Function at 0x4d40c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c1a2
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x661850]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], ecx
push str.Tue_Jul_28_13:52:42_2015
push 0x3bf
push str.CNPCWnd::OnLButtonUp
push str.GameProcessNPCWnd.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x13c]
add ecx, 0x578
call fcn.00516820
movzx eax, al
test eax, eax
je 0x4d4194
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x13c]
add ecx, 0x578
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax + 0x578]
mov eax, dword [edx + 0x24]
call eax
cmp eax, 4
jne 0x4d4194
mov ecx, dword [ebp - 0x13c]
add ecx, 0x578
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0x578]
mov edx, dword [eax + 0xc]
call edx
mov byte [ebp - 0x135], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0x135]
jmp 0x4d484c
mov eax, dword [ebp - 0x13c]
mov byte [eax + 0xff9], 1
mov ecx, dword [ebp - 0x13c]
mov byte [ecx + 0x1129], 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x13c]
add ecx, 0xea8
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xea8]
mov edx, dword [eax + 0xc]
call edx
movzx eax, al
test eax, eax
je 0x4d42d8
mov ecx, 0x77b1b8
call fcn.0043b9f0
movzx ecx, al
test ecx, ecx
je 0x4d420d
push 3
mov ecx, 0x6eeef8
call fcn.00496cc0
push 0
mov edx, dword [0x77b1b8]
mov ecx, 0x77b1b8
mov eax, dword [edx + 0xc]
call eax
mov ecx, 0x7792f4
call fcn.0043b9f0
movzx ecx, al
test ecx, ecx
je 0x4d423c
push 0xf
mov ecx, 0x6eeef8
call fcn.00496cc0
push 0
mov edx, dword [0x7792f4]
mov ecx, 0x7792f4
mov eax, dword [edx + 0xc]
call eax
mov ecx, 0x7775f8
call fcn.0043b9f0
movzx ecx, al
test ecx, ecx
je 0x4d426b
push 2
mov ecx, 0x6eeef8
call fcn.00496cc0
push 0
mov edx, dword [0x7775f8]
mov ecx, 0x7775f8
mov eax, dword [edx + 0xc]
call eax
mov ecx, 0x6f322c
call fcn.0043b9f0
movzx ecx, al
test ecx, ecx
je 0x4d429a
push 0
mov ecx, 0x6eeef8
call fcn.00496cc0
push 0
mov edx, dword [0x6f322c]
mov ecx, 0x6f322c
mov eax, dword [edx + 0xc]
call eax
mov ecx, 0x7a59d8
call fcn.0043b9f0
movzx ecx, al
test ecx, ecx
je 0x4d42b7
push 0x1b
mov ecx, 0x6eeef8
call fcn.00496ec0
mov byte [ebp - 0x136], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0x136]
jmp 0x4d484c
mov ecx, 0x66ab24
call fcn.00466bb0
mov dword [ebp - 0x18], 0
jmp 0x4d42f4
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov ecx, 0x66ab24
call fcn.004505e0
cmp dword [ebp - 0x18], eax
jge 0x4d47ca
mov ecx, 0x66ab24
call fcn.0050cea0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 2
jne 0x4d47b4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [eax + 0xeb0]
jle 0x4d433c
jmp 0x4d47ca
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4d47b4
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
movsx ecx, byte [eax]
cmp ecx, 0x40
jne 0x4d45b5
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
movsx ecx, byte [eax + 1]
cmp ecx, 0x40
jne 0x4d45b5
push 0x20
mov ecx, 0x7c0e48
call fcn.005121c0
mov dword [0x6f3228], 0x21
mov dword [0x6ef668], 6
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
movsx ecx, byte [eax + 2]
cmp ecx, 0x2a
jne 0x4d43eb
push 0
push 0xa
push 0xc5
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x2a
push 0xcc
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x6ef668], 7
push 0x1a4
push 2
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
mov ecx, 0x6f09c4
call fcn.00513b70
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x6f09c4
call fcn.00513af0
push 0x574a9b
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x6658cc]
mov dword [ebp - 0x140], edx
cmp dword [ebp - 0x140], 0
je 0x4d444e
cmp dword [ebp - 0x140], 1
je 0x4d44e0
jmp 0x4d456c
mov eax, dword [0x6658d0]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x320
je 0x4d4473
cmp dword [ebp - 0x144], 0x400
je 0x4d44a9
jmp 0x4d44db
push 1
push 0xe
push 0x109
mov ecx, dword [0x69edd6]
add ecx, 0x139
push ecx
mov edx, dword [0x69edd2]
add edx, 0x10b
push edx
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x4d44db
push 1
push 0xe
push 0x107
mov eax, dword [0x69edd6]
add eax, 0x18d
push eax
mov ecx, dword [0x69edd2]
add ecx, 0x17d
push ecx
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x4d456c
mov edx, dword [0x6658d0]
mov dword [ebp - 0x148], edx
cmp dword [ebp - 0x148], 0x320
je 0x4d4506
cmp dword [ebp - 0x148], 0x400
je 0x4d453a
jmp 0x4d456c
push 1
push 0xe
push 0x136
mov eax, dword [0x69edd6]
add eax, 0x154
push eax
mov ecx, dword [0x69edd2]
add ecx, 0xf4
push ecx
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x4d456c
push 1
push 0xe
push 0x136
mov edx, dword [0x69edd6]
add edx, 0x1a7
push edx
mov eax, dword [0x69edd2]
add eax, 0x163
push eax
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
push 0x104
mov eax, dword [ebp - 0x13c]
add eax, 0xb4
push eax
call fcn.005477d6
add esp, 0xc
jmp 0x4d47b4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
movsx eax, byte [edx]
cmp eax, 0x40
jne 0x4d463c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x21
jne 0x4d463c
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx + 0xb0]
push edx
mov ecx, 0x6f322c
call fcn.0043ba40
mov ecx, 0x6f322c
call fcn.0043b9f0
movzx eax, al
test eax, eax
jne 0x4d4606
push 0
mov ecx, 0x6eeef8
call fcn.00496ec0
push 4
mov ecx, 0x6f322c
call fcn.004a6370
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
push 0
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 0xb0]
push ecx
push 0x3f3
mov ecx, 0x7c46b0
call fcn.00508040
jmp 0x4d47b4
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
movsx ecx, byte [eax]
cmp ecx, 0x40
jne 0x4d46c7
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
movsx ecx, byte [eax + 1]
cmp ecx, 0x23
jne 0x4d46c7
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
call fcn.00545a90
add esp, 4
cmp eax, 3
jbe 0x4d46c7
mov byte [ebp - 0x134], 0
push 0x103
push 0
lea ecx, [ebp - 0x133]
push ecx
call fcn.005454d0
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
add eax, 2
push eax
push 0x104
lea ecx, [ebp - 0x134]
push ecx
call fcn.005477d6
add esp, 0xc
push 1
push 0
push 0
lea edx, [ebp - 0x134]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4d47b4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
push 0x5810c8
call fcn.00548180
add esp, 8
test eax, eax
jne 0x4d4722
push str._SpecialRepairitem
push 0
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xb0]
push eax
push 0x3f3
mov ecx, 0x7c46b0
call fcn.00508040
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx + 0x1c0]
add edx, 1
mov eax, dword [ebp - 0x13c]
mov dword [eax + 0x1c0], edx
jmp 0x4d47b4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
push str._jfsell
call fcn.00548180
add esp, 8
test eax, eax
jne 0x4d4788
mov byte [0x76f8f4], 1
push 1
mov ecx, 0x6f322c
call fcn.004a6370
mov dword [0x76f8d4], 0xffffffff
mov ecx, 0x6f322c
call fcn.0043b9f0
movzx eax, al
test eax, eax
jne 0x4d4786
push 0
mov ecx, 0x6eeef8
call fcn.00496c40
push 1
mov edx, dword [0x6f322c]
mov ecx, 0x6f322c
mov eax, dword [edx + 0xc]
call eax
jmp 0x4d478f
mov byte [0x76f8f4], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
push 0
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 0xb0]
push ecx
push 0x3f3
mov ecx, 0x7c46b0
call fcn.00508040
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x1c], 0
mov ecx, 0x66ab24
call fcn.0046d040
jmp 0x4d42eb
mov eax, dword [ebp - 0x13c]
cmp dword [eax + 0x1fc], 0
je 0x4d4830
mov ecx, dword [ebp - 0x13c]
movzx edx, byte [ecx + 0x298]
test edx, edx
je 0x4d4830
mov eax, dword [ebp - 0x13c]
mov byte [eax + 0x298], 0
push 0x10
push 0
mov ecx, dword [ebp - 0x13c]
add ecx, 0x29c
push ecx
call fcn.005454d0
add esp, 0xc
mov edx, dword [ebp - 0x13c]
mov dword [edx + 0x294], 0
mov eax, dword [ebp - 0x13c]
mov dword [eax + 0x290], 0
mov byte [ebp - 0x137], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0x137]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0054514c
mov esp, ebp
pop ebp
ret 8