Function at 0x405ac4
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x41c194]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
movzx ebx, dx
mov eax, ecx
mov esi, ebx
mov dword [esp + 0xc], eax
push edi
cmp esi, 0x40
ja 0x40646c
je 0x406431
push 0x15
pop ecx
cmp esi, ecx
ja 0x405fd7
je 0x40612b
cmp esi, 5
ja 0x405f64
je 0x405ede
sub esi, 1
je 0x405eca
sub esi, 1
je 0x405d19
push 0
pop edi
sub esi, 1
je 0x405b43
sub esi, 1
je 0x405b75
xor eax, eax
jmp 0x4065b4
inc word [0x41cf62]
cmp dword [0x41c268], 0
mov eax, dword [0x41c19c]
mov dword [0x41e620], eax
jne 0x405b71
push edi
push edi
mov edx, 0x41e040
call fcn.00408593
test eax, eax
jne 0x4065b1
mov eax, dword [esp + 0x10]
cmp ebx, 4
jne 0x405b81
inc word [0x41cf64]
cmp dword [0x41c268], 0
mov ebx, 0x4015c8
mov dword [esp + 0x10], edi
mov edx, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], edi
jne 0x405ba2
mov edx, 0x41e040
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.00405916
mov esi, eax
test esi, esi
jns 0x405c9b
cmp esi, 0x800704c7
je 0x405c93
cmp dword [0x41c268], 0
jne 0x405bd7
mov ebx, 0x41e040
push 0x208
mov esi, 0x80004005
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov dword [esp + 0x20], eax
test eax, eax
je 0x405c8b
push ebx
mov edx, 0x104
mov ecx, eax
call fcn.00405313
mov eax, dword [esp + 0x20]
mov dword [0x41e49c], eax
mov eax, dword [0x41c204]
mov dword [0x41e4b0], eax
xor eax, eax
inc eax
mov dword [0x41e4b4], 0x888866
push 0xfffffffffffffffe
mov dword [0x41e4c8], 0xf
mov dword [0x41e4c4], 0x407c10
mov dword [0x41e48c], 0x41e580
mov dword [0x41e4bc], 0x4015dc
mov dword [0x41d1b8], eax
mov dword [0x41e498], eax
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x41e480
mov ebx, eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x405c74
call fcn.00405348
mov esi, eax
jmp 0x405c76
mov esi, edi
push ebx
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
test esi, esi
jns 0x405c8b
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov dword [esp + 0x14], 1
test esi, esi
js 0x405ebe
push 0x1fa
lea eax, [esp + 0x74]
push edi
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
je 0x405cc4
push ecx
lea edx, [esp + 0x74]
mov ecx, ebx
call fcn.004197e9
mov esi, eax
test esi, esi
js 0x405cd3
cmp dword [esp + 0x14], 0
jne 0x405cd3
lea edi, [esp + 0x70]
mov edx, dword [esp + 0x20]
push edi
push 1
call fcn.00408593
test eax, eax
je 0x405cf6
push dword [esp + 0x20]
mov edx, 0x104
mov ecx, 0x41e040
call fcn.00405313
test ebx, ebx
je 0x405d0a
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x41f4a8]
call esi
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0x4065b1
call fcn.004067b2
test eax, eax
je 0x4065b1
mov ebx, dword [0x41c19c]
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.00405742
mov esi, eax
xor edi, edi
test esi, esi
jns 0x405e18
cmp esi, 0x800704c7
je 0x405e0a
push 0x208
mov esi, 0x80004005
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x405e0e
push 0x4015c8
mov edx, 0x104
mov dword [0x41e49c], eax
mov ecx, eax
call fcn.00405313
mov eax, dword [0x41c208]
push 0xfffffffffffffffe
mov dword [0x41e4b0], eax
mov dword [0x41e48c], 0x41e4e0
mov dword [0x41e4bc], 0x4015dc
mov dword [0x41e4b4], 0x881064
mov dword [0x41e498], 1
mov dword [0x41e4c8], 0xf
mov dword [0x41e4c4], 0x407da0
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x41e480
mov ebx, eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
jne 0x405def
call fcn.00405348
mov esi, eax
jmp 0x405df1
mov esi, edi
push ebx
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
test esi, esi
jns 0x405e06
push dword [esp + 0x1c]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
test esi, esi
js 0x405eb8
jmp 0x405e1c
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x41e6dc]
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x41e6dc], eax
lea eax, [esp + 0x34]
push eax
push edi
push 0x41e040
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
mov edi, 0x41cf60
push ecx
sbb eax, eax
and eax, dword [esp + 0x58]
push ecx
mov edx, eax
mov ecx, edi
call fcn.00416eb7
call fcn.00417314
push 8
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.004070f4
mov ecx, eax
call fcn.00417260
mov edx, dword [0x41c19c]
mov ecx, dword [esp + 0x1c]
call fcn.00408b35
test eax, eax
jne 0x405ea6
mov eax, dword [esp + 0x14]
mov esi, 0x80004005
mov dword [0x41e6dc], eax
push dword [esp + 0x1c]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test esi, esi
jns 0x4065b1
mov dword [0x41c19c], ebx
mov ecx, esi
call fcn.0040791e
jmp 0x4065b1
inc word [0x41cf60]
xor ecx, ecx
inc ecx
call fcn.004092db
jmp 0x4065b1
mov esi, 0x41e680
mov ecx, esi
call fcn.00408151
test eax, eax
jne 0x405f27
xor edi, edi
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
cmp eax, 0x100b
je 0x405f0b
cmp eax, 0x1009
je 0x405f0b
cmp eax, 0x100c
jne 0x405f5a
call fcn.00405363
mov ecx, esi
mov dword [0x41e68c], edi
mov dword [0x41e688], edi
call fcn.00408151
test eax, eax
je 0x405ef0
push 0x41de80
push 0x28
pop edx
mov ecx, 0x41df20
call fcn.00405313
push 0x41ded0
push 0x28
pop edx
mov ecx, 0x41df70
call fcn.00405313
mov dword [0x41d1b0], 1
jmp 0x4065b1
call fcn.00407944
jmp 0x4065b1
sub esi, 6
je 0x405fb3
sub esi, 1
je 0x405fa1
sub esi, 8
je 0x4065b1
sub esi, 1
jne 0x405b3c
inc word [0x41cf68]
xor edi, edi
push edi
push edi
push 0xc7
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4065b1
xor edi, edi
push edi
push edi
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4065b1
inc word [0x41cf66]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
xor ecx, ecx
mov esi, eax
call fcn.004164d5
push esi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
jmp 0x4065b1
cmp esi, 0x1a
ja 0x40617d
je 0x406171
sub esi, 0x16
je 0x406117
sub esi, 1
je 0x4060be
sub esi, 1
je 0x406065
sub esi, 1
jne 0x405b3c
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetMenu]
xor edi, edi
mov esi, eax
push edi
push edi
push 0xe
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push edi
push 0xb1
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0xb7
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x19
push 1
push esi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x4065b1
inc word [0x41cf76]
xor edi, edi
push edi
push 0x4079e0
push dword [0x41d1dc]
push 0xe
push dword [0x41dfd8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
jne 0x4065b1
mov eax, dword [0x41dfc0]
push edi
dec eax
push eax
push 0xbb
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x4065b1
mov ecx, eax
call fcn.004054e2
jmp 0x4065b1
inc word [0x41cf74]
mov eax, dword [0x41d1d0]
test eax, eax
je 0x4060da
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4065b1
push 0x41e640
mov dword [0x41e64c], 0x10010
mov dword [0x41e654], 0x41e360
mov dword [0x41e658], 0x800080
mov dword [0x41e650], 0x41e260
call dword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov dword [0x41d1d0], eax
jmp 0x4065b1
cmp word [0x41e260], 0
je 0x40612b
call fcn.0041506c
jmp 0x4065b1
cmp bx, cx
jne 0x406137
inc word [0x41cf72]
mov eax, dword [0x41d1d0]
test eax, eax
jne 0x4060ce
and dword [0x41e654], eax
push 0x41e640
mov dword [0x41e64c], 0x10001
mov dword [0x41e658], 0x80
mov dword [0x41e650], 0x41e260
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x40610d
xor ecx, ecx
call fcn.00408245
jmp 0x4065b1
push 0x1b
pop ebx
sub esi, ebx
je 0x4063a7
sub esi, 5
je 0x4062c0
sub esi, 1
jne 0x405b3c
inc word [0x41cf78]
lea eax, [esp + 0x34]
push 0x3c
pop ebx
push ebx
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4065b1
mov eax, dword [esp + 0x10]
push 0x2d0
mov dword [esp + 0x38], ebx
mov ebx, 0x41dfe0
push 0x5a
push esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push dword [0x41c26c]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [esp + 0x48], 0x1010041
mov dword [0x41dfe0], eax
mov eax, 0x2000
push esi
push edi
mov word [esp + 0x6c], ax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov edi, eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
test esi, esi
je 0x4065b1
push dword [0x41dfd0]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x2d0
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push ebx
mov dword [0x41dfe0], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov esi, eax
test esi, esi
je 0x4062a5
push dword [0x41dfdc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 1
push esi
push 0x30
push dword [0x41d1d4]
mov dword [0x41dfdc], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x44]
mov dword [0x41c26c], eax
push dword [0x41dfcc]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x41d1ac], 1
jmp 0x4065b1
mov ecx, dword [0x41d1bc]
neg ecx
sbb ecx, ecx
and ecx, 0x100000
add ecx, 0x50200104
call fcn.00415238
test eax, eax
je 0x4062fb
xor eax, eax
mov dword [0x41d1b4], 1
cmp dword [0x41d1bc], eax
sete al
mov dword [0x41d1bc], eax
jmp 0x40631a
push 0x30
push dword [0x41c244]
push dword [0x41c228]
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x41d1bc]
test eax, eax
je 0x40636a
mov eax, dword [0x41d1cc]
xor edi, edi
mov dword [0x41d1c8], eax
test eax, eax
je 0x406340
mov eax, dword [esp + 0x10]
push edi
push ebx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetMenu]
push edi
push ebx
mov esi, eax
push 3
push esi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push ebx
push 3
jmp 0x406052
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetMenu]
xor edi, edi
push edi
push ebx
push 3
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp dword [0x41d1c8], edi
je 0x4065b1
mov eax, dword [esp + 0x10]
push edi
push ebx
push 0x111
push eax
jmp 0x405f96
lea eax, [esp + 0x24]
push eax
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x41d1cc], 0
je 0x4063ed
xor edi, edi
push edi
push dword [0x41d1d8]
mov dword [0x41d1cc], edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
call fcn.0040543e
jmp 0x406422
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov dword [0x41d1cc], 1
call fcn.0040543e
xor ecx, ecx
inc ecx
call fcn.004073b8
push 5
push dword [0x41d1d8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x41d1b4], 1
jmp 0x4065b1
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x401634
push eax
push 1
push 0x38f
xor edi, edi
mov dword [esp + 0x20], 2
push edi
call dword [sym.imp.ntdll.dll_WinSqmAddToStream]
push 1
push edi
push edi
push 0x401670
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4065b1
cmp esi, 0x41
je 0x406569
cmp esi, 0x2ff
jbe 0x405b3c
mov eax, 0x302
xor edi, edi
lea ecx, [eax - 1]
cmp esi, ecx
jbe 0x40649f
cmp esi, eax
je 0x4064fd
cmp esi, 0x303
jne 0x405b3c
mov eax, 0x300
cmp bx, ax
jne 0x4064b2
inc word [0x41cf6a]
jmp 0x4064c7
cmp bx, cx
jne 0x4064c0
inc word [0x41cf6c]
jmp 0x4064c7
inc word [0x41cf70]
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edi
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edi
push eax
push 0xb0
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x4065b1
mov eax, 0x302
cmp bx, ax
jne 0x406548
inc word [0x41cf6e]
cmp dword [0x41d1a8], edi
jne 0x406548
push 0x1fa
lea eax, [esp + 0x74]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.0041993e
test eax, eax
js 0x406548
cmp word [esp + 0x70], di
je 0x406548
lea ecx, [esp + 0x70]
call fcn.00408099
inc word [0x41cf7e]
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [0x41d1d4]
cmp eax, ecx
je 0x406560
cmp eax, dword [0x41d1dc]
jne 0x4065b1
push edi
push edi
push esi
push ecx
jmp 0x405fa8
mov eax, dword [0x41dfd8]
xor edi, edi
mov dword [esp + 0x14], eax
mov esi, edi
mov eax, dword [0x41dfd4]
mov dword [esp + 0x18], eax
push 2
push dword [esp + esi*4 + 0x18]
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x406597
inc esi
cmp esi, 2
jb 0x40657f
jmp 0x406599
mov edi, eax
push edi
push 0x4016f0
push dword [0x41c244]
push dword [0x41d1dc]
call dword [sym.imp.SHELL32.dll_ShellAboutW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041b4e0
mov esp, ebp
pop ebp
ret 4