Function at 0x41e330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535436
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x58b464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xac], ebx
call fcn.0044cfe0
push 0xfffffffffffffff0
mov ecx, ebx
call fcn.0048dda0
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push eax
call edi
and eax, 0xff3effff
mov ecx, ebx
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.0048dda0
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push eax
call esi
push 0xffffffffffffffec
mov ecx, ebx
call fcn.0048dda0
push eax
call edi
and eax, 0xfffffff7
mov ecx, ebx
push eax
push 0xffffffffffffffec
call fcn.0048dda0
push eax
call esi
push 0x91
mov ecx, ebx
call fcn.00464a50
lea esi, [ebx + 0x2c]
push str.winCtn
mov ecx, esi
mov dword [ebp - 0x74], esi
call fcn.00453870
push str.titleTabLt
mov ecx, esi
mov dword [ebx + 0x6c4], eax
call fcn.00453870
push str.mainTabLt
mov ecx, esi
mov dword [ebx + 0x68c], eax
call fcn.00453870
push str.defaultInstallBtn
mov ecx, esi
mov dword [ebx + 0x688], eax
call fcn.00453870
push str.customeInstallBtn
mov ecx, esi
mov dword [ebx + 0x690], eax
call fcn.00453870
push str.customeBtn
mov ecx, esi
mov dword [ebx + 0x694], eax
call fcn.00453870
push str.treatyBtn
mov ecx, esi
mov dword [ebx + 0x698], eax
call fcn.00453870
push str.backBtn
mov ecx, esi
mov dword [ebx + 0x69c], eax
call fcn.00453870
push str.treatyCb
mov ecx, esi
mov dword [ebx + 0x6a0], eax
call fcn.00453870
push str.chDirBtn
mov ecx, esi
mov dword [ebx + 0x6a8], eax
call fcn.00453870
push str.installDirEdit
mov ecx, esi
mov dword [ebx + 0x6ac], eax
call fcn.00453870
push str.openProduceBtn
mov ecx, esi
mov dword [ebx + 0x6b8], eax
call fcn.00453870
mov dword [ebx + 0x6a4], eax
push str.ableftBtn
mov ecx, esi
call fcn.00453870
push str.abrightBtn
mov ecx, esi
mov dword [ebx + 0x6b0], eax
call fcn.00453870
push str.titleGrpCtn
mov ecx, esi
mov dword [ebx + 0x6b4], eax
call fcn.00453870
push str.progressLb
mov ecx, esi
mov dword [ebx + 0x6c0], eax
call fcn.00453870
push str.createDSCb
mov ecx, esi
mov dword [ebx + 0x6bc], eax
call fcn.00453870
push str.createQSCb
mov ecx, esi
mov dword [ebx + 0x6c8], eax
call fcn.00453870
push str.progressAnLb
mov ecx, esi
mov dword [ebx + 0x6cc], eax
call fcn.00453870
push str.finishedLbl
mov ecx, esi
mov dword [ebx + 0x6d0], eax
call fcn.00453870
push str.installPrg
mov ecx, esi
mov dword [ebx + 0x6d4], eax
call fcn.00453870
push str.tipLbl
mov ecx, esi
mov dword [ebx + 0x6e4], eax
call fcn.00453870
push str.softNameLbl
mov ecx, esi
mov dword [ebx + 0x6e0], eax
call fcn.00453870
push str.installLogo
mov ecx, esi
mov dword [ebx + 0x6d8], eax
call fcn.00453870
mov ecx, dword [ebx + 0x6d8]
mov dword [ebx + 0x6dc], eax
test ecx, ecx
je 0x41e5dd
call fcn.00450b80
mov ecx, dword [ebx + 0x6d8]
mov edi, eax
call fcn.00450a00
mov ecx, ebx
mov esi, eax
call fcn.0048dda0
push eax
call dword [sym.imp.USER32.dll_GetDC]
push edi
push esi
push 0x571790
lea esi, [ebx + 0x2c]
push esi
push eax
call fcn.00462000
mov ecx, dword [ebx + 0x6d8]
add esp, 0x14
mov dword [ebp - 0xb0], edx
mov edx, dword [ecx]
push eax
call dword [edx + 0x80]
mov ecx, dword [ebx + 0x6d8]
push 0x571790
mov eax, dword [ecx]
call dword [eax + 0x3c]
push str.bTitleLbl1
mov ecx, esi
call fcn.00453870
push str.bTitleLbl2
mov ecx, esi
mov dword [ebp - 0x20], eax
call fcn.00453870
push str.bTitleLbl3
mov ecx, esi
mov dword [ebp - 0x1c], eax
call fcn.00453870
mov dword [ebp - 0x18], eax
mov ecx, 3
lea eax, [ebp - 0x20]
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xa8], eax
nop
mov esi, dword [eax]
test esi, esi
je 0x41e680
mov ecx, esi
call fcn.00450b80
mov ecx, esi
mov ebx, eax
call fcn.00450a00
mov ecx, dword [ebp - 0xac]
mov edi, eax
call fcn.0048dda0
push eax
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push 0x571790
push dword [ebp - 0x74]
push eax
call fcn.00462000
mov edx, dword [esi]
add esp, 0x14
mov ecx, esi
push eax
call dword [edx + 0x80]
mov eax, dword [esi]
mov ecx, esi
push 0x571790
call dword [eax + 0x3c]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xb0]
add eax, 4
sub ecx, 1
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb0], ecx
jne 0x41e620
push 0xb8
call fcn.004f173a
mov esi, eax
mov dword [ebp - 0x74], esi
push 0xb8
push 0
push esi
mov dword [ebp - 4], 0
call fcn.004ae860
mov ebx, dword [ebp - 0xac]
add esp, 0x10
mov ecx, esi
push 1
push 1
push 1
push 0x56f9a4
push 0x56f9a4
push 0x56f9a4
sub esp, 0x28
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_class__lambda_3505f79a7c3738e13025ddda0bca1763___class_std::allocator_int___void__int__double__wchar_t_const__.0
mov dword [eax + 4], ebx
mov dword [eax + 0x24], eax
call fcn.00415ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
mov dword [ebx + 0x78c], eax
call fcn.004227d0
cmp dword [ebx + 0x760], 0
je 0x41e713
mov byte [ebx + 0x7b0], 1
jmp 0x41e71a
mov byte [ebx + 0x7b0], 0
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.00421c30
mov dword [ebp - 4], 1
lea edx, [ebp - 0x70]
mov ecx, dword [ebx + 0x6b8]
cmp dword [ebp - 0x5c], 8
cmovae edx, dword [ebp - 0x70]
mov eax, dword [ecx]
push edx
call dword [eax + 0x3c]
mov ecx, ebx
call fcn.00464250
cmp byte [ebx + 0x7b0], 0
je 0x41ec83
push 0xf
xor eax, eax
mov dword [ebp - 0x44], 7
push str.TextToVoice.exe
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.00406670
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae ecx, dword [ebp - 0x58]
call fcn.0041eda0
test eax, eax
je 0x41e996
push 0x1e
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0x571a84
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00406670
push 0xffffffffffffffff
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x248]
push 0x56f9a4
mov dword [ebp - 0x250], 4
mov dword [ebp - 0x24c], 0x93
call fcn.0044da60
push 0xffffffffffffffff
push str.MessageBox1Wnd.xml
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 4
call fcn.0044da60
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c]
push 0x12
xor eax, eax
mov dword [ebp - 0x78], 7
push str.MessageBox1Wnd.xml
mov dword [ebp - 0x7c], 0
mov word [ebp - 0x8c], ax
call fcn.00406670
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
push 0x12
xor eax, eax
mov dword [ebp - 0x14], 7
push str.MessageBox1Wnd.xml
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00406670
push 1
sub esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8c]
call fcn.00422f70
push eax
push 0
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x28]
call fcn.00422f00
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x41e87f
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x140]
call fcn.0044da60
mov eax, dword [ebp - 0x90]
cmp eax, 8
jb 0x41e8ab
inc eax
lea ecx, [ebp - 0xa4]
push eax
push dword [ebp - 0xa4]
call fcn.00406dd0
xor eax, eax
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94], 0
cmp eax, 8
jb 0x41e8dd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406dd0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x41e90c
inc eax
lea ecx, [ebp - 0x8c]
push eax
push dword [ebp - 0x8c]
call fcn.00406dd0
xor eax, eax
mov dword [ebp - 0x78], 7
mov dword [ebp - 0x7c], 0
mov word [ebp - 0x8c], ax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
mov ecx, ebx
push 0x571ac4
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0048dda0
lea edx, [ebp - 0x250]
mov ecx, eax
call fcn.0044d6a0
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x140]
call fcn.0044db80
lea ecx, [ebp - 0x1c4]
call fcn.0044db80
lea ecx, [ebp - 0x248]
call fcn.0044db80
push 1
mov ecx, ebx
call fcn.00464390
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x41e996
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00406dd0
push 0xffffffffffffffff
push 0x56f9a4
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x250], 4
mov dword [ebp - 0x24c], 0x93
call fcn.0044da60
push 0xffffffffffffffff
push str.InstalledPathTipWnd.xml
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 0xa
call fcn.0044da60
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
push 0x17
xor eax, eax
mov dword [ebp - 0x14], 7
push str.InstalledPathTipWnd.xml
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00406670
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8c]
push 0x17
xor eax, eax
mov dword [ebp - 0x78], 7
push str.InstalledPathTipWnd.xml
mov dword [ebp - 0x7c], 0
mov word [ebp - 0x8c], ax
call fcn.00406670
push 1
sub esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.00422f70
push eax
push 0
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00422f00
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
jb 0x41ea58
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x140]
call fcn.0044da60
mov eax, dword [ebp - 0x90]
cmp eax, 8
jb 0x41ea84
inc eax
lea ecx, [ebp - 0xa4]
push eax
push dword [ebp - 0xa4]
call fcn.00406dd0
xor eax, eax
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x94], 0
cmp eax, 8
jb 0x41eabc
inc eax
lea ecx, [ebp - 0x8c]
push eax
push dword [ebp - 0x8c]
call fcn.00406dd0
xor eax, eax
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7c], 0
cmp eax, 8
jb 0x41eae8
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406dd0
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
push eax
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.0048dda0
lea edx, [ebp - 0x250]
mov ecx, eax
call fcn.0044d6a0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x140]
mov esi, eax
call fcn.0044db80
lea ecx, [ebp - 0x1c4]
call fcn.0044db80
lea ecx, [ebp - 0x248]
call fcn.0044db80
cmp esi, 1
jne 0x41ec3d
lea edi, [ebx + 0x750]
push 0x5705ac
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.004174d0
push str.TextToVoice.exe
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa4]
call fcn.00417460
mov ecx, eax
lea esi, [ebx + 0x6f0]
add esp, 8
mov dword [ebp - 0x74], ecx
cmp esi, ecx
je 0x41ebc4
cmp dword [esi + 0x14], 8
jb 0x41eb9d
mov eax, dword [esi + 0x14]
mov ecx, esi
inc eax
push eax
push dword [esi]
call fcn.00406dd0
mov ecx, dword [ebp - 0x74]
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41ebb5
mov eax, dword [esi]
jmp 0x41ebb7
mov eax, esi
xor edx, edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.00409440
mov eax, dword [ebp - 0x90]
cmp eax, 8
jb 0x41ebe2
inc eax
lea ecx, [ebp - 0xa4]
push eax
push dword [ebp - 0xa4]
call fcn.00406dd0
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0xa4], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x90], 7
mov dword [ebp - 0x94], 0
cmp eax, 8
jb 0x41ec18
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00406dd0
cmp dword [esi + 0x14], 8
jb 0x41ec20
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41ec28
mov edi, dword [edi]
push 1
push edi
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41ec65
test esi, esi
jne 0x41ec60
cmp dword [ebx + 0x764], 8
lea eax, [ebx + 0x750]
jb 0x41ec52
mov eax, dword [eax]
push 1
push 1
push eax
mov ecx, ebx
call fcn.0041efb0
jmp 0x41ec6e
cmp esi, 2
jne 0x41ec6e
push 1
mov ecx, ebx
call fcn.00464390
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x41ec83
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00406dd0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x41ec98
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00406dd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f16f8
mov esp, ebp
pop ebp
ret