Function at 0x40d9a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x466290
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4835f0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d9e0
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov ebx, 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0
mov dword [esp + 0x44], 0
call fcn.0042aab0
neg eax
sbb eax, eax
add eax, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], eax
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40da35
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
push str.Environment
push ecx
mov byte [esp + 0x4c], bl
call fcn.004012d0
add esp, 8
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SOFTWAREProtectCop
call fcn.0040bad0
lea esi, [esp + 0x30]
call fcn.004268a0
test eax, eax
je 0x40e0c8
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40da98
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push ecx
mov byte [esp + 0x48], 2
mov ecx, esp
mov dword [esp + 0x24], esp
push str.test
call fcn.0040bad0
push ecx
mov byte [esp + 0x4c], 3
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4711cc
call fcn.0040bad0
lea edi, [esp + 0x20]
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 2
call fcn.004269f0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 4
call fcn.00402ad0
mov byte [esp + 0x44], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40db1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x40db4a
cmp dword [eax - 4], ebx
jle 0x40db3a
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.004010b0
mov eax, dword [esp + 0x14]
push eax
push 0x32
push 0x488270
call fcn.0044acec
add esp, 0xc
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x470cc8
call fcn.0040bad0
mov byte [esp + 0x48], 5
mov esi, dword [esp + 0x20]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
push esi
call fcn.00402a60
add eax, 0x10
mov dword [edi], eax
add esp, 4
lea edi, [esp + 0x20]
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 2
call fcn.004269f0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 6
call fcn.00402ad0
mov byte [esp + 0x44], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dbc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jne 0x40dd15
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.11111111111111
call fcn.0040bad0
push ecx
mov byte [esp + 0x4c], 7
mov dword [esp + 0x28], esp
mov edi, esp
push esi
call fcn.00402a60
add eax, 0x10
mov dword [edi], eax
add esp, 4
lea esi, [esp + 0x30]
mov byte [esp + 0x4c], 2
call fcn.00426c30
mov dword [0x484d40], ebx
mov dword [0x484d44], ebx
mov dword [0x484d48], ebx
mov dword [0x484d4c], ebx
mov dword [0x484d50], ebx
mov dword [0x484d54], ebx
mov dword [0x484d58], ebx
mov dword [0x484d5c], ebx
mov dword [0x484d60], ebx
mov dword [0x484d64], ebx
mov dword [0x484d68], ebx
mov dword [0x484d6c], ebx
mov dword [0x484d70], ebx
mov dword [0x484d74], ebx
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40dc77
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push str.ctCop.exe
push str.Prote
push 0x4882d8
lea ecx, [esp + 0x24]
push str.__s_s_s___run1
push ecx
mov byte [esp + 0x58], 8
call fcn.004012d0
mov esi, dword [esp + 0x2c]
add esp, 0x14
cmp dword [esi - 4], ebx
jle 0x40dcc7
mov edx, dword [esi - 0xc]
push edx
lea ecx, [esp + 0x1c]
call fcn.004010b0
mov esi, dword [esp + 0x18]
push esi
push ebx
call fcn.00429e20
mov eax, dword [esp + 0x54]
mov ecx, dword [eax + 0x20]
add esp, 8
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0042ecf0
mov edx, dword [eax + 0x20]
push 0
push 0x3e8
push 0x30b
push edx
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [esi - 0x10]
mov byte [esp + 0x44], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40e096
push ebx
push 0
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d40], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dd56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push ebx
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d44], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dd96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 2
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d48], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ddd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 3
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d4c], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40de18
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 4
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d50], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40de59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 5
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d54], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40de9a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 6
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d58], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dedb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 7
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d5c], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40df1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 8
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d60], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40df5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 9
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d64], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40df9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0xa
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d68], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dfdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0xb
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d6c], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e020
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0xc
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d70], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e061
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0xd
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a1b0
mov eax, dword [eax]
push eax
call fcn.0044b4b2
mov dword [0x484d74], eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e0a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e0d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40e0d6
push 0
push 0
push 0x471228
call fcn.00433c91
call fcn.0042a1c0
movsx eax, al
add eax, 2
cmp eax, 3
ja case.default.0x40e0e6
jmp dword [eax*4 + 0x40e218]
mov byte [0x484d10], bl
call fcn.004390f8
mov eax, dword [eax + 4]
call fcn.004167f0
jmp case.default.0x40e0e6
mov byte [0x484d10], 0
jmp case.default.0x40e0e6
mov byte [0x484d10], 0xff
jmp case.default.0x40e0e6
mov byte [0x484d10], 0xfe
cmp dword [0x484d44], 0
je 0x40e1ab
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40e142
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
push str.ProtectCopMtr.exe
push 0x4882d8
lea ecx, [esp + 0x54]
push str._s_s
push ecx
mov byte [esp + 0x54], 9
call fcn.004012d0
mov esi, dword [esp + 0x5c]
add esp, 0x10
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [esp + 0x44], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e1ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], 0xffffffff
call fcn.00402940
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e201
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 4