Function at 0x4077e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xffffffffffffffff
push 0x475cac
mov eax, dword fs:[0]
push eax
sub esp, 0x8c8
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x8c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x8dc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8ec]
xor ebx, ebx
test byte [0x4b17fc], 1
mov esi, ecx
mov edi, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
mov byte [edi], bl
mov dword [esp + 0x20], ebx
jne 0x407868
or dword [0x4b17fc], 1
push ebx
mov ecx, 0x4b17d4
call fcn.00469b10
mov ecx, 0x4b17ec
call fcn.0046da70
push 0x479d30
call fcn.00446932
add esp, 4
push str.urlguide_version
push 0x4829b8
push 0x4b17d4
call fcn.0041ae70
cmp eax, ebx
je 0x4078b6
mov ecx, eax
lea ebp, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x407885
sub ecx, ebp
sar ecx, 1
je 0x4078b6
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
lea ecx, [esp + 0x20]
push ecx
mov ebp, eax
call fcn.0041a460
add esp, 4
test al, al
je 0x4078ef
cmp ebp, dword [esp + 0x20]
jg 0x4078fa
push 0x482b30
mov ecx, 0x4ad828
call fcn.0040c400
mov al, 1
mov ecx, dword [esp + 0x8dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8c0]
xor ecx, esp
call fcn.0044610a
add esp, 0x8d4
ret
mov ebp, esi
mov ecx, ebp
call fcn.0046c290
jmp 0x4078fc
mov ebp, esi
test byte [0x4b17c8], 1
mov byte [edi], 1
jne 0x407922
or dword [0x4b17c8], 1
push 0x479d00
mov byte [0x4b17b4], bl
call fcn.00446932
add esp, 4
mov edi, 0x482b60
mov ecx, 0x4b17b0
call fcn.00410490
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad954]
je 0x407949
mov edi, 0x4ad950
call fcn.0040bd10
mov edx, dword [0x4ad954]
push 0x68
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x407968
push 0x482b7c
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x407987
push 0x482b7c
push 0x482c68
mov edi, 0x482c68
call fcn.00410330
push esi
push ebp
call fcn.00406fb0
add esp, 8
test al, al
jne 0x4079d6
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad82c]
je 0x4079ad
mov edi, 0x4ad828
call fcn.0040bd10
push 0x482ba4
mov ecx, 0x4ad828
call fcn.0040c400
push 0x482970
mov ecx, ebp
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
xor al, al
jmp 0x4078c7
push 0x482bc8
mov ecx, 0x4ad828
call fcn.0040c400
mov esi, dword [0x4ad954]
mov edi, 0x4ad828
call fcn.0040bd10
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4ac7a4
call ebp
push 0x4ac7a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [esp + 0x7c]
call fcn.0041def0
lea esi, [esp + 0x6c]
mov dword [esp + 0x8e4], ebx
call fcn.00402860
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x8fc], 1
call fcn.0046e600
mov ecx, esi
call fcn.0046d3c0
mov ecx, edi
mov byte [esp + 0x8e4], 4
call fcn.0046d3c0
push ebx
push ebx
push ebx
push ebx
push 0x4829bc
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x60]
call fcn.0046e600
push 0x7fe
lea ecx, [esp + 0xda]
push ebx
mov byte [esp + 0x8ec], 5
push ecx
mov word [esp + 0xe0], bx
call fcn.004498f0
add esp, 0xc
push str.UserManager
call fcn.00402f70
add esp, 4
lea ecx, [esp + 0x48]
mov esi, eax
call fcn.0046d380
push eax
add esi, 0x5d8
push esi
push str.__s_scdreg.exe___makeUrlGuideBin___s_
lea edx, [esp + 0xe0]
push 0x104
push edx
call fcn.00446633
add esp, 0x14
push 0x40
lea eax, [esp + 0x94]
push ebx
push eax
call fcn.004498f0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x8c], 0x44
push 0x4ac78c
call ebp
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x90]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xf4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x24]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x28]
push edx
call esi
cmp dword [esp + 0x34], ebx
jne 0x407c0a
mov esi, dword [esp + 0x18]
push ebx
push ebx
push esi
lea ecx, [esp + 0x54]
call fcn.0046e300
test al, al
jne 0x407b7c
mov ecx, esi
call fcn.0046c290
push str.urlguide_version
push 0x4829b8
call fcn.0041a9a0
push eax
call fcn.0041ae70
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00468ff0
push esi
push 0x482c34
lea ecx, [esp + 0x40]
call fcn.00469230
mov ecx, eax
call fcn.00469230
lea ecx, [esp + 0x38]
call fcn.00468ae0
push eax
mov ecx, 0x4ad828
call fcn.0040c400
lea ecx, [esp + 0x38]
call fcn.00468ae0
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 8]
cmp ecx, ebx
je 0x407bea
push eax
push 0x482c68
mov edi, 0x482c68
call fcn.00410330
lea ecx, [esp + 0x38]
call fcn.00468c30
lea ecx, [esp + 0x48]
call fcn.0046d3c0
lea ecx, [esp + 0x5c]
call fcn.0046d3c0
jmp 0x4078c5
push 0x482c78
mov ecx, 0x4ad828
call fcn.0040c400
mov ecx, dword [esp + 0x18]
push 0x482c9c
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x48]
call fcn.0046d3c0
lea ecx, [esp + 0x5c]
call fcn.0046d3c0
xor al, al
jmp 0x4078c7