Function at 0x401028
Capabilities:
Create process on windows

Disassembly:
push 0x9c
push 0
push 0x4091dc
call sub.CRTDLL.dll_memset
add esp, 0xc
mov eax, dword [esp + 4]
mov dword [0x4091e4], eax
push 0
push 0xfa0
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4091dc], eax
call fcn.00406520
call fcn.00406048
call fcn.00405d60
call fcn.00404560
call fcn.00404020
call fcn.00403e8e
call fcn.00403b92
call fcn.00403056
call fcn.00402c29
call fcn.00403830
push 0xfa00
push 8
push dword [0x4091dc]
call sub.KERNEL32.dll_HeapAlloc
mov dword [0x4091e0], eax
mov dword [0x409264], 0x12c
mov dword [0x409260], 0x122
mov dword [0x409268], 3
mov dword [0x4091f0], 1
mov dword [0x409254], 0
mov dword [0x40922c], 0
mov dword [0x409244], 0
jmp 0x401153
jmp 0x401201
jmp 0x4012b5
jmp 0x40130c
jmp 0x40162d
jmp 0x401683
push dword [0x4091e0]
push dword [0x4091e0]
mov edx, 0x40801e
call fcn.004032ec
inc dword [0x4091e0]
push 0xce0000
push dword [0x409260]
push dword [0x409264]
push 0xc8
push 0xc8
mov eax, 0
call fcn.004049d2
pop dword [0x4091e0]
mov dword [0x409220], eax
cmp dword [0x409220], 0
je 0x4016da
jmp 0x4016df
jmp 0x402764
call fcn.00404a30
call fcn.00404200
and eax, eax
je 0x4016ef
jmp 0x4016f4
jmp 0x402764
push 8
push 0x40802b
mov eax, 1
call fcn.00405e90
and eax, eax
je 0x40171e
call fcn.00405eb0
push eax
mov eax, 0xffffffff
call fcn.00404210
jmp 0x401746
push 8
push 0x40803a
mov eax, 1
call fcn.00405e90
and eax, eax
je 0x401746
call fcn.00405eb0
push eax
mov eax, 0xffffffff
call fcn.00404210
push 0x18
push 0x14
push 0
call fcn.00403be0
call fcn.00403cdc
push eax
call fcn.00406541
push 0x7700
push 0x18
push 0x14
push 0
push 0
call fcn.00406734
push 0xffffff
push 0
push 0x15
push 0
push 0
call fcn.004067c0
push 0
push 0x15
push 0x13
push 1
push 0x13
call fcn.004067c0
push 0
push 0x17
push 1
push 0x17
push 0x14
call fcn.004067c0
push 0xffffff
push 0x17
push 0
push 0
push 0
call fcn.004067c0
call fcn.00406628
push 0xf
call sub.USER32.dll_GetSysColor
mov dword [0x4091ec], eax
push 0xa
push 0x64
push 1
call fcn.00403be0
call fcn.00403cdc
push eax
call fcn.00406541
push dword [0x4091ec]
push 0xa
push 0x64
push 0
push 0
call fcn.00406734
call fcn.00406628
call fcn.00404a30
push eax
mov eax, 0
call fcn.00402e98
mov dword [0x409230], eax
cmp dword [0x409230], 0
je 0x401a1b
mov eax, 0x408042
call fcn.004030d4
push 0x40804a
mov eax, 1
call fcn.004030a6
push dword [0x4091e0]
push dword [0x4091e0]
mov edx, 0x408058
call fcn.004032ec
inc dword [0x4091e0]
mov eax, 0
call fcn.004030a6
pop dword [0x4091e0]
push dword [0x4091e0]
push dword [0x4091e0]
mov edx, 0x40805f
call fcn.004032ec
inc dword [0x4091e0]
mov eax, 5
call fcn.004030a6
pop dword [0x4091e0]
push 0x40806b
mov eax, 6
call fcn.004030a6
call fcn.00403080
push 0x408079
mov eax, 3
call fcn.004030a6
mov eax, 0x40807e
call fcn.004030d4
push 0x408083
mov eax, 7
call fcn.004030a6
push 0x408086
mov eax, 8
call fcn.004030a6
push 0x408089
mov eax, 9
call fcn.004030a6
push 0x40808c
mov eax, 0xa
call fcn.004030a6
push 0x40808f
mov eax, 0xb
call fcn.004030a6
push 0x408092
mov eax, 0xc
call fcn.004030a6
push 0x408095
mov eax, 0xd
call fcn.004030a6
push 0x408098
mov eax, 0xe
call fcn.004030a6
push 0x40809b
mov eax, 0xf
call fcn.004030a6
push 0x40809e
mov eax, 0x10
call fcn.004030a6
push 0x4080a2
mov eax, 0x11
call fcn.004030a6
push 0x4080a6
mov eax, 0x12
call fcn.004030a6
push 0x4080aa
mov eax, 0x13
call fcn.004030a6
push 0x4080ae
mov eax, 0x14
call fcn.004030a6
push 0x4080b2
mov eax, 0x15
call fcn.004030a6
mov eax, 0x4080b6
call fcn.004030d4
push 0x4080b8
mov eax, 4
call fcn.004030a6
push 0x4080c0
mov eax, 2
call fcn.004030a6
push 1
mov ebx, dword [0x409268]
add ebx, 6
push ebx
push 0
call fcn.004039cb
push dword [0x4091f0]
push 5
push 0
call fcn.004039cb
push dword [0x409254]
push 6
push 0
call fcn.004039cb
mov ebx, dword [0x409260]
call fcn.0040309b
mov edi, eax
add edi, 0x19
sub ebx, edi
mov dword [0x409228], ebx
push 1
push 0
lea ebp, [0x409270]
mov ebx, dword [ebp + 4]
mov edi, dword [0x409228]
sar edi, 2
add ebx, edi
push ebx
mov ebx, dword [ebp]
mov edi, dword [0x409264]
sar edi, 2
add ebx, edi
push ebx
call fcn.00401311
mov dword [0x40921c], eax
push dword [0x40921c]
push dword [0x409228]
push dword [0x409264]
push 0
push 0
push 0
call fcn.00403fff
mov dword [0x409214], eax
push 0x4080d0
push 0xc
push 0x76
mov ebx, dword [0x409228]
inc ebx
push ebx
push 0x1e
mov eax, 1
call fcn.00404260
push 0x4080d4
push 0xc
push 0x46
mov ebx, dword [0x409228]
add ebx, 0xd
push ebx
push 0x41
mov eax, 2
call fcn.00404260
push 0x4080d4
push 0xc
push 0x3c
mov ebx, dword [0x409228]
inc ebx
push ebx
push 0xe6
mov eax, 3
call fcn.00404260
push 0x4080d4
push 0xc
push 0x64
mov ebx, dword [0x409228]
add ebx, 0xb
push ebx
push 0xb4
mov eax, 7
call fcn.00404260
call fcn.0040162f
push 0
call fcn.00403bbb
push eax
push 0x18
push 0x14
mov ebx, dword [0x409228]
inc ebx
push ebx
push 0
push 5
call fcn.00403fff
mov dword [0x409204], eax
push 1
call fcn.00403bbb
push eax
push 0xa
push 0x64
mov ebx, dword [0x409228]
add ebx, 0xf
push ebx
push 0xc8
push 6
call fcn.00403fff
mov dword [0x409208], eax
lea eax, [0x401158]
call fcn.00404a40
mov dword [0x40923c], 0
mov dword [0x409240], 0
call fcn.00404a50
mov dword [0x4091f8], eax
call sub.USER32.dll_GetForegroundWindow
mov ebx, eax
cmp ebx, dword [0x409220]
jne 0x401c22
mov eax, 0x19
call fcn.00402c19
jmp 0x401c2c
mov eax, 0x32
call fcn.00402c19
push 0x409270
call sub.USER32.dll_GetCursorPos
push dword [0x4091f8]
mov ebx, 5
cmp ebx, dword [esp]
jne 0x401d5e
push dword [0x40921c]
call sub.GDI32.dll_DeleteObject
mov dword [0x40921c], 0
call fcn.00404b00
mov dword [0x409264], eax
call fcn.00404b20
mov dword [0x409260], eax
mov ebx, dword [0x409260]
call fcn.0040309b
mov edi, eax
add edi, 0x19
sub ebx, edi
mov dword [0x409228], ebx
push dword [0x409228]
push dword [0x409264]
push 0xffffffff
push 0xffffffff
mov eax, 0
call fcn.00404273
push 0xffffffff
push 0xffffffff
mov ebx, dword [0x409228]
inc ebx
push ebx
push 0xffffffff
mov eax, 1
call fcn.00404273
push 0xffffffff
push 0xffffffff
mov ebx, dword [0x409228]
add ebx, 0xd
push ebx
push 0xffffffff
mov eax, 2
call fcn.00404273
push 0xffffffff
push 0xffffffff
mov ebx, dword [0x409228]
inc ebx
push ebx
mov ebx, dword [0x409264]
add ebx, 0xffffffc4
push ebx
mov eax, 3
call fcn.00404273
push 0xffffffff
push 0xffffffff
mov ebx, dword [0x409228]
inc ebx
push ebx
push 0xffffffff
mov eax, 5
call fcn.00404273
push 0xffffffff
push 0xffffffff
mov ebx, dword [0x409228]
add ebx, 0xb
push ebx
push 0xffffffff
mov eax, 7
call fcn.00404273
jmp 0x402311
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401d8e
call fcn.00404b70
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401d88
call fcn.00404a30
push eax
mov eax, 0
call fcn.00402f3e
pop eax
jmp 0x402311
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401fac
call fcn.00404b80
push eax
mov ebx, 0
cmp ebx, dword [esp]
jne 0x401dc0
call fcn.004012b7
mov dword [0x409200], 1
jmp 0x401fa6
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401e65
push 1
push 0
call fcn.00403980
mov ebx, eax
cmp ebx, 0
jne 0x401e23
push 1
push 1
push 0
call fcn.004039cb
push 3
push 0
push 0
push 0
push 0
push 0xffffffff
push dword [0x409220]
call sub.USER32.dll_SetWindowPos
jmp 0x401e60
push 0
push 1
push 0
call fcn.004039cb
push 3
push 0
push 0
push 0
push 0
push 0xfffffffe
push dword [0x409220]
call sub.USER32.dll_SetWindowPos
jmp 0x401fa6
mov ebx, 5
cmp ebx, dword [esp]
jne 0x401ea3
push 5
push 0
call fcn.00403980
mov ebx, eax
neg ebx
inc ebx
mov dword [0x4091f0], ebx
push dword [0x4091f0]
push 5
push 0
call fcn.004039cb
jmp 0x401fa6
mov ebx, 6
cmp ebx, dword [esp]
jne 0x401ee1
push 6
push 0
call fcn.00403980
mov ebx, eax
neg ebx
inc ebx
mov dword [0x409254], ebx
push dword [0x409254]
push 6
push 0
call fcn.004039cb
jmp 0x401fa6
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401f13
push 1
push 0
push 0
push 0x4080d5
push 0x4080fc
push 0
call sub.SHELL32.dll_ShellExecuteA
jmp 0x401fa6
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401f92
push dword [0x4091e0]
push 0x40
push dword [0x4091e0]
mov edx, 0x408101
call fcn.004032ec
push dword [0x4091e0]
push 0x420d4d96
push 0x40810e
call fcn.004060d4
pop eax
mov edx, 0x40811c
call fcn.004032ec
push dword [0x4091e0]
push 0x40811e
call fcn.00401206
pop eax
inc dword [0x4091e0]
push dword [0x4091e0]
mov edx, 0x408292
call fcn.004032ec
inc dword [0x4091e0]
call fcn.00403840
pop dword [0x4091e0]
jmp 0x401fa6
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401fa6
mov dword [0x4091fc], 1
pop eax
jmp 0x402311
mov ebx, 0x20a
cmp ebx, dword [esp]
jne 0x402068
call fcn.00404b90
mov ebx, eax
cmp ebx, 0
jle 0x401fce
inc dword [0x409268]
jmp 0x401fdd
mov ebx, dword [0x409268]
add ebx, 0xffffffff
mov dword [0x409268], ebx
mov ebx, dword [0x409268]
cmp ebx, 0xf
jle 0x401ff2
mov dword [0x409268], 0xf
mov ebx, dword [0x409268]
cmp ebx, 1
jge 0x402007
mov dword [0x409268], 1
call fcn.0040162f
mov dword [0x409224], 7
mov eax, 0x15
cmp eax, dword [0x409224]
jl 0x402040
push 0
push dword [0x409224]
push 0
call fcn.004039cb
inc dword [0x409224]
jmp 0x402016
push 1
mov ebx, dword [0x409268]
add ebx, 6
push ebx
push 0
call fcn.004039cb
mov dword [0x409200], 1
jmp 0x402311
mov ebx, 0x100
cmp ebx, dword [esp]
jne 0x402311
call fcn.00404b90
push eax
mov ebx, 0x6b
cmp ebx, dword [esp]
jne 0x4020a1
mov ebx, dword [0x409268]
cmp ebx, 0xa
jge 0x40209c
inc dword [0x409268]
call fcn.0040162f
jmp 0x402310
mov ebx, 0x6d
cmp ebx, dword [esp]
jne 0x4020cf
mov ebx, dword [0x409268]
cmp ebx, 2
jl 0x4020ca
mov ebx, dword [0x409268]
add ebx, 0xffffffff
mov dword [0x409268], ebx
call fcn.0040162f
jmp 0x402310
mov ebx, 0x52
cmp ebx, dword [esp]
jne 0x402127
mov ebx, dword [0x4091f0]
cmp ebx, 0
jne 0x402104
push 1
push 5
push 0
call fcn.004039cb
mov dword [0x4091f0], 1
jmp 0x402122
push 0
push 5
push 0
call fcn.004039cb
mov dword [0x4091f0], 0
jmp 0x402310
mov ebx, 0x43
cmp ebx, dword [esp]
jne 0x402141
push dword [0x409210]
call fcn.0040646b
jmp 0x402310
mov ebx, 0x49
cmp ebx, dword [esp]
jne 0x402277
mov ebx, dword [0x409264]
push dword [0x409268]
mov eax, ebx
pop ebx
cdq
idiv ebx
mov ebx, eax
mov dword [0x409250], ebx
mov ebx, dword [0x409228]
push dword [0x409268]
mov eax, ebx
pop ebx
cdq
idiv ebx
mov ebx, eax
mov dword [0x40924c], ebx
push dword [0x40924c]
push dword [0x409250]
push 2
call fcn.00403be0
mov dword [0x409218], eax
cmp dword [0x409218], 0
je 0x402263
call fcn.00403cdc
push eax
call fcn.00406541
mov dword [0x40920c], eax
push 0
call sub.USER32.dll_GetDC
mov dword [0x4091f4], eax
push 0xcc0020
lea ebp, [0x409270]
mov ebx, dword [ebp + 4]
mov edi, dword [0x409228]
mov esi, dword [0x409268]
add esi, esi
push esi
mov eax, edi
pop edi
cdq
idiv edi
mov edi, eax
sub ebx, edi
push ebx
mov ebx, dword [ebp]
mov edi, dword [0x409264]
mov esi, dword [0x409268]
add esi, esi
push esi
mov eax, edi
pop edi
cdq
idiv edi
mov edi, eax
sub ebx, edi
push ebx
push dword [0x4091f4]
push dword [0x40924c]
push dword [0x409250]
push 0
push 0
push dword [0x40920c]
call sub.GDI32.dll_BitBlt
call fcn.00406628
push dword [0x4091f4]
push 0
call sub.USER32.dll_GetDC
push eax
call sub.USER32.dll_ReleaseDC
push dword [0x409218]
push 2
call fcn.004064ec
jmp 0x402272
push 0x42
push 0x190
call sub.KERNEL32.dll_Beep
jmp 0x402310
mov ebx, 0x47
cmp ebx, dword [esp]
jne 0x402292
call fcn.004012b7
mov dword [0x409200], 1
jmp 0x402310
mov ebx, 0x25
cmp ebx, dword [esp]
jne 0x4022b3
lea ebp, [0x409270]
push dword [ebp + 4]
mov ebx, dword [ebp]
add ebx, 0xffffffff
push ebx
call sub.USER32.dll_SetCursorPos
jmp 0x402310
mov ebx, 0x27
cmp ebx, dword [esp]
jne 0x4022d2
lea ebp, [0x409270]
push dword [ebp + 4]
mov ebx, dword [ebp]
inc ebx
push ebx
call sub.USER32.dll_SetCursorPos
jmp 0x402310
mov ebx, 0x26
cmp ebx, dword [esp]
jne 0x4022f3
lea ebp, [0x409270]
mov ebx, dword [ebp + 4]
add ebx, 0xffffffff
push ebx
push dword [ebp]
call sub.USER32.dll_SetCursorPos
jmp 0x402310
mov ebx, 0x28
cmp ebx, dword [esp]
jne 0x402310
lea ebp, [0x409270]
mov ebx, dword [ebp + 4]
inc ebx
push ebx
push dword [ebp]
call sub.USER32.dll_SetCursorPos
pop eax
pop eax
mov ebx, dword [0x4091f8]
cmp ebx, 0x332d
jne 0x402333
call fcn.00404b80
mov ebx, eax
cmp ebx, 7
jl 0x402333
mov eax, 1
jmp 0x402335
xor eax, eax
and eax, eax
je 0x402397
call fcn.00404b80
mov ebx, eax
add ebx, 0xfffffffa
mov dword [0x409268], ebx
call fcn.0040162f
mov dword [0x409224], 7
mov eax, 0x15
cmp eax, dword [0x409224]
jl 0x402382
push 0
push dword [0x409224]
push 0
call fcn.004039cb
inc dword [0x409224]
jmp 0x402358
push 1
call fcn.00404b80
push eax
push 0
call fcn.004039cb
mov ebx, dword [0x40923c]
lea ebp, [0x409270]
cmp ebx, dword [ebp]
jne 0x4023cb
mov ebx, dword [0x409240]
cmp ebx, dword [ebp + 4]
jne 0x4023cb
mov ebx, dword [0x409254]
cmp ebx, 0
je 0x4023cb
mov ebx, dword [0x409200]
cmp ebx, 1
je 0x4023cb
jmp 0x4023d2
mov eax, 1
jmp 0x4023d4
xor eax, eax
and eax, eax
je 0x402723
push dword [0x409268]
push dword [0x40921c]
lea ebp, [0x409270]
mov ebx, dword [ebp + 4]
mov edi, dword [0x409228]
mov esi, dword [0x409268]
add esi, esi
push esi
mov eax, edi
pop edi
cdq
idiv edi
mov edi, eax
sub ebx, edi
push ebx
mov ebx, dword [ebp]
mov edi, dword [0x409264]
mov esi, dword [0x409268]
add esi, esi
push esi
mov eax, edi
pop edi
cdq
idiv edi
mov edi, eax
sub ebx, edi
push ebx
call fcn.00401311
mov dword [0x40921c], eax
push dword [0x40921c]
push 0
push 0x172
push dword [0x409214]
call sub.USER32.dll_SendMessageA
push dword [0x4091e0]
mov edx, 0x4082a3
call fcn.004032ec
push dword [0x4091e0]
push 0x4082a5
push 2
push dword [0x4091e0]
mov eax, dword [0x409248]
call fcn.00402c35
call fcn.00402836
inc dword [0x4091e0]
call fcn.0040378c
pop eax
push dword [0x4091e0]
push 0x4082a5
push 2
push dword [0x4091e0]
mov eax, dword [0x409248]
call fcn.00402c20
call fcn.00402836
inc dword [0x4091e0]
call fcn.0040378c
pop eax
push dword [0x4091e0]
push 0x4082a5
push 2
push dword [0x4091e0]
mov eax, dword [0x409248]
call fcn.00402c10
call fcn.00402836
inc dword [0x4091e0]
call fcn.0040378c
pop eax
lea ecx, [0x409210]
pop edx
call fcn.004032a0
fild dword [0x409264]
mov dword [esp - 4], 0x40000000
fdiv dword [esp - 4]
fidiv dword [0x409268]
sub esp, 4
fstp dword [esp]
call fcn.00403a20
mov ebx, eax
imul ebx, dword [0x409268]
mov edi, dword [0x409268]
sar edi, 1
add ebx, edi
mov dword [0x409234], ebx
fild dword [0x409228]
mov dword [esp - 4], 0x40000000
fdiv dword [esp - 4]
fidiv dword [0x409268]
sub esp, 4
fstp dword [esp]
call fcn.00403a20
mov ebx, eax
imul ebx, dword [0x409268]
mov edi, dword [0x409268]
sar edi, 1
add ebx, edi
mov dword [0x409238], ebx
call fcn.00404ba0
push eax
call fcn.00406541
push dword [0x409238]
push dword [0x409234]
call fcn.00406860
mov dword [0x409248], eax
push dword [0x4091e0]
push dword [0x4091e0]
mov edx, 0x4082a7
call fcn.004032ec
push dword [0x4091e0]
mov eax, dword [0x409248]
call fcn.00402c35
call fcn.004029b3
pop eax
mov edx, 0x4082ad
call fcn.004032ec
push dword [0x4091e0]
mov eax, dword [0x409248]
call fcn.00402c20
call fcn.004029b3
pop eax
mov edx, 0x4082ad
call fcn.004032ec
push dword [0x4091e0]
mov eax, dword [0x409248]
call fcn.00402c10
call fcn.004029b3
pop eax
inc dword [0x4091e0]
mov eax, 1
call fcn.004041d0
pop dword [0x4091e0]
push dword [0x4091e0]
push dword [0x4091e0]
mov eax, dword [0x409210]
call fcn.00402862
inc dword [0x4091e0]
mov eax, 2
call fcn.004041d0
pop dword [0x4091e0]
call fcn.00406628
push 0
call fcn.00403bbb
call fcn.00403cdc
push eax
call fcn.00406541
push dword [0x409248]
push 0x18
push 0x14
push 0
push 0
call fcn.00406734
push 0xffffff
push 0
push 0x15
push 0
push 0
call fcn.004067c0
push 0
push 0x16
push 0x13
push 1
push 0x13
call fcn.004067c0
push 0
push 0x17
push 1
push 0x17
push 0x14
call fcn.004067c0
push 0xffffff
push 0x17
push 0
push 0
push 0
call fcn.004067c0
call fcn.00406628
push 0
call fcn.00403bbb
push eax
push 0
push 0x172
push dword [0x409204]
call sub.USER32.dll_SendMessageA
mov dword [0x409200], 0
lea ebp, [0x409270]
push dword [ebp]
pop dword [0x40923c]
push dword [ebp + 4]
pop dword [0x409240]
mov ebx, dword [0x4091f8]
cmp ebx, 0x10
je 0x402753
mov ebx, dword [0x4091fc]
cmp ebx, 1
je 0x402753
jmp 0x40275a
mov eax, 1
jmp 0x40275c
xor eax, eax
and eax, eax
je 0x401bfd
push 0
call 0x40277e
push dword [0x4091dc]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00403b3b
call fcn.00404bc0
call fcn.00405d84
call fcn.0040605c
ret