Function at 0x40a3b0
Capabilities:
Create process on windows
Create thread
Hide graphical window
Read .ini file

Disassembly:
sub esp, 0x854
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x84c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2985
jg 0x40b048
je 0x40afa0
add ecx, 0xffffd897
cmp ecx, 0x39
ja case.default.0x40b057
movzx eax, byte [ecx + 0x40b4dc]
jmp dword [eax*4 + 0x40b44c]
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
cmp eax, 5
jne 0x40a421
push 0xb
jmp 0x40a423
push 0xa
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.default.0x40b057
mov dword [0x4ce7fc], 1
push 0
push 0x40e350
push dword [0x4def88]
push 0x4adef0
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.default.0x40b057
push 0
push 0x40e350
push dword [0x4def88]
mov dword [0x4ce7fc], 2
push 0x4adef0
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x2778
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_EnableWindow]
push eax
call esi
push 0
push 0x2779
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b057
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0x277b
push dword [0x4def88]
call edi
mov edx, 0x4adf0c
mov ecx, eax
call fcn.0040f0a0
jmp 0x40a495
mov edx, 0x4adf24
mov ecx, 0x4adf0c
call fcn.0040f2b0
test eax, eax
je 0x40a48f
call fcn.0040d920
jmp 0x40a48f
mov dword [0x4ce7fc], 0xb
jmp 0x40a444
push 0
push 0x40e350
push dword [0x4def88]
mov dword [0x4ce7fc], 0xc
push 0x4adef0
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x277d
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_EnableWindow]
push eax
call esi
push 0
push 0x277e
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b057
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0x2780
push dword [0x4def88]
call edi
mov ecx, eax
call fcn.0040eea0
jmp 0x40a53c
push 1
mov edx, 0x4adf58
mov ecx, 0x4adf3c
call fcn.0040f3f0
add esp, 4
test eax, eax
je 0x40a536
push 0
mov edx, 0x4adf74
mov ecx, 0x4adf90
call fcn.0040f3f0
add esp, 4
call fcn.0040d490
jmp 0x40a536
mov dword [0x4ce7fc], 0x15
jmp 0x40a444
push 0
push 0x40e350
push dword [0x4def88]
mov dword [0x4ce7fc], 0x16
push 0x4adef0
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x2782
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_EnableWindow]
push eax
call esi
push 0
push 0x2783
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b057
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0x2785
push dword [0x4def88]
call edi
mov edx, 0x4adfa8
mov ecx, eax
call fcn.0040f0a0
jmp 0x40a5fa
mov edx, 0x4adfc8
mov ecx, 0x4adfa8
call fcn.0040f2b0
test eax, eax
je 0x40a5f4
call fcn.0040d740
jmp 0x40a5f4
push 0x4ded80
push 0x4ad0a4
push 0x4adfe8
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 0x4ad374
jmp 0x40a66e
mov esi, dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
push 0x4ded80
push 0x4ad370
push 0x4adfe8
push 0x4adff8
call esi
mov edx, 0x4ad0e0
mov ecx, 0x4ae00c
call fcn.004773a0
lea edx, [esp + 0x58]
mov ecx, eax
call fcn.00475e00
test eax, eax
je 0x40a6df
push 0x4ded80
lea eax, [esp + 0x5c]
push eax
push 0x4ae018
push 0x4adff8
call esi
call fcn.0040e2b0
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae028
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a72e
push 0x4ad0e0
push 0x4ae028
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae028
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae038
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a78d
push 0x4ad0e0
push 0x4ae038
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae038
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae04c
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a7ec
push 0x4ad0e0
push 0x4ae04c
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae04c
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae068
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a84b
push 0x4ad0e0
push 0x4ae068
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae068
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae07c
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a8aa
push 0x4ad0e0
push 0x4ae07c
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae07c
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae090
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a909
push 0x4ad0e0
push 0x4ae090
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae090
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae0ac
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a968
push 0x4ad0e0
push 0x4ae0ac
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae0ac
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ded80
push 3
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae0c0
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40a9c7
push 0x4ad0e0
push 0x4ae0c0
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
push 0x4ad0a4
push 0x4ae0c0
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.default.0x40b057
mov eax, dword [0x4dde90]
cmp eax, 0xe7
jl 0x40a9f4
cmp eax, 0xe9
jle 0x40aa12
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x2769
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x276a
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x4c]
mov dword [0x4c5188], 1
push eax
push 0
push 0
push 0x40f590
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40b057
cmp dword [0x4c5188], 0
je case.default.0x40b057
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x276a
push dword [0x4def88]
mov dword [0x4c5188], 0
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x2769
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b057
call dword [sym.imp.user32.dll_CreatePopupMenu]
mov edx, 0x4ade88
mov ecx, 0x4ad090
mov ebp, eax
call fcn.004773a0
mov ebx, dword [sym.imp.user32.dll_AppendMenuW]
push eax
push 0x2988
push 0
push ebp
call ebx
mov edi, dword [sym.imp.user32.dll_LoadBitmapW]
push 0
push 0x755a
push dword [InitializeSListHead]
call edi
mov esi, dword [sym.imp.user32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x2988
push ebp
call esi
mov edx, 0x4ade90
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0x2989
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x2989
push ebp
call esi
mov edx, 0x4ade98
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0x298a
push 0
push ebp
call ebx
push 0
push 0x7549
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x298a
push ebp
call esi
push 0
push 0
push 0x800
push ebp
call ebx
mov edx, 0x4ad8c0
mov ecx, 0x4adea0
call fcn.004773a0
push eax
push 0x7540
push 0
push ebp
call ebx
push 0
push 0x7540
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x7540
push ebp
call esi
cmp dword [0x4de950], 0
jne 0x40abc0
mov edx, 0x4adeb4
mov ecx, ebp
call fcn.00461aa0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
push 0
push dword [0x4def88]
push 0
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 2
push ebp
call dword [sym.imp.user32.dll_TrackPopupMenu]
push ebp
mov esi, eax
call dword [sym.imp.user32.dll_DestroyMenu]
mov eax, esi
jmp 0x40b433
mov eax, dword [0x4dde90]
cmp eax, 1
jne 0x40ac23
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.default.0x40b057
cmp eax, 0xe7
jl 0x40ac31
cmp eax, 0xe9
jle 0x40ac4f
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x276f
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x410c90
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40b057
mov eax, dword [0x4dde90]
cmp eax, 1
je 0x40ac00
cmp eax, 0xe7
jl 0x40aca9
cmp eax, 0xe9
jle 0x40acc7
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x410fa0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40b057
mov eax, dword [0x4dde90]
cmp eax, 0xe7
jl 0x40acf7
cmp eax, 0xe9
jle 0x40ad15
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x279d
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x279e
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x4c]
mov dword [0x4c518c], 1
push eax
push 0
push 0
push 0x412b10
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40b057
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x279e
push dword [0x4def88]
mov dword [0x4c518c], 0
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x279d
push dword [0x4def88]
call edi
push eax
call esi
push 0
push 0x279e
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_EnableWindow]
push eax
call esi
push 0
push 0x279d
push dword [0x4def88]
call edi
push eax
call esi
jmp case.default.0x40b057
push 0x4ded80
push 6
lea eax, [esp + 0x54]
push eax
push 0
push 0x4ae0d4
push 0x4adff8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x4c], 0x31
push 0x4ded80
jne 0x40ae19
push 0x4ad0e0
push 0x4ae0d4
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
push 1
jmp 0x40ae30
push 0x4ad0a4
push 0x4ae0d4
push 0x4adff8
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
push 0
push 0x2776
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_EnableWindow]
jmp case.default.0x40b057
call dword [sym.imp.user32.dll_CreatePopupMenu]
mov edx, 0x4ade98
mov ecx, 0x4ad090
mov ebp, eax
call fcn.004773a0
mov ebx, dword [sym.imp.user32.dll_AppendMenuW]
push eax
push 0x298c
push 0
push ebp
call ebx
mov edi, dword [sym.imp.user32.dll_LoadBitmapW]
push 0
push 0x7549
push dword [InitializeSListHead]
call edi
mov esi, dword [sym.imp.user32.dll_SetMenuItemBitmaps]
push eax
push 0
push 0x298c
push ebp
call esi
mov edx, 0x4ade90
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0x298b
push 0
push ebp
call ebx
push 0
push 0x7530
push dword [InitializeSListHead]
call edi
push eax
push 0
push 0x298b
jmp 0x40ab68
mov eax, dword [0x4dde90]
cmp eax, 1
je 0x40ac00
cmp eax, 0xe7
jl 0x40aeed
cmp eax, 0xe9
jle 0x40af0b
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x27a3
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x4137c0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40b057
mov eax, dword [0x4dde90]
cmp eax, 1
je 0x40ac00
cmp eax, 0xe7
jl 0x40af65
cmp eax, 0xe9
jle 0x40af83
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x413be0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.default.0x40b057
mov eax, dword [0x4aded8]
movq xmm0, qword [0x4aded0]
mov dword [esp + 0x60], eax
mov ax, word [0x4adedc]
push 0xba
mov word [esp + 0x68], ax
lea eax, [esp + 0x6a]
push 0
push eax
movq qword [esp + 0x64], xmm0
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2776
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x1073
push 0x2776
push dword [0x4def88]
mov dword [esp + 0x3c], 0x64
call edi
push eax
call esi
mov eax, dword [0x4def88]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x60], 0x5c
jmp 0x40b3e6
add ecx, 0xffffd67a
cmp ecx, 9
ja case.default.0x40b057
jmp dword [ecx*4 + 0x40b518]
mov eax, dword [0x4aded8]
movq xmm0, qword [0x4aded0]
mov dword [esp + 0x60], eax
mov ax, word [0x4adedc]
push 0x1fa
mov word [esp + 0x68], ax
lea eax, [esp + 0x6a]
push 0
push eax
movq qword [esp + 0x64], xmm0
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x2776
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x1073
push 0x2776
push dword [0x4def88]
mov dword [esp + 0x3c], 0x104
call edi
push eax
call esi
mov eax, dword [0x4def88]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x60], 0x5c
mov dword [esp + 0x1c], 0x4adee0
jmp 0x40b3ee
mov dword [0x4c518c], 3
call fcn.00464e20
mov dword [0x4c518c], 2
jmp case.default.0x40b057
call fcn.0040d740
jmp case.default.0x40b057
call fcn.0040d920
jmp case.default.0x40b057
call fcn.0040d490
jmp case.default.0x40b057
mov ecx, 0x276f
call fcn.00475c40
jmp case.default.0x40b057
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x276f
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
mov dword [esp + 0x2c], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x276f
push dword [0x4def88]
call edi
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x4ade70
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], 0
jmp 0x40b413
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x276f
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x276f
jmp 0x40b3be
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27a3
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
mov dword [esp + 0x2c], 0x400
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x27a3
push dword [0x4def88]
call edi
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x4ade70
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], 0
jmp 0x40b413
push 0x7fc
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27a3
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
push ecx
push 0x1073
push 0x27a3
push dword [0x4def88]
mov dword [esp + 0x3c], 0x400
mov dword [esp + 0x2c], 0
call edi
push eax
call esi
mov eax, dword [0x4def88]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], 0x4ade58
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c1390]
movups xmmword [esp + 0x24], xmm0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x3c
push eax
mov dword [esp + 0x18], 0x4c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, 1
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x854
ret