Function at 0x40c937
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c656
mov eax, dword fs:[0]
push eax
mov eax, 0x1544
call fcn.00529dc0
mov eax, dword [0x61b660]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1530], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1534], eax
cmp dword [ebp - 0x1534], 0x1f40
ja 0x40c20d
cmp dword [ebp - 0x1534], 0x1f40
je 0x40c558
mov ecx, dword [ebp - 0x1534]
sub ecx, 0x415
mov dword [ebp - 0x1534], ecx
cmp dword [ebp - 0x1534], 0x18
ja case.default.0x40c24e
mov edx, dword [ebp - 0x1534]
movzx eax, byte [edx + 0x40cb68]
jmp dword [eax*4 + 0x40cb48]
cmp dword [ebp - 0x1534], 0x232d
ja 0x40c255
cmp dword [ebp - 0x1534], 0x232d
je 0x40c74a
mov ecx, dword [ebp - 0x1534]
sub ecx, 0x1f43
mov dword [ebp - 0x1534], ecx
cmp dword [ebp - 0x1534], 4
ja case.default.0x40c24e
mov edx, dword [ebp - 0x1534]
jmp dword [edx*4 + 0x40cb84]
jmp case.default.0x40c24e
mov eax, dword [ebp - 0x1530]
add eax, 0x168
mov dword [ebp - 0x14a0], eax
mov ecx, dword [ebp - 0x14a0]
cmp dword [ecx + 0x14], 0x10
jb 0x40c287
mov edx, dword [ebp - 0x14a0]
mov eax, dword [edx]
mov dword [ebp - 0x1538], eax
jmp 0x40c293
mov ecx, dword [ebp - 0x14a0]
mov dword [ebp - 0x1538], ecx
mov edx, dword [ebp - 0x1538]
push edx
push 1
push 0x416
mov eax, dword [0x62cb28]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
mov ecx, dword [ebp - 0x1530]
call fcn.004337ac
jmp case.default.0x40c24e
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x430], ecx
mov byte [ebp - 0x42c], 0
push 0x3ff
push 0
lea edx, [ebp - 0x42b]
push edx
call fcn.00529d40
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x430]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
mov ecx, dword [ebp - 0x430]
movzx edx, byte [ecx]
push edx
mov ecx, dword [0x62905c]
call fcn.00427f00
push 1
push 0
push 0
lea eax, [ebp - 0x42c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x40c24e
push 1
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x1530]
mov ecx, dword [eax + 0x98]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
jmp case.default.0x40c24e
push 0
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x1530]
mov ecx, dword [eax + 0x98]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
jmp case.default.0x40c24e
mov ecx, dword [ebp - 0x1530]
call fcn.0040ce30
jmp case.default.0x40c24e
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x434], ecx
push 5
mov ecx, dword [ebp - 0x1530]
call fcn.004337ac
mov ecx, 0x625398
call fcn.00564220
push 0x625398
mov edx, dword [ebp - 0x434]
push edx
mov ecx, dword [0x62905c]
call fcn.004286d0
test eax, eax
je 0x40c3f7
push 0
mov eax, dword [ebp - 0x1530]
mov ecx, dword [eax + 0x98]
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x98]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [0x621cfc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40c418
push 1
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x1530]
mov ecx, dword [ecx + 0x98]
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x434]
push ecx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x14c0], eax
mov edx, dword [ebp - 0x14c0]
push edx
mov eax, dword [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x1530]
add ecx, 0x168
call fcn.004064c0
mov ecx, dword [ebp - 0x434]
mov dword [ebp - 0x149c], ecx
mov edx, dword [ebp - 0x149c]
push edx
call fcn.0042a4c9
add esp, 4
jmp case.default.0x40c24e
push 1
mov eax, dword [ebp - 0x1530]
mov ecx, dword [eax + 0x98]
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x98]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x24]
call eax
push 3
push 0
push 0
push 0
push 0
push 0x6358d8
mov ecx, dword [ebp - 0x1530]
call fcn.0043398f
push 3
push 0
push 0
push 0
push 0
push 0x635950
mov ecx, dword [ebp - 0x1530]
call fcn.0043398f
push 5
mov ecx, dword [ebp - 0x1530]
call fcn.004337ac
mov ecx, dword [ebp - 0x1530]
cmp dword [ecx + 0x184], 0
jne 0x40c508
push 0
push 0xc8
push 0x63
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0x1530]
mov dword [ecx + 0x184], 1
push 0
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x1530]
mov ecx, dword [ecx + 0x98]
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
call eax
jmp case.default.0x40c24e
mov ecx, dword [ebp - 0x1530]
mov dword [ecx + 0x188], 0
jmp case.default.0x40c24e
mov edx, dword [ebp - 0x1530]
mov dword [edx + 0x188], 1
jmp case.default.0x40c24e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x40c664
mov byte [ebp - 0x83c], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x83b]
push ecx
call fcn.00529d40
add esp, 0xc
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0xb0]
mov dword [ebp - 0x14d0], eax
mov ecx, dword [ebp - 0x1530]
add ecx, 0xa0
mov dword [ebp - 0x14d4], ecx
mov edx, dword [ebp - 0x14d4]
cmp dword [edx + 0x14], 0x10
jb 0x40c5cb
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax]
mov dword [ebp - 0x153c], ecx
jmp 0x40c5d7
mov edx, dword [ebp - 0x14d4]
mov dword [ebp - 0x153c], edx
mov eax, dword [ebp - 0x14d0]
push eax
mov ecx, dword [ebp - 0x153c]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.00529940
add esp, 0xc
mov eax, dword [ebp - 0x1530]
add eax, 0x168
mov dword [ebp - 0x14d8], eax
mov ecx, dword [ebp - 0x14d8]
cmp dword [ecx + 0x14], 0x10
jb 0x40c621
mov edx, dword [ebp - 0x14d8]
mov eax, dword [edx]
mov dword [ebp - 0x1540], eax
jmp 0x40c62d
mov ecx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1540], ecx
push 0
mov edx, dword [ebp - 0x1540]
push edx
push 0x5bf8b8
lea eax, [ebp - 0x83c]
push eax
mov ecx, dword [ebp - 0x1530]
call fcn.00421080
lea ecx, [ebp - 0x83c]
push ecx
mov ecx, dword [ebp - 0x1530]
call fcn.0040cf10
jmp 0x40c745
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x840], edx
cmp dword [ebp - 0x840], 0
je 0x40c68d
mov eax, dword [ebp - 0x840]
push eax
mov ecx, dword [ebp - 0x1530]
call fcn.0040cf10
jmp 0x40c745
mov byte [ebp - 0xc44], 0
push 0x3ff
push 0
lea ecx, [ebp - 0xc43]
push ecx
call fcn.00529d40
add esp, 0xc
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0xb0]
mov dword [ebp - 0x14dc], eax
mov ecx, dword [ebp - 0x1530]
add ecx, 0xa0
mov dword [ebp - 0x14e0], ecx
mov edx, dword [ebp - 0x14e0]
cmp dword [edx + 0x14], 0x10
jb 0x40c6ea
mov eax, dword [ebp - 0x14e0]
mov ecx, dword [eax]
mov dword [ebp - 0x1544], ecx
jmp 0x40c6f6
mov edx, dword [ebp - 0x14e0]
mov dword [ebp - 0x1544], edx
mov eax, dword [ebp - 0x14dc]
push eax
mov ecx, dword [ebp - 0x1544]
push ecx
lea edx, [ebp - 0xc44]
push edx
call fcn.00529940
add esp, 0xc
push 0
mov eax, dword [ebp - 0x438]
push eax
push 0x5bf8b8
lea ecx, [ebp - 0xc44]
push ecx
mov ecx, dword [ebp - 0x1530]
call fcn.00421080
lea edx, [ebp - 0xc44]
push edx
mov ecx, dword [ebp - 0x1530]
call fcn.0040cf10
jmp case.default.0x40c24e
mov eax, dword [ebp - 0x1530]
cmp dword [eax + 0x184], 0
jne 0x40c782
push 0
push 0xc8
push 0x63
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x1530]
mov dword [eax + 0x184], 1
mov ecx, dword [ebp - 0x1530]
cmp dword [ecx + 0xbc], 0
je 0x40c79a
cmp dword [0x62cb2c], 0
jne 0x40c7c0
push 0
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x1530]
mov ecx, dword [ecx + 0x98]
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
call eax
jmp case.default.0x40c24e
mov dword [ebp - 0xc68], 0
mov dword [ebp - 0xc64], 0
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0xc5c], 0
mov dword [ebp - 0xc54], 0
mov dword [ebp - 0xc50], 0
mov dword [ebp - 0xc4c], 0
mov dword [ebp - 0xc48], 0
mov dword [ebp - 0xc70], 0
mov dword [ebp - 0xc6c], 0
lea ecx, [ebp - 0xc6c]
push ecx
lea edx, [ebp - 0xc70]
push edx
mov ecx, dword [ebp - 0x1530]
call fcn.0040de70
lea eax, [ebp - 0xc68]
push eax
mov ecx, dword [ebp - 0xc6c]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
lea edx, [ebp - 0xc54]
push edx
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp dword [ebp - 0xc68], 0
jne 0x40c87e
mov eax, dword [ebp - 0xc4c]
sub eax, 0x19a
mov dword [ebp - 0xc68], eax
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0xbc]
shl edx, 5
add edx, 0x28
mov dword [ebp - 0xc58], edx
push 0
mov eax, dword [ebp - 0xc58]
push eax
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0x9c]
push edx
mov eax, dword [ebp - 0xc48]
sub eax, dword [ebp - 0xc58]
push eax
mov ecx, dword [ebp - 0xc68]
push ecx
mov edx, dword [ebp - 0x1530]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x1530]
mov ecx, dword [eax + 0x98]
mov edx, dword [edx]
mov eax, dword [edx + 0x28]
call eax
push 3
push 0
push 0
push 0
push 0
push 0x6358d8
mov ecx, dword [ebp - 0x1530]
call fcn.0043398f
push 3
push 0
push 0
push 0
push 0
push 0x635950
mov ecx, dword [ebp - 0x1530]
call fcn.0043398f
push 5
mov ecx, dword [ebp - 0x1530]
call fcn.004337ac
jmp case.default.0x40c24e
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1090], ecx
mov byte [ebp - 0x108c], 0
push 0x3ff
push 0
lea edx, [ebp - 0x108b]
push edx
call fcn.00529d40
add esp, 0xc
lea eax, [ebp - 0x108c]
push eax
mov ecx, dword [ebp - 0x1090]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
mov ecx, dword [ebp - 0x1090]
movzx edx, byte [ecx]
push edx
mov ecx, dword [0x62905c]
call fcn.00427f00
lea eax, [ebp - 0x108c]
push eax
lea ecx, [ebp - 0xc8c]
call fcn.00405860
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc8c]
push ecx
push str._select_
lea edx, [ebp - 0x2c]
push edx
call fcn.00407200
add esp, 0xc
mov dword [ebp - 0x1548], eax
mov eax, dword [ebp - 0x1548]
mov dword [ebp - 0x1514], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1514]
push ecx
lea ecx, [ebp - 0xc8c]
call fcn.00405ab0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406060
mov byte [ebp - 4], 0
cmp dword [ebp - 0xc78], 0x10
jb 0x40ca0b
mov edx, dword [ebp - 0xc8c]
mov dword [ebp - 0x154c], edx
jmp 0x40ca17
lea eax, [ebp - 0xc8c]
mov dword [ebp - 0x154c], eax
cmp dword [ebp - 0x1530], 0
jne 0x40ca2c
mov dword [ebp - 0x1550], 0
jmp 0x40ca3b
mov ecx, dword [ebp - 0x1530]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x1550], edx
push 1
push 0
mov eax, dword [ebp - 0x154c]
push eax
push str.explorer.exe
push str.open
mov ecx, dword [ebp - 0x1550]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0xc8c]
call fcn.00406060
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x40c24e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1498], edx
mov byte [ebp - 0x1494], 0
push 0x3ff
push 0
lea eax, [ebp - 0x1493]
push eax
call fcn.00529d40
add esp, 0xc
lea ecx, [ebp - 0x1494]
push ecx
mov edx, dword [ebp - 0x1498]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [edx + 8]
push ecx
mov edx, dword [ebp - 0x1498]
movzx eax, byte [edx]
push eax
mov ecx, dword [0x62905c]
call fcn.00427f00
push 0x1388
push 0x64
lea ecx, [ebp - 0x1494]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x1530]
add ecx, 0xc0
call fcn.00429e80
jmp case.default.0x40c24e
push 0x1388
push 0x64
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x1530]
add ecx, 0xc0
call fcn.00429e80
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1530]
call fcn.0042d194
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052927b
mov esp, ebp
pop ebp
ret 0xc