Function at 0x401c9a
Capabilities:
Create process on windows

Disassembly:
push ebx
push edi
sub esp, 0x30
mov eax, esp
mov edx, eax
add edx, 0x30
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x401ca6
call fcn.00407c50
mov dword [esp], eax
call fcn.0040b410
and eax, eax
je 0x401cc6
jmp 0x401cbb
call fcn.0040b5d0
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x14]
push dword [esp + 4]
call fcn.0040b610
add ebx, eax
push dword [esp + 4]
call fcn.0040b660
mov edi, eax
add edi, 0xffffff06
mov eax, edi
mov edi, 2
cdq
idiv edi
mov edi, eax
add ebx, edi
add ebx, 0xffffffe2
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x14]
and ebx, ebx
jge 0x401d14
mov dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
push dword [esp + 4]
call fcn.0040b6a0
add ebx, eax
push dword [esp + 4]
call fcn.0040b6f0
mov edi, eax
add edi, 0xffffff8d
mov eax, edi
mov edi, 2
cdq
idiv edi
mov edi, eax
add ebx, edi
mov dword [esp + 0x18], ebx
push dword [esp + 4]
call fcn.0040b750
push eax
push 0xc80000
push str.Info
push 0x73
push 0xfa
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 0xffffffff
call fcn.0040aed0
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x401d98
push dword [esp + 0x1c]
call fcn.0040b750
push eax
call fcn.00407a10
and eax, eax
je 0x401d98
mov eax, 1
jmp 0x401d9a
xor eax, eax
and eax, eax
je 0x401fd0
push 1
push dword [esp + 8]
call fcn.0040b780
push dword [0x4109c0]
push 0xffffffff
call fcn.00407a40
push 1
push str.PopSel___ver._2.36
push 0x14
push 0xd2
push 0xf
push 0xa
push 0xffffffff
call fcn.00407cb0
push 1
push 0x40f02d
push 0x14
push 0xd2
push 0x23
push 0xa
push 0xffffffff
call fcn.00407cb0
push 1
push 0xff
push str.http:__home.mnet_online.de_horst.muc_win_
push 0x14
push 0xe6
push 0x3c
push 0x14
push 0xffffffff
call fcn.0040823f
mov dword [esp + 0x20], eax
push 0xff
push str.mailto:horst.schaeffer_gmx.net
push 0x14
push 0xd2
push 0x50
push 0x28
push 0xffffffff
call fcn.0040837b
mov dword [esp + 0x24], eax
push 0xff0000
push 1
push dword [esp + 0x28]
call fcn.004083a0
push 0xff0000
push 1
push dword [esp + 0x2c]
call fcn.004083a0
push 1
push 0xd
push dword [esp + 0x24]
call fcn.0040b2d0
push 2
push 0x1b
push dword [esp + 0x24]
call fcn.0040b2d0
mov dword [esp + 0x28], 0
call fcn.0040b57f
mov dword [esp + 0x10], eax
call fcn.0040b7c0
mov ebx, eax
cmp ebx, dword [esp + 0x1c]
je 0x401edc
jmp 0x401f9b
mov ebx, dword [esp + 0x10]
cmp ebx, 0x332d
jne 0x401ef3
call fcn.0040b590
mov dword [esp + 0x28], eax
jmp 0x401f1b
mov ebx, dword [esp + 0x10]
cmp ebx, 0x332c
jne 0x401f0a
call fcn.0040b7e0
mov dword [esp + 0x28], eax
jmp 0x401f1b
mov ebx, dword [esp + 0x10]
cmp ebx, 0x10
jne 0x401f1b
mov dword [esp + 0x28], 2
mov ebx, dword [esp + 0x28]
cmp ebx, dword [esp + 0x20]
je 0x401f30
mov ebx, dword [esp + 0x28]
cmp ebx, 1
je 0x401f30
jmp 0x401f37
mov eax, 1
jmp 0x401f39
xor eax, eax
and eax, eax
je 0x401f4d
mov edx, str.http:__home.mnet_online.de_horst.muc_win_
lea ecx, [esp + 0x2c]
call fcn.00406010
jmp 0x401f65
mov ebx, dword [esp + 0x28]
cmp ebx, dword [esp + 0x24]
jne 0x401f65
mov edx, str.mailto:horst.schaeffer_gmx.net
lea ecx, [esp + 0x2c]
call fcn.00406010
mov edx, dword [esp + 0x2c]
xor ecx, ecx
call fcn.004122c0
jne 0x401f9b
push 1
push 0
push 0
push dword [esp + 0x38]
push str.open
push dword [esp + 0x18]
call fcn.0040b750
push eax
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x401fa8
mov ebx, dword [esp + 0x28]
cmp ebx, 2
jne 0x401eb9
push dword [esp + 0x1c]
call fcn.0040ac80
push 0
push dword [esp + 8]
call fcn.0040b780
push dword [esp + 4]
call fcn.0040b800
push dword [esp]
call fcn.00407c10
xor eax, eax
push dword [esp + 0x2c]
call fcn.0040d700
add esp, 0x30
pop edi
pop ebx
ret