Function at 0x401860
Capabilities:
Create directory
Create process on windows
Get common file path
Hide graphical window
Read .ini file

Disassembly:
mov eax, 0x118c
call fcn.0041d200
push ebx
push ebp
push esi
push edi
xor esi, esi
push 2
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, dword [esp + 0x11a0]
push ebx
mov dword [0x4404ec], ebx
call fcn.00401710
add esp, 4
push 1
push 0x23
push 0x43fb50
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x401c5f
lea eax, [esp + 0x59c]
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x59c]
push 0x5c
push ecx
call fcn.0041d120
lea edx, [esp + 0x5a4]
push 0x5c
push edx
mov byte [eax], 0
call fcn.0041d120
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x10
push eax
push 0x43fb50
call edi
push esi
push 0x43fb50
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x19c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x19c]
push 0x2e
push ecx
call fcn.0041d120
lea edx, [esp + 0x1a4]
push 0x5c
push edx
mov byte [eax], 0
call fcn.0041d120
add esp, 0x10
push eax
push 0x43fb50
call edi
push str..ini
push 0x43fb50
call edi
mov edi, 0x43fb50
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x43ff50
mov eax, ecx
mov esi, edi
mov edi, 0x43ff50
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041d120
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
mov byte [eax], 0
push str.GenePccMon.ini
push 0x43ff50
call esi
push 0x43ff50
push 0x439748
push str.RePreview
push str.Hot_Key
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x43fb50
push 0
push str.LunachGenePccMonIL
push str.coexecutor
call ebp
test eax, eax
je 0x401a66
push 0x43fb50
push 0x64
push str.LoopMax
push str.coexecutor
call ebp
push 0x43fb50
push 1
push str.LoopSleep
push str.coexecutor
mov edi, eax
call ebp
lea ecx, [esp + 0x19c]
push 0x104
push ecx
push ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x19c]
push 0x5c
push edx
call fcn.0041d120
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x19c]
push str.GenePccMonIL.exe
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x19c]
push ecx
push edi
push edx
lea eax, [esp + 0x5a8]
push str._s__d__d
push eax
call fcn.0041d147
add esp, 0x14
lea ecx, [esp + 0x59c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
xor esi, esi
mov eax, dword [str.XXXXX]
mov cx, word [0x4396dc]
mov dword [esp + 0x5c], eax
mov word [esp + 0x60], cx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x62]
push 0x43fb50
rep stosd dword es:[edi], eax
lea edx, [esp + 0x60]
push 0x104
push edx
push 0x4396d0
push 0x4396c8
push str.annie
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x5c]
push str.XXXXX
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x401ad4
lea ecx, [esp + 0x5c]
push ecx
push str.AMCAP
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x43fb50
push 2
push str.StillCapture
push str.annie
call ebp
push 0x43fb50
push esi
push str.RendererType
push str.annie
mov dword [0x440374], eax
call ebp
push 0x43fb50
push 1
push str.UseStillPin
push str.annie
mov dword [0x440384], eax
call ebp
push 0x43fb50
push esi
push str.CloseWhenPlugout
push str.annie
mov dword [0x440378], eax
call ebp
push 0x43fb50
push esi
push str.UseVRDefault
push str.annie
mov dword [0x44037c], eax
call ebp
push 0x43fb50
push esi
push str.ResumeDelay
push str.annie
mov dword [0x440380], eax
call ebp
push 0x43fb50
push 0xbb8
push str.ResumeTime
push str.annie
mov dword [0x440388], eax
call ebp
push 0x43fb50
push 0xbb8
push str.ResumeStart
push str.annie
mov dword [0x43936c], eax
call ebp
push 0x43fb50
push esi
push str.ResumeShowDelay
push str.annie
mov dword [0x439370], eax
call ebp
push 0x43fb50
push 2
push str.DoScaleRecord
push str.annie
mov dword [0x440578], eax
call ebp
cmp eax, 1
mov dword [0x44056c], eax
jne 0x401bf2
mov dword [0x439374], 0x160
mov dword [0x439378], 0x120
mov dword [0x43937c], 0x140
mov dword [0x439380], 0xf0
push 0x43fb50
push 1
push str.Toolbar
push str.annie
call ebp
push 0x43fb50
push 1
push str.Statusbar
push str.annie
mov dword [0x44038c], eax
call ebp
push 0x43fb50
push esi
push str.StockObject
push str.annie
mov dword [0x440390], eax
call ebp
push 0x43fb50
push esi
push str.NewUI
push str.annie
mov dword [0x44035c], eax
call ebp
cmp eax, 1
mov dword [0x440360], eax
jne 0x401c9d
push 9
push 0xa
push 0x11
push 0xa
jmp 0x401ca1
mov edx, dword [0x4404ec]
push 0x104
push 0x43fb50
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x2e
push 0x43fb50
call fcn.0041d120
add esp, 8
mov byte [eax], 0
push str..ini
push 0x43fb50
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x401a68
push esi
push esi
push esi
push esi
push 0x440364
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x11a4]
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
cmp eax, esi
jne 0x401d54
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push str.AMCapIcon
push ebx
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 1
mov dword [esp + 0x2c], eax
call fcn.004014e0
and eax, 0xffff
push 1
mov dword [esp + 0x3c], eax
call fcn.004014e0
mov edx, dword [0x44035c]
add esp, 8
and eax, 0xffff
neg edx
sbb edx, edx
mov dword [esp + 0x38], eax
and edx, 0xfffffffc
add edx, 4
push edx
call edi
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], 0x100b
mov dword [esp + 0x1c], 0x402e60
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x401d54
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118c
ret
push 0xc
call edi
push esi
mov dword [0x4404f4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [0x4404f4]
mov edi, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x4404f8
push edi
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
push edi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x10
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x280
push esi
cdq
push ebx
push esi
sub eax, edx
push esi
push 0x21c
push 0x280
sar eax, 1
push esi
push eax
push 0x2cf0000
push str.AMCAP
push 1
call fcn.004014e0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExA]
add esp, 4
and eax, 0xffff
push eax
push esi
call edi
push eax
push ebx
mov ecx, 0x441208
mov dword [0x440530], eax
call fcn.00418770
test eax, eax
jne 0x401e00
mov edx, dword [0x440530]
push esi
push esi
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118c
ret
mov eax, dword [esp + 0x11a4]
push eax
push ebx
call fcn.004156e0
mov ecx, dword [0x440530]
add esp, 8
push esi
push ebx
push esi
push ecx
push esi
push esi
push esi
push esi
push 0x44800000
push esi
push str.StatusClass
push esi
call edi
cmp eax, esi
mov dword [0x440534], eax
jne 0x401e43
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118c
ret
mov edx, dword [esp + 0x11a8]
mov eax, dword [0x440530]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push edx
push eax
call edi
mov ecx, dword [0x44038c]
mov edx, dword [0x441208]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push edx
call edi
mov eax, dword [0x440390]
mov ecx, dword [0x440534]
neg eax
sbb eax, eax
and eax, 5
push eax
push ecx
call edi
push 0x43fb50
push 0x104
push 0x43f4d0
push 0x440db4
push str.CaptureFile
push str.annie
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x43fb50
push 1
push str.CaptureWMV
push str.annie
call ebp
mov dword [0x43f820], eax
mov ecx, 0xa
xor eax, eax
mov edi, 0x43f670
mov dword [0x43f824], esi
push 0x43fb50
rep stosd dword es:[edi], eax
lea edx, [esp + 0xda0]
mov ecx, 0xa
mov edi, 0x43f648
push 0x400
push edx
push 0x440db4
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.VideoDevice2
push str.annie
mov dword [0x43f698], esi
mov dword [0x43f69c], esi
mov dword [0x43f630], esi
mov byte [esp + 0xdb4], al
mov byte [esp + 0x9b4], al
call edi
push 0x43fb50
lea eax, [esp + 0x9a0]
push 0x400
push eax
push 0x440db4
push str.AudioDevice2
push str.annie
call edi
mov byte [0x43f644], 0
call fcn.004097c0
cmp dword [0x43f818], esi
jne 0x401f6f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118c
ret
push 0x43fb50
push esi
mov ebx, 1
push str.CaptureCC
push str.annie
mov dword [0x43f628], esi
mov dword [0x43f634], ebx
call ebp
push 0x43fb50
push ebx
push str.MasterStream
push str.annie
mov dword [0x43f638], eax
mov dword [0x43f6a8], ebx
call ebp
push 0x43fb50
push esi
push str.UseTimeLimit
push str.annie
mov dword [0x43f618], eax
mov dword [0x43f7ac], esi
mov dword [0x43f6a0], 0
mov dword [0x43f6a4], 0x403e0000
call ebp
push 0x43fb50
push esi
push str.TimeLimit
push str.annie
mov dword [0x43f7a8], eax
call ebp
push 0x43fb50
push esi
push str.DefaultWidth
push str.annie
mov dword [0x43f7b8], eax
mov dword [0x43f7b0], esi
mov dword [0x43f7b4], esi
call ebp
push 0x43fb50
push esi
push str.DefaultHeight
push str.annie
mov dword [0x43f7c0], eax
call ebp
push 0x43fb50
push esi
push str.DefaultVideo
push str.annie
mov dword [0x43f7c4], eax
call ebp
push eax
push 0x43fb50
lea ecx, [esp + 0x168]
push str.dwDefFormat_of__s___d_n
push ecx
mov dword [0x43f7c8], eax
call fcn.0041d147
mov eax, dword [0x43f7c0]
add esp, 0x10
cmp eax, esi
je 0x402088
cmp dword [0x43f7c4], esi
je 0x402088
mov eax, dword [0x43f7c8]
mov dword [0x43f7bc], ebx
cmp eax, esi
jne 0x40208e
mov dword [0x43f7bc], esi
lea edx, [esp + 0x99c]
lea eax, [esp + 0xd9c]
push edx
push eax
mov dword [0x4403a4], ebx
call fcn.00409610
mov edx, dword [0x4312a8]
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4312a4]
mov eax, dword [0x4312ac]
add esp, 8
mov dword [esp + 0x48], ecx
mov ecx, dword [0x4312b0]
mov dword [esp + 0x3c], 0x20
push str.user32.dll
mov dword [esp + 0x44], 5
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
mov dword [0x44053c], esi
mov dword [0x440540], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.UnregisterDeviceNotification
push edi
call ebp
push str.RegisterDeviceNotificationA
push edi
mov dword [0x44053c], eax
call ebp
cmp eax, esi
mov dword [0x440540], eax
mov dword [0x440538], esi
je 0x402147
mov ecx, dword [0x440530]
lea edx, [esp + 0x3c]
push esi
push edx
push ecx
call eax
mov dword [0x440538], eax
mov eax, dword [0x43f820]
mov dword [0x43fb10], esi
cmp eax, esi
mov dword [0x440394], esi
mov dword [0x440398], esi
mov dword [0x44039c], ebx
mov dword [0x4403a0], esi
mov dword [0x43fb44], esi
je 0x4021c8
cmp dword [0x43f81c], esi
je 0x4021c0
mov edx, dword [0x440530]
push esi
push edx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, 4
jl 0x4021c0
mov ebp, dword [sym.imp.USER32.dll_RemoveMenu]
push 0x400
push esi
push edi
call ebp
push 0x400
push esi
push edi
call ebp
push 0x400
push esi
push edi
call ebp
cmp dword [0x43f820], esi
jne 0x4021cd
call fcn.00401480
cmp dword [0x43f818], esi
jne 0x4021da
call fcn.004084f0
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118c
ret