Function at 0x422eb0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5971a7
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x30c]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 0
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004bf2a0
push eax
lea ecx, [ebp - 0x220]
call fcn.00427350
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 2
call fcn.00435e46
mov eax, dword [ebp - 0x220]
mov edx, str.closebtn
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x422f66
test si, si
je 0x422f62
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x422f66
add ecx, 4
add edx, 4
test si, si
jne 0x422f40
xor ecx, ecx
jmp 0x422f6b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete dl
test dl, dl
je 0x422f82
push 2
mov ecx, edi
call fcn.0043de4b
jmp 0x4232fe
mov edx, str.opt_user
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x422fb6
test si, si
je 0x422fb2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x422fb6
add ecx, 4
add edx, 4
test si, si
jne 0x422f90
xor ecx, ecx
jmp 0x422fbb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
je 0x422ffb
mov ecx, dword [ebp - 0x21c]
mov ecx, dword [ecx + 0x108]
call fcn.0043eea1
mov ecx, dword [edi + 0x474]
test al, al
mov eax, dword [ecx]
je 0x422fee
push 0
call dword [eax + 0x104]
jmp 0x4232fe
push 1
call dword [eax + 0x104]
jmp 0x4232fe
mov ecx, str.btn_user
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x423026
test dx, dx
je 0x423022
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x423026
add eax, 4
add ecx, 4
test dx, dx
jne 0x423000
xor eax, eax
jmp 0x42302b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x42303f
push ecx
call fcn.004235d0
jmp 0x4232fe
mov edx, str.btn_selpath
lea ecx, [ebp - 0x220]
call fcn.00424f80
test al, al
je 0x423160
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
call fcn.00427780
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push 0x5f86e4
push eax
call fcn.00425da0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004cbb60
add esp, 0x14
mov dword [ebp - 0x288], 0
xorps xmm0, xmm0
mov dword [ebp - 0x26c], 0
mov ecx, edi
movq qword [ebp - 0x274], xmm0
movups xmmword [ebp - 0x284], xmm0
call fcn.0043dfc5
mov esi, dword [ebp - 0x21c]
mov ecx, 1
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x280], eax
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x4230fe
push 0
lea ecx, [ebp - 0x21c]
call fcn.00427130
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x288]
mov dword [ebp - 0x27c], esi
push eax
mov dword [ebp - 0x278], 0x40
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42313b
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.004224c0
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4232fe
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4232fe
mov edx, str.btn_install1
lea ecx, [ebp - 0x220]
call fcn.00424f80
test al, al
jne 0x4232c6
mov edx, str.btn_install2
lea ecx, [ebp - 0x220]
call fcn.00424f80
test al, al
jne 0x4232c6
mov edx, str.btn_install3
lea ecx, [ebp - 0x220]
call fcn.00424f80
test al, al
jne 0x4232c6
mov edx, str.openmain
lea ecx, [ebp - 0x220]
call fcn.00424f80
test al, al
je 0x4232fe
push 0x5f8268
lea edx, [edi + 0x498]
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x224]
call fcn.00424fd0
add esp, 4
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
call fcn.00427780
mov byte [ebp - 4], 5
lea eax, [ebp - 0x21c]
push dword [ebp - 0x224]
push 0x5f8580
push eax
call fcn.00425da0
mov esi, dword [ebp - 0x21c]
mov ecx, 1
add esp, 0xc
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x42323e
push 0
lea ecx, [ebp - 0x21c]
call fcn.00427130
mov esi, dword [ebp - 0x21c]
push 0x44
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.004cbb60
add esp, 0xc
mov dword [ebp - 0x268], 0x44
mov eax, 1
mov dword [ebp - 0x23c], 1
mov word [ebp - 0x238], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push esi
push 0
movups xmmword [ebp - 0x278], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 1
mov ecx, edi
mov byte [edi + 0x4a8], 1
call fcn.0043de4b
lea ecx, [ebp - 0x21c]
call fcn.00424eb0
lea ecx, [ebp - 0x224]
call fcn.00424eb0
jmp 0x4232fe
mov ecx, dword [ebp - 0x21c]
push 0
mov ecx, dword [ecx + 0x108]
mov dword [edi + 0x470], ecx
mov eax, dword [ecx]
call dword [eax + 0x104]
push 0
push 0
push edi
push 0x420da0
push 0
push 0
call fcn.004d2cee
add esp, 0x18
mov dword [edi + 0x4a4], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x423323
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret 4