Function at 0x40c773
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get disk information
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
push ebx
xor ebx, ebx
cmp dword [0x42f0b4], ebx
mov dword [ebp - 4], ebx
je 0x40cb9e
cmp byte [0x42e629], bl
jne 0x40cb9e
cmp byte [0x42e62b], bl
jne 0x40cb9e
cmp byte [0x42f175], bl
jne 0x40cb9b
cmp byte [0x42dbac], 1
mov eax, dword [0x42f130]
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x44], bx
mov word [ebp - 0x42], bx
mov dword [ebp - 0x40], ebx
je 0x40c7f8
mov eax, dword [0x42f134]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push ebx
push 0x80
push 3
push ebx
mov edi, 0xc0000000
push 3
push edi
push eax
call esi
cmp eax, 0xffffffff
mov dword [0x42e038], eax
jne 0x40c829
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40c840
push dword [0x42e038]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_SoftIce_loaded
call fcn.004099b6
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.Error_in
push 0x42f10c
call fcn.00409a00
add esp, 0x18
push ebx
push 0x80
push 3
push ebx
push 3
push edi
push dword [0x42f138]
call esi
cmp eax, 0xffffffff
mov dword [0x42e760], eax
jne 0x40c87f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40c896
push dword [0x42e760]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_RegMon_loaded
call fcn.004099b6
pop ecx
push ebx
push 0x80
push 3
push ebx
push 3
push edi
push str..REGSYS
call esi
cmp eax, 0xffffffff
mov dword [0x42e760], eax
jne 0x40c8be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40c8d5
push dword [0x42e760]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_RegMon_loaded
call fcn.004099b6
pop ecx
push ebx
push 0x80
push 3
push ebx
push 3
push edi
push dword [0x42f140]
call esi
cmp eax, 0xffffffff
mov dword [0x42de5c], eax
jne 0x40c8fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40c915
push dword [0x42de5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_FileMon_loaded
call fcn.004099b6
pop ecx
mov esi, 0x408
push esi
call fcn.004179b4
push 8
mov dword [ebp - 0xc], eax
pop edi
lea eax, [ebp - 0x14]
push edi
push 0x427a40
push eax
call fcn.00417bc0
push edi
lea eax, [ebp - 0x24]
push 0x427a34
push eax
call fcn.00417bc0
push edi
lea eax, [ebp - 0x1c]
push 0x427a28
push eax
call fcn.00417bc0
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0040d197
lea eax, [ebp - 0x1c]
push ebx
push eax
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0040d197
add esp, 0x48
lea eax, [ebp - 0x14]
push 1
push eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.0040d197
push 0x14
call fcn.004179b4
push eax
push 0x14
push 0x42e4e8
mov dword [ebp - 8], eax
call fcn.0040840b
push 1
lea eax, [ebp - 0x1c]
push dword [ebp - 8]
push edi
push eax
call fcn.0040d197
push dword [ebp - 8]
call fcn.00417985
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00417bc0
add esp, 0x40
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004025ef
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004025ef
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004025ef
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x184]
push eax
push esi
push dword [ebp - 0xc]
push dword [0x42f0fc]
call fcn.00401c75
push esi
lea eax, [ebp - 0x60c]
push dword [ebp - 0xc]
push eax
call fcn.00417bc0
add esp, 0x44
push 0x400
call fcn.004179b4
mov edi, eax
pop ecx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push edi
call fcn.00418030
pop ecx
pop ecx
mov al, byte [edi + 1]
inc edi
cmp al, 0x22
je 0x40ca5a
cmp al, bl
jne 0x40ca4e
cmp byte [edi], 0x22
jne 0x40ca60
inc edi
push 0x42f190
push edi
call fcn.004181a0
pop ecx
test eax, eax
pop ecx
je 0x40ca88
push 0x400
call fcn.004179b4
push edi
push eax
mov dword [ebp - 4], eax
call fcn.00418030
add esp, 0xc
push dword [0x42f12c]
mov edi, dword [ebp - 8]
push str.__s_
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp - 4], ebx
je 0x40cab0
push dword [ebp - 4]
push edi
call fcn.00418040
pop ecx
pop ecx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40cafa
cmp dword [ebp - 4], ebx
je 0x40cadc
push dword [ebp - 4]
call fcn.00417985
pop ecx
cmp edi, ebx
je 0x40cae7
push edi
call fcn.00417985
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_spawn_unlocked_child_process__error__d._If_error_persists_contact_Softwrap_support.
call fcn.004099b6
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x40cb08
push dword [ebp - 4]
call fcn.00417985
pop ecx
cmp edi, ebx
je 0x40cb13
push edi
call fcn.00417985
pop ecx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x60c]
push dword [ebp - 0x20c]
push eax
push dword [ebp - 0x208]
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40cb4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_write_to_external_process_memory___error__ld.If_error_persists_contact_Softwrap_support.
call fcn.004099b6
pop ecx
pop ecx
push esi
push ebx
push dword [ebp - 0xc]
call fcn.004174b0
push dword [ebp - 0xc]
call fcn.00417985
inc dword [0x42e614]
push 0x42e5f4
call fcn.0040d399
add esp, 0x14
call fcn.00410541
push dword [0x42f0b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x80]
mov dword [0x42f0b0], ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov byte [0x42f175], 1
pop esi
pop ebx
leave
ret
call fcn.00411ce2
push 1
call fcn.00417f53