmp 0x408ac0
cmp eax, dword [0x4856a0]
jne 0x40abc2
push str.MONITOR_EVENT_SNAPSHOT
call fcn.00404b40
add esp, 4
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x409fc0
mov dword [esp + 8], 0x65
mov dword [esp + 4], eax
jmp 0x405cf0
cmp eax, dword [0x48569c]
jne 0x40abf6
push str.MONITOR_TWAIN_ACTIVE
call fcn.00404b40
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [0x485694], ecx
mov dword [0x485690], 0x3e8
mov dword [0x48568c], 1
ret
cmp eax, dword [0x485698]
jne 0x40ac1c
push str.MONITOR_TWAIN_INACTIVE
call fcn.00404b40
add esp, 4
xor eax, eax
mov dword [0x485694], eax
mov dword [0x485690], eax
mov dword [0x48568c], eax
ret