Function at 0x40facb
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x45e987
call fcn.0041f258
sub esp, 0x2f8
mov eax, 0x9c78
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, eax
jg 0x40fe71
je 0x40fe5e
add eax, 0xffffffd9
cmp esi, eax
jg 0x40fcb1
je case.0x40fe87.40107
mov eax, 0x9c4a
cmp esi, eax
jg 0x40fc02
je 0x40fbf0
sub esi, 0xab
je 0x40fbc2
sub esi, 0x348
je 0x40fba2
sub esi, 0x9853
je 0x40fb98
sub esi, 1
je 0x40fb8e
sub esi, 1
je 0x40fb7c
sub esi, 1
jne case.0x40fe87.40059
push 0x96
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041ca6a
mov dword [ebp - 4], 1
mov ecx, ebx
call fcn.00406912
mov ecx, eax
call fcn.0041466c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041caf0
jmp case.0x40fe87.40059
xor esi, esi
push esi
push esi
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x40fe87.40059
call fcn.00410826
jmp case.0x40fe87.40059
call fcn.0041079f
jmp case.0x40fe87.40059
call fcn.00406912
mov esi, eax
mov ecx, esi
call fcn.00406f63
mov byte [ebp - 0x10], al
mov ecx, esi
push dword [ebp - 0x10]
call fcn.00407e51
jmp 0x40fed4
call fcn.00406912
mov eax, dword [eax + 0x10]
add eax, 0x24
cmp dword [eax + 0x14], 8
jb 0x40fbd5
mov eax, dword [eax]
push 0xa
mov ecx, 0x463758
push ecx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x64]
jmp case.0x40fe87.40059
sub esi, 0x9c4b
je 0x40fc95
sub esi, 1
je 0x40fc80
sub esi, 1
je 0x40fc6b
sub esi, 1
je 0x40fc56
sub esi, 1
je 0x40fc41
sub esi, 1
jne case.0x40fe87.40059
push ebx
lea ecx, [ebp - 0x28]
call fcn.004014f9
lea ecx, [ebp - 0x28]
call fcn.0040156d
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x94]
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x90]
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x8c]
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x88]
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x74]
jmp case.0x40fe87.40059
call fcn.004105e3
jmp case.0x40fe87.40059
lea eax, [esi - 0x9c52]
cmp eax, 0x23
ja case.0x40fe87.40059
movzx eax, byte [eax + 0x410027]
jmp dword [eax*4 + 0x40ffef]
push 0x96
push 0
lea ecx, [ebp - 0x2c]
call fcn.0041ca6a
mov dword [ebp - 4], 2
mov ecx, ebx
call fcn.00406912
mov ecx, ebx
mov edx, dword [eax + 0x10]
call fcn.00419ff4
jmp 0x40fb6b
call fcn.004108e8
jmp case.0x40fe87.40059
push 0x96
push str.load.ani
lea ecx, [ebp - 0x2c]
call fcn.0041ca6a
mov dword [ebp - 4], 3
mov ecx, ebx
call fcn.00406912
mov ecx, eax
call fcn.00407392
jmp 0x40fb6b
push ebx
call dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0x9c5d
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
shr eax, 3
mov ecx, ebx
not al
and al, 1
movzx eax, al
push eax
call fcn.00406912
mov ecx, eax
call fcn.004080ec
jmp case.0x40fe87.40059
call fcn.00406912
xor esi, esi
mov edi, dword [eax + 0x18]
test edi, edi
je 0x40fd76
mov edx, dword [edi + 4]
jmp 0x40fd78
mov edx, esi
mov ecx, ebx
call fcn.0041188d
test edi, edi
je 0x40fd86
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, eax
call fcn.00411861
jmp case.0x40fe87.40059
call fcn.00406912
xor esi, esi
mov edi, dword [eax + 0x14]
test edi, edi
je 0x40fdac
mov edx, dword [edi + 4]
jmp 0x40fdae
mov edx, esi
mov ecx, ebx
call fcn.0041188d
test edi, edi
je 0x40fdbc
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, eax
call fcn.00411877
jmp case.0x40fe87.40059
call fcn.00406912
push 0xffffffffffffffff
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x48]
jmp case.0x40fe87.40059
call fcn.004104f9
jmp case.0x40fe87.40059
xor dl, dl
call fcn.00410c1f
jmp case.0x40fe87.40059
call fcn.00410621
jmp case.0x40fe87.40059
call fcn.004114b0
jmp case.0x40fe87.40059
push 0
push 0xb
call fcn.0040d234
push eax
push ebx
call dword [sym.imp.USER32.dll_WinHelpW]
jmp case.0x40fe87.40059
lea ecx, [ebp - 0x304]
call fcn.00411ce1
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x2c]
push esi
push ecx
mov ecx, eax
call fcn.0040e1f2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x304]
call fcn.00411d72
lea edx, [ebp - 0x2c]
mov ecx, ebx
call fcn.004115cf
jmp 0x40feaa
push 1
call fcn.00406912
mov ecx, eax
call fcn.00407c08
jmp case.0x40fe87.40059
add esi, 0xffff6387
cmp esi, 0x3f
ja case.0x40fe87.40059
movzx eax, byte [esi + 0x4100b3]
jmp dword [eax*4 + 0x41004b]
push 0x463758
lea ecx, [ebp - 0x2c]
call fcn.004014c8
and dword [ebp - 4], 0
xor edx, edx
inc edx
lea ecx, [ebp - 0x2c]
call fcn.0041a223
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004017c6
jmp case.0x40fe87.40059
call fcn.00406912
mov esi, eax
mov ecx, esi
call fcn.004077f7
test al, al
je 0x40fed4
mov ecx, esi
call fcn.00407271
mov ecx, ebx
call fcn.0040f508
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, eax
call fcn.00406646
jmp case.0x40fe87.40059
call fcn.00410a68
jmp case.0x40fe87.40059
call fcn.0041094d
jmp case.0x40fe87.40059
call fcn.004109aa
jmp case.0x40fe87.40059
call fcn.0041070e
jmp case.0x40fe87.40059
call fcn.00410602
jmp case.0x40fe87.40059
mov dl, 1
jmp 0x40fdf1
call fcn.00411585
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, ebx
cmp byte [eax + 0xdc], 0
je case.0x40fe87.40085
call fcn.0041153a
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, ebx
cmp byte [eax + 0xdc], 0
je 0x40fe5e
push 0
jmp 0x40fe60
call fcn.00406912
mov esi, eax
mov ecx, esi
call fcn.00406f63
neg al
sbb al, al
inc al
jmp 0x40fbb0
call fcn.004101db
jmp case.0x40fe87.40059
xor edx, edx
call fcn.004101aa
jmp case.0x40fe87.40059
xor edx, edx
inc edx
jmp 0x40ff8b
call fcn.004100f3
jmp case.0x40fe87.40059
call fcn.004112f1
jmp case.0x40fe87.40059
push 0x28
push 1
jmp 0x40fe13
call fcn.00410cbe
jmp case.0x40fe87.40059
call fcn.00406912
mov ecx, ebx
mov edi, dword [eax + 0xc]
call fcn.00406912
lea ecx, [ebp - 0x14]
push ecx
mov ecx, edi
mov esi, dword [eax + 0x18]
mov eax, dword [edi]
call dword [eax + 0x3c]
push eax
mov ecx, esi
call fcn.0041ade7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8