Function at 0x4015f0
Capabilities:
Create process on windows
Create thread
Hide graphical window
Inspect load icon resource
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x860
mov esi, dword [esp + 0x874]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 0x85c], eax
mov dword [esp + 0x30], 0
call fcn.0040ef20
mov dword [0x464b5c], esi
call fcn.0040f680
test al, al
je 0x401638
call fcn.0040f690
test al, al
je 0x401a44
mov edi, dword [esp + 0x87c]
call fcn.00403ab0
lea ebp, [esp + 0x5c]
push 0x7f0
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push ebp
call fcn.00434f40
add esp, 8
lea esi, [eax + 1]
cmp eax, ebp
cmovb esi, ebp
push 0x3a
push ebp
call fcn.00434f40
add esp, 8
lea ecx, [eax + 1]
cmp eax, esi
cmovb ecx, esi
test eax, eax
cmove ecx, esi
mov dword [ecx], 0x74747570
mov dword [ecx + 4], 0x78652e79
mov word [ecx + 8], 0x65
push 0x458b44
push ebp
call fcn.0043d28b
add esp, 8
test eax, eax
je 0x4016c1
mov esi, eax
push ebp
call fcn.0040ddc0
add esp, 4
mov dword [0x464b60], eax
push esi
call fcn.0043cfc2
add esp, 4
jmp 0x4016cb
mov dword [0x464b60], 0
lea eax, [esp + 0x34]
lea ecx, [esp + 0x38]
lea edx, [esp + 0x3c]
push eax
push ecx
push edx
push edi
call fcn.0040fd60
add esp, 0x10
lea esi, [esp + 0x1c]
push fcn.00402160
push 0
push dword [esp + 0x40]
push dword [esp + 0x48]
push esi
call fcn.0040ece0
add esp, 0x14
push esi
call fcn.0040eee0
add esp, 4
test al, al
je 0x4018b5
mov dword [esp + 8], 0
xor ebx, ebx
mov dword [esp], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
call fcn.0040ec60
mov edi, eax
push ebp
push eax
call fcn.0040f0e0
add esp, 8
mov esi, eax
push edi
call fcn.0040e4c0
add esp, 4
test esi, esi
je 0x401a55
call fcn.0040b520
mov byte [0x464b65], al
test al, al
mov edi, dword [esp + 8]
jne 0x401c60
mov edi, dword [esp + 0x878]
test edi, edi
jne 0x4017f6
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0x402190
mov eax, dword [esp + 0x874]
mov dword [esp + 0x6c], eax
push 0xc8
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x70], eax
mov dword [esp + 0x80], str.PageantSysTray
push ebp
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x464b4c], 0
push 0
push dword [esp + 0x878]
push 0
push 0
push 0x64
push 0x64
push 0x80000000
push 0x80000000
push 0xef0000
push 0x457ee8
push str.PageantSysTray
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x464b48], eax
push eax
call fcn.00403e80
add esp, 4
call fcn.00408e40
mov dword [0x464b68], 0x451178
mov byte [0x464b6c], 1
call fcn.0040f680
test al, al
je 0x401ad0
mov dword [esp + 0x18], esi
push 0x464b68
push ebp
call fcn.00409450
add esp, 8
mov dword [esp + 0x10], eax
call fcn.0040ec90
mov esi, eax
push dword [esp + 0x5c]
push eax
call fcn.0040d6a0
add esp, 8
mov edi, eax
mov eax, dword [eax]
push edi
call dword [eax + 0x18]
add esp, 4
test eax, eax
je 0x401a74
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
add esp, 4
push eax
push esi
push str.Unable_to_open_named_pipe_at__s_for_SSH_agent:_n_s
jmp 0x401b31
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
xor ebx, ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x401930
push 0
push 1
mov edi, dword [esp + 0x10]
push edi
push 8
lea eax, [esp + 0x40]
push eax
push ebx
call fcn.0040e4d0
add esp, 0x18
mov ebx, eax
lea ebp, [edi + 1]
push dword [esp + 0x5c]
call fcn.0040f010
add esp, 4
mov dword [ebx + edi*8], eax
mov eax, dword [esp + 4]
and al, 1
mov byte [ebx + edi*8 + 4], al
mov dword [esp + 8], ebp
lea ebp, [esp + 0x5c]
push esi
call fcn.0040eee0
add esp, 4
test al, al
jne 0x401731
push ebp
push esi
call fcn.0040ee80
add esp, 8
test al, al
jne 0x4018e0
push 0
push str._pgpfp
push 0
push esi
call fcn.0040ed10
add esp, 0x10
test al, al
jne 0x401a65
push 0
push str._restrictacl
push 0x459042
push str._restrict_acl
push 0
push esi
call fcn.0040ed10
add esp, 0x18
test al, al
je 0x401980
call fcn.0040fc00
jmp 0x40191f
push 0
push 0x45902e
push str._restrict_putty_acl
push 0
push esi
call fcn.0040ed10
add esp, 0x14
test al, al
je 0x4019a7
mov byte [0x464b64], 1
jmp 0x40191f
push 0
push 0x459e5a
push str._nodecrypt
push 0x457d71
push str._no_decrypt
push 0
push esi
call fcn.0040ed10
add esp, 0x1c
test al, al
je 0x4019d7
mov al, 1
mov dword [esp + 4], eax
jmp 0x40191f
push 0
push 0x457cba
push 0
push esi
call fcn.0040ed10
add esp, 0x10
test al, al
je 0x4019f8
mov al, 1
mov dword [esp + 0x14], eax
jmp 0x40191f
push 0
push 0x4592db
push str._openssh_config
push ebp
push esi
call fcn.0040ed10
add esp, 0x14
test al, al
je 0x401a1e
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
jmp 0x40191f
push 0
push str._unix
push ebp
push esi
call fcn.0040ed10
add esp, 0x10
test al, al
je 0x401da0
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
jmp 0x40191f
push 0x10
push str.Pageant_Fatal_Error
push str.Unable_to_access_security_APIs._Pageant_will_nnot_run__in_case_it_causes_a_security_breach.
jmp 0x401b41
push 0x10
push str.Pageant_Error
push dword [esp + 0x64]
jmp 0x401b41
push 0
call fcn.0040f380
add esp, 4
jmp 0x401b49
push edi
push dword [esp + 0x14]
call fcn.00409490
add esp, 8
mov eax, dword [esp]
test eax, eax
je 0x401abc
push 0x457c1e
push eax
mov dword [esp + 8], eax
call fcn.0043d28b
add esp, 8
test eax, eax
je 0x401d8b
mov edi, eax
push esi
push 0x45c367
push eax
call fcn.004028b0
add esp, 0xc
push edi
call fcn.0043cfc2
add esp, 4
push esi
call fcn.0040e4c0
add esp, 4
mov edi, dword [esp + 0x878]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401b7f
mov edi, eax
call fcn.0040ba60
push edi
call fcn.0043d7fc
add esp, 4
push 0x464b68
push ebp
call fcn.00409450
add esp, 8
mov dword [esp + 0x10], eax
push dword [esp + 0x5c]
mov dword [esp + 0x10], edi
push edi
call fcn.0040cc50
add esp, 8
mov edi, eax
mov eax, dword [eax]
push edi
call dword [eax + 0x18]
add esp, 4
test eax, eax
je 0x401b6b
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
add esp, 4
push eax
push dword [esp + 0x10]
push str.Unable_to_open_AF_UNIX_socket_at__s_for_SSH_agent:_n_s
call fcn.0040dd70
add esp, 0xc
push 0x10
push str.Pageant_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 1
mov ecx, dword [esp + 0x85c]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 0x860
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push edi
push dword [esp + 0x14]
call fcn.00409490
add esp, 8
mov edi, dword [esp + 0x878]
test edi, edi
jne 0x401be0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0x402900
mov eax, dword [esp + 0x874]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x80], 0x457ee8
push ebp
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x464b70], 0x451180
mov byte [0x464b78], 1
push 0x464b70
call fcn.00407730
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
mov dword [0x464b8c], eax
push 0
push 0
push 0
push 0
call edi
mov dword [0x464b90], eax
lea eax, [esp + 0x874]
push ebp
push 0
push eax
push 0x402bc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401c47
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x402c70
push dword [0x464b8c]
call fcn.004040e0
add esp, 0xc
mov edi, dword [esp + 8]
push esi
call fcn.0040f1c0
add esp, 4
test edi, edi
je 0x401c8f
xor esi, esi
nop
movzx edx, byte [ebx + esi*8 + 4]
mov ecx, dword [ebx + esi*8]
call fcn.00402c90
push dword [ebx + esi*8]
call fcn.0040f040
add esp, 4
add esi, 1
cmp edi, esi
jne 0x401c70
push ebx
call fcn.0040e4c0
add esp, 4
call fcn.004094a0
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x401cb1
cmp byte [ebx], 0x22
jne 0x401cb8
add ebx, 1
push 0x22
jmp 0x401cba
xor ebx, ebx
jmp 0x401d53
push 0x20
push ebx
call fcn.00434e10
add esp, 8
mov esi, dword [esp + 0x880]
test eax, eax
je 0x401cfd
mov byte [eax], 0
add eax, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
movsx eax, byte [eax]
test eax, eax
je 0x401cff
push eax
call fcn.0043d6e0
add esp, 4
mov ecx, eax
lea eax, [edi + 1]
test ecx, ecx
jne 0x401ce0
jmp 0x401cff
xor edi, edi
push esi
push 0
push edi
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x401d4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push ebx
push str.Failed_to_run___s_:__s
call fcn.0040dd70
add esp, 0xc
mov esi, eax
push 0x30
push 0x457ee8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040e4c0
add esp, 4
mov edi, dword [esp + 8]
cmp byte [0x464b65], 0
je 0x401de0
xor esi, esi
test ebx, ebx
jne 0x401b4e
test edi, edi
jne 0x401b4e
push 0x10
push str.Pageant_Error
push str.Pageant_is_already_running
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401b4e
push dword [esp]
push str.Unable_to_write_OpenSSH_config_file_to__s
call fcn.0040dd70
add esp, 8
jmp 0x401b39
push 0
push 0x45a251
push 0
push esi
call fcn.0040ed10
add esp, 0x10
test al, al
je 0x40213e
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 0x45c400
cmp eax, dword [esp + 0x20]
jge 0x401739
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
jmp 0x401739
mov esi, dword [0x464b48]
mov dword [esp + 0x1fc], 0
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push ebp
push 4
call edi
mov dword [esp + 0x5c], 0x1fc
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 1
mov dword [esp + 0x68], 7
mov dword [esp + 0x6c], 0x8006
push 0xc9
push dword [0x464b5c]
call dword [sym.imp.USER32.dll_LoadIconA]
mov esi, eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x74]
push 0x25
push str.Pageant__PuTTY_authentication_agent_
push eax
call fcn.00434730
add esp, 0xc
push ebp
push 0
call edi
test esi, esi
je 0x401e5b
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x464b94], eax
cmp dword [0x464b60], 0
je 0x401ebf
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x464b98], eax
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
push str.New_Session
push 0x90
push 0
push dword [0x464b94]
call esi
push str.Saved_Sessions
push dword [0x464b98]
push 0x10
push dword [0x464b94]
call esi
push 0
push 0
push 0x800
push dword [0x464b94]
call esi
mov eax, dword [0x464b94]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
push str.View_Keys
push 0x20
push 0
push eax
call esi
push 0x457b58
push 0x30
push 0
push dword [0x464b94]
call esi
push 0x45bec2
push 0x40
push 0
push dword [0x464b94]
call esi
push 0
push 0
push 0x800
push dword [0x464b94]
call esi
push str.Remove_All_Keys
push 0x50
push 0
push dword [0x464b94]
call esi
push str.Re_encrypt_All_Keys
push 0x60
push 0
push dword [0x464b94]
call esi
push 0
push 0
push 0x800
push dword [0x464b94]
call esi
call fcn.00403c20
test al, al
je 0x401f55
push 0x458b7e
push 0x70
push 0
push dword [0x464b94]
call dword [sym.imp.USER32.dll_AppendMenuA]
push str.About
push 0x80
push 0
push dword [0x464b94]
call esi
push 0
push 0
push 0x800
push dword [0x464b94]
call esi
push str.Exit
push 0x10
push 0
push dword [0x464b94]
call esi
push dword [0x464b98]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [0x464b9c], eax
push 0
push 0x20
push dword [0x464b94]
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push 0
push dword [0x464b48]
call dword [sym.imp.USER32.dll_ShowWindow]
test byte [esp + 0x14], 1
je 0x401ff2
cmp dword [0x464b4c], 0
jne 0x401ff2
push 0
push 0x403410
push 0
push 0xd3
push dword [0x464b5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x464b4c], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [esp + 0x40]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov ebp, dword [sym.imp.USER32.dll_IsDialogMessageA]
jmp 0x402009
call fcn.00404080
call fcn.00404230
mov esi, eax
call fcn.004040d0
movzx eax, al
add eax, 0xffffffff
push 0x1cff
push eax
push 0
push esi
push dword [esi + 0x100]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esi + 0x100]
jae 0x402042
push eax
push esi
call fcn.004042d0
add esp, 8
push esi
call fcn.00404340
add esp, 4
push 1
push 0
push 0
push 0
push ebx
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x402073
push ebx
call dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
push ebx
call esi
test eax, eax
je 0x402004
cmp dword [esp + 0x44], 0x12
je 0x4020cd
push dword [0x464b4c]
call edi
test eax, eax
je 0x402099
push ebx
push dword [0x464b4c]
call ebp
test eax, eax
jne 0x40206a
push dword [0x464ba0]
call edi
test eax, eax
je 0x4020b2
push ebx
push dword [0x464ba0]
call ebp
test eax, eax
jne 0x40206a
push dword [0x464ba4]
call edi
test eax, eax
je 0x40205c
push ebx
push dword [0x464ba4]
call ebp
test eax, eax
jne 0x40206a
jmp 0x40205c
mov dword [esp + 0x5c], 0x1fc
mov eax, dword [0x464b48]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 1
lea eax, [esp + 0x5c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push dword [0x464b94]
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [0x464ba8]
test eax, eax
je 0x402111
push eax
call fcn.0040f670
add esp, 4
cmp dword [esp], 0
je 0x402135
push 0x457c1e
push dword [esp + 4]
call fcn.0043d28b
add esp, 8
test eax, eax
je 0x402135
push eax
call fcn.0043cfc2
add esp, 4
push dword [esp + 0x48]
call fcn.004015e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push dword [ecx + eax*4]
push 0x45c379
call fcn.00402160
int3