Function at 0x418380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b7d0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4cb06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x418779
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x4183e1
sub esp, 0x10
call fcn.00418d90
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x138
jne 0x41842d
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x104]
je 0x4183fb
cmp eax, dword [esi + 0x108]
jne 0x418409
push 0x191514
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x1ac]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x2b
jne 0x41848a
movzx eax, word [ebp + 0x10]
sub eax, 0x5e0
je 0x418457
sub eax, 1
je 0x41844f
sub eax, 5
jne 0x418468
lea ecx, [esi + 0x13c]
jmp 0x41845a
lea ecx, [esi + 0x98]
jmp 0x41845a
lea ecx, [esi + 0x5c]
push dword [esi + 0x1ac]
push dword [ebp + 0x14]
call fcn.0041c460
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x14
jne 0x4184b5
sub esp, 0x10
call fcn.004195e0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x4e
jne 0x41858a
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffe
je 0x4184d2
cmp eax, 0xfffffffc
jne 0x418568
mov eax, dword [ecx]
cmp eax, dword [esi + 0x58]
jne 0x418568
mov ebx, dword [esi + 0x19c]
mov ecx, dword [ebx - 0x10]
lea esi, [ebx - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, eax
lea eax, [esi + 0xc]
shr ecx, 0x1f
test cl, cl
jne 0x418506
cmp edx, dword [esi]
jne 0x418506
lock inc dword [eax]
jmp 0x418532
mov eax, dword [edx]
lea edi, [esi + 4]
push 2
push dword [edi]
mov ecx, edx
call dword [eax]
mov esi, eax
test esi, esi
je 0x41878f
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov edx, dword [edi]
inc edx
push edx
push ebx
call fcn.00403720
add esp, 8
push 1
push 0
push 0
add esi, 0x10
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esi, 0xfffffff0
mov dword [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418568
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x18
jne 0x41860c
cmp dword [ebp + 0x10], 0
je 0x4185dc
mov eax, dword [0x4d07b8]
test eax, eax
jne 0x4185ac
push 0x5e0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [0x4d07b8], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x113
jne 0x41863d
sub esp, 8
push dword [ebp + 0x10]
push ecx
call fcn.00419820
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x111
jne 0x418779
movzx eax, word [ebp + 0x10]
mov ecx, 0x5e0
cmp cx, ax
jne 0x4186c5
add dword [esi + 0x1c4], 0xffffffff
mov eax, dword [esi + 0x1c4]
jns 0x418674
mov dword [esi + 0x1c4], 2
mov eax, 2
push dword [esi + 0x1ac]
lea ecx, [esi + 0x178]
push eax
call fcn.0041cd00
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x1b58
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x5e1
cmp cx, ax
jne 0x41873d
inc dword [esi + 0x1c4]
mov eax, dword [esi + 0x1c4]
cmp eax, 2
jle 0x4186ec
mov dword [esi + 0x1c4], 0
xor eax, eax
push dword [esi + 0x1ac]
lea ecx, [esi + 0x178]
push eax
call fcn.0041cd00
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x1b58
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x5e6
cmp cx, ax
jne 0x41876f
sub esp, 0x10
mov ecx, esi
call fcn.00419ed0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 2
cmp cx, ax
je 0x418747
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.00403710
int3