Function at 0x40c710
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4467b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], ecx
mov byte [ebp - 0x21d], 0
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x40cb6e
mov eax, esi
lea edx, [eax + 2]
jmp 0x40c770
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40c770
sub eax, edx
sar eax, 1
je 0x40cb6e
mov dword [ebp - 0x224], ebx
mov edi, 4
mov dword [ebp - 0x254], edi
push str.Uninstall_Common_Softwares...
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
cmp dword [ebp - 0x224], ebx
je 0x40c7d0
mov edi, 0x1000004
mov dword [ebp - 0x254], edi
push 0x465138
push str.TotalUninstaller__s
lea edx, [ebp - 0x21c]
call fcn.0040dd40
add esp, 8
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov ebx, eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x268], 0x40
mov dword [ebp - 0x27c], 0x20
mov dword [ebp - 0x2d4], 0x44
push 0x44
push 0
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00430500
push esi
push str.COMMAND_:___s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 0x14
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x2d4]
push eax
push 0
push 0
push edi
push 1
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40c88f
lea esi, [ebp + 0xc]
call fcn.004058f0
add eax, 0x800
push eax
push str.Uninstall_Runinng:__s__cannot_create_Process
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
mov ecx, dword [ebp - 0x230]
push ecx
push 1
push 0x7e9
mov edx, dword [ebp - 0x22c]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x250]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x40c8de
lea esi, [ebp + 0xc]
call fcn.004058f0
add eax, 0x800
push eax
push str.Uninstall_Runinng:__s__fail_to_assign_process_to_job
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
mov edx, dword [ebp - 0x248]
push edx
push str.processID_:___d_
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
lea eax, [ebp - 0x224]
push eax
push ebx
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
cmp dword [ebp - 0x224], 0
jne 0x40c935
lea esi, [ebp + 0xc]
call fcn.004058f0
add eax, 0x800
push eax
push str.Uninstall_Runinng:__s__process_is_not_in_Job
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.the_command_finished___
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x23c], pe_nt_image_headers32
push pe_nt_image_headers32
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x238], edi
mov dword [edi], 0x3c
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
push edi
push 3
push ebx
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
mov esi, dword [edi + 4]
mov dword [ebp - 0x234], esi
test esi, esi
je 0x40cadc
push esi
push str.After_Uninstall_Runinng__number_of_process_in_Job_:___d_
mov ecx, 0x466338
call fcn.0041a690
xor ecx, ecx
mov eax, esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041e79e
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x40cad6
xor edi, edi
mov dword [ebp - 0x240], edi
mov edi, edi
cmp edi, esi
jge 0x40ca65
mov esi, dword [ebp - 0x238]
mov eax, dword [esi + edi*4 + 8]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx + edi*4], eax
test eax, eax
je 0x40ca2e
mov ecx, dword [esi + edi*4 + 8]
push ecx
push edi
lea esi, [ebp + 0xc]
call fcn.004058f0
add eax, 0x800
push eax
push str.Uninstall_Runinng:__s__Open_process_successfully___d_nd_process_id:___d_
jmp 0x40ca47
mov edx, dword [esi + edi*4 + 8]
push edx
push edi
lea esi, [ebp + 0xc]
call fcn.004058f0
add eax, 0x800
push eax
push str.Uninstall_Runinng:__s__fail_to_open_process___d_nd_process_id:___d_
mov ecx, 0x466338
call fcn.0041a690
add esp, 0x10
add edi, 1
mov dword [ebp - 0x240], edi
mov esi, dword [ebp - 0x234]
jmp 0x40c9f0
lea esi, [ebp + 0xc]
call fcn.004058f0
add eax, 0x800
push eax
push str.Uninstall_Runinng:__s__Waiting_for_Job
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
push 0xffffffffffffffff
push 1
push ebx
mov edi, dword [ebp - 0x234]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
mov dword [ebp - 0x258], esi
cmp esi, edi
jge 0x40cab8
cmp dword [ebx + esi*4], 0
je 0x40cab3
mov eax, dword [ebx + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 1
jmp 0x40ca99
push str.End_waiting_for_the_job
mov ecx, 0x466338
call fcn.0041a690
push ebx
call fcn.0041e7a3
add esp, 8
mov edi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x228]
lea esi, [ebp + 0xc]
call fcn.004058f0
mov esi, eax
call fcn.0040d9e0
test al, al
jne 0x40caf6
mov byte [ebp - 0x21d], 1
mov ecx, dword [ebp - 0x230]
push ecx
push 2
push 0x7e9
mov edx, dword [ebp - 0x22c]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x24c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40cb26
push eax
call esi
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x40cb33
push eax
call esi
test edi, edi
je 0x40cb3e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x40cb45
push ebx
call esi
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x21d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0042f002
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x40cb52