Function at 0x40cd60
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x624637
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x6ba4f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004394c0
mov esi, eax
call fcn.00401720
mov ecx, eax
test ecx, ecx
je 0x40d2f9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4e4], eax
push esi
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 1
call fcn.0040de10
test al, al
jne 0x40cdfb
push esi
lea ecx, [ebp - 0x4e4]
call fcn.0040e000
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 3
call fcn.00439270
mov esi, dword [ebp - 0x4e4]
mov ecx, str.sysclosebutton
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ce3d
test dx, dx
je 0x40ce39
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ce3d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ce17
xor eax, eax
jmp 0x40ce42
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d2aa
mov ecx, str.btn_cancel
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ce77
test dx, dx
je 0x40ce73
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ce77
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ce51
xor eax, eax
jmp 0x40ce7c
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d2aa
mov ecx, str.sysminbutton
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ceb6
test dx, dx
je 0x40ceb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ceb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ce90
xor eax, eax
jmp 0x40cebb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ceca
push eax
push 0xf020
jmp 0x40d2b1
mov ecx, str.btn_inst
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cef7
test dx, dx
je 0x40cef3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cef7
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ced1
xor eax, eax
jmp 0x40cefc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d02b
mov ecx, dword [edi + 0x778]
push 1
mov eax, dword [ecx]
call dword [eax + 0x218]
mov ecx, dword [edi + 0x774]
push 0
mov eax, dword [ecx]
call dword [eax + 0x118]
push 0
mov ecx, edi
call fcn.0040cca0
lea eax, [edi + 0x788]
push eax
call fcn.0041eb97
add esp, 4
test eax, eax
jne 0x40cf50
push 0x6a576c
lea ecx, [edi + 0x788]
call fcn.004065a0
cmp dword [edi + 0x79c], 8
lea eax, [edi + 0x788]
jb 0x40cf61
mov eax, dword [eax]
push eax
call fcn.00406430
mov ecx, eax
call fcn.0042186a
push 0
push 0x6c5b68
push 0x6c5994
push 0
push str.opt_startService
lea ecx, [edi + 0x30]
call fcn.0042d830
push eax
call fcn.00529db5
add esp, 0x14
test eax, eax
je 0x40cfad
mov ecx, eax
call fcn.00437be0
movzx eax, al
push eax
call fcn.00406430
mov ecx, eax
call fcn.004217e6
lea eax, [edi + 0x76c]
mov dword [edi + 0x7a0], 1
mov dword [ebp - 0x4dc], eax
call fcn.0040bc20
lea edx, [edi + 0x76c]
lea ecx, [eax + 4]
mov dword [ebp - 0x4e0], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ecx, eax
je 0x40cfec
cmp dword [ecx], edx
je 0x40d00c
add ecx, 4
cmp ecx, eax
jne 0x40cfe1
mov ecx, dword [ebp - 0x4e0]
cmp dword [ecx + 8], eax
je 0x40cfff
mov dword [eax], edx
add dword [ecx + 4], 4
jmp 0x40d00c
lea edx, [ebp - 0x4dc]
push edx
push eax
call fcn.0040e320
push 0
push 0
push edi
push 0x40c4f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x7a4], eax
jmp 0x40d2bd
mov ecx, str.btn_browser
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d058
test dx, dx
je 0x40d054
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d058
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d032
xor eax, eax
jmp 0x40d05d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d1cf
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.004394c0
push eax
lea ecx, [ebp - 0x4dc]
call fcn.0040dc60
mov eax, dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x42a]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x454]
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x43c], eax
xor eax, eax
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x42c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x440], 0x40dce0
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
mov byte [ebp - 4], 5
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x454]
test ecx, ecx
push dword [ebp - 0x18]
cmove ecx, eax
xor eax, eax
mov dword [ebp - 0x454], ecx
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40d1b9
test byte [ebp - 0x444], 1
je 0x40d186
lea ecx, [ebp - 0x222]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40d1b6
lea eax, [ebp - 0x222]
mov ecx, edi
push eax
call fcn.0040c6b0
test eax, eax
je 0x40d1b6
mov ecx, dword [edi + 0x770]
test ecx, ecx
je 0x40d1b6
add edi, 0x788
cmp dword [edi + 0x14], 8
jb 0x40d1b0
mov edi, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4dc]
jmp 0x40d290
mov ecx, str.btn_ok
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d1fc
test dx, dx
je 0x40d1f8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d1fc
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d1d6
xor eax, eax
jmp 0x40d201
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d20e
push eax
push eax
push 0x10
jmp 0x40d2b6
mov ecx, str.btn_license
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d23b
test dx, dx
je 0x40d237
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d23b
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d215
xor eax, eax
jmp 0x40d240
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d2bd
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.004394c0
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0040dc60
push 1
push 0
push 0
push dword [ebp - 0x4e0]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x4e0]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d2bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40d2bd
push 0
push 0xf060
push 0x112
mov ecx, edi
call fcn.0043cde0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d2dc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fa22
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040bef0
int3