Function at 0x4095ea
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [0x4194ef], 0
push 0
call fcn.00409337
cmp dword [0x41b540], 0
jne 0x40965a
mov eax, dword [0x41921b]
cmp dword [0x41b554], eax
jbe 0x409628
push dword [0x41b554]
call fcn.0040998e
jmp 0x40998b
cmp dword [0x41b554], 0
jne 0x409636
jmp 0x40998b
mov dword [0x419503], 0
mov dword [0x419507], 0
push dword [0x41b554]
call fcn.0040335e
jmp 0x40998b
cmp dword [0x41b540], 0x11
jne 0x409687
mov dword [0x419503], 0
mov dword [0x419507], 0
push dword [0x419356]
call fcn.0040335e
jmp 0x40998b
cmp dword [0x41b540], 0xe
jne 0x4096b4
mov dword [0x419503], 0
mov dword [0x419507], 0
push dword [0x419362]
call fcn.0040335e
jmp 0x40998b
cmp dword [0x41b540], 0xf
jne 0x4096c9
push 1
call fcn.0040e806
jmp 0x40998b
cmp dword [0x41b540], 0x10
jne 0x4096de
push 0
call fcn.0040e806
jmp 0x40998b
cmp dword [0x41b540], 1
jne 0x409741
mov ebx, dword [0x41b554]
shl ebx, 2
add ebx, dword [0x419273]
mov eax, dword [ebx]
add eax, dword [0x419287]
mov dword [ebp - 8], eax
push dword [0x41b558]
push 0x41c257
push dword [ebp - 8]
call fcn.0040f9d0
mov ebx, dword [0x41b558]
mov byte [ebx + 0x41c257], 0
push 1
push 0
push 0
push 0x41c257
push str.open
push dword [0x419004]
call sub.SHELL32.dll_ShellExecuteA
jmp 0x40998b
cmp dword [0x41b540], 2
jne 0x409754
call fcn.00409e2f
jmp 0x40998b
cmp dword [0x41b540], 3
jne 0x4097f7
mov dword [0x419527], 1
jmp 0x409774
mov eax, dword [0x41b554]
mov dword [ebp - 4], 0x20
mul dword [ebp - 4]
mov dword [ebp - 4], eax
mov ebx, eax
push dword [ebx + 0x41b72b]
push 0x40a0ea
push dword [0x419004]
push 0x40976d
push dword [section..data]
call sub.USER32.dll_DialogBoxParamA
cmp eax, 1
jne 0x4097d3
mov ebx, dword [ebp - 4]
mov eax, dword [0x41951b]
mov dword [ebx + 0x41b72b], eax
wait
fninit
fild dword [0x41951b]
fmul qword [ebx + 0x41b723]
fstp qword [ebx + 0x41b72f]
jmp 0x4097e3
cmp eax, 3
jne 0x4097e3
push dword [0x41b554]
call fcn.0040a412
mov dword [0x419527], 0
call fcn.004030f9
jmp 0x40998b
cmp dword [0x41b540], 4
jne 0x409814
mov dword [0x419513], 0
call fcn.004030f9
jmp 0x40998b
cmp dword [0x41b540], 5
jne 0x4098ae
mov ebx, dword [0x41b554]
shl ebx, 2
add ebx, dword [0x419273]
mov eax, dword [ebx]
add eax, dword [0x419287]
mov dword [ebp - 8], eax
push dword [0x41b558]
push 0x41bd2b
push dword [ebp - 8]
call fcn.0040f9d0
mov ebx, dword [0x41b558]
mov byte [ebx + 0x41bd2b], 0
push str._Productid
push 0x41bd2b
call fcn.0040f980
push 8
call fcn.00409a9c
push str.number
push 0x41bd2b
call fcn.0040f980
push 0x14
call fcn.00409a9c
jmp 0x40988e
push 1
push 0
push 0
push 0x41bd2b
push 0x409889
push dword [0x419004]
call sub.SHELL32.dll_ShellExecuteA
jmp 0x40998b
cmp dword [0x41b540], 6
jne 0x4098d4
cmp dword [0x419533], 0
jbe 0x40998b
dec dword [0x419533]
call fcn.004030f9
jmp 0x40998b
cmp dword [0x41b540], 7
jne 0x409905
mov eax, dword [0x419533]
inc eax
mul dword [0x41922f]
cmp eax, dword [0x419513]
jae 0x40998b
inc dword [0x419533]
call fcn.004030f9
jmp 0x40998b
cmp dword [0x41b540], 0xa
jne 0x409927
push 0
push 0xf060
push 0x112
push dword [0x419004]
call sub.USER32.dll_SendMessageA
jmp 0x40998b
cmp dword [0x41b540], 0xb
jne 0x409949
push 0
push 0x6a6
push 0x111
push dword [0x419004]
call sub.USER32.dll_SendMessageA
jmp 0x40998b
cmp dword [0x41b540], 0xc
jne 0x40996b
push 0
push 0x3f5
push 0x111
push dword [0x419004]
call sub.USER32.dll_SendMessageA
jmp 0x40998b
cmp dword [0x41b540], 0xd
jne 0x40998b
push 0
push 0x6a7
push 0x111
push dword [0x419004]
call sub.USER32.dll_SendMessageA
pop ebx
leave
ret