Function at 0x40c6c0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x621847
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x6b6538]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00436970
mov esi, eax
call fcn.00401730
mov ecx, eax
test ecx, ecx
je 0x40cc70
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4e4], eax
push esi
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 1
call fcn.0040d790
test al, al
jne 0x40c75b
push esi
lea ecx, [ebp - 0x4e4]
call fcn.0040da30
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 3
call fcn.00436720
mov esi, dword [ebp - 0x4e4]
mov ecx, str.sysclosebutton
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c79d
test dx, dx
je 0x40c799
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c79d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c777
xor eax, eax
jmp 0x40c7a2
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cc21
mov ecx, str.btn_cancel
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c7d7
test dx, dx
je 0x40c7d3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c7d7
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c7b1
xor eax, eax
jmp 0x40c7dc
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cc21
mov ecx, str.sysminbutton
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c816
test dx, dx
je 0x40c812
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c816
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c7f0
xor eax, eax
jmp 0x40c81b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40c82a
push eax
push 0xf020
jmp 0x40cc28
mov ecx, str.btn_inst
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c857
test dx, dx
je 0x40c853
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c857
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c831
xor eax, eax
jmp 0x40c85c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40c99f
mov ecx, dword [edi + 0x77c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x218]
mov ecx, dword [edi + 0x774]
push 0
mov eax, dword [ecx]
call dword [eax + 0x118]
mov ecx, dword [edi + 0x778]
test ecx, ecx
je 0x40c898
mov eax, dword [ecx]
push 0
call dword [eax + 0x118]
push 0
mov ecx, edi
call fcn.0040c600
lea eax, [edi + 0x78c]
push eax
call fcn.0041b25f
add esp, 4
test eax, eax
jne 0x40c8c4
push 0x6a2f48
lea ecx, [edi + 0x78c]
call fcn.00409210
cmp dword [edi + 0x7a0], 8
lea eax, [edi + 0x78c]
jb 0x40c8d5
mov eax, dword [eax]
push eax
call fcn.004062d0
mov ecx, eax
call fcn.0041e995
push 0
push 0x6c1ae0
push 0x6c190c
push 0
push str.opt_startService
lea ecx, [edi + 0x30]
call fcn.0042ad30
push eax
call fcn.0052721f
add esp, 0x14
test eax, eax
je 0x40c921
mov ecx, eax
call fcn.004350d0
movzx eax, al
push eax
call fcn.004062d0
mov ecx, eax
call fcn.0041e911
lea eax, [edi + 0x76c]
mov dword [edi + 0x7a4], 1
mov dword [ebp - 0x4dc], eax
call fcn.0040b550
lea edx, [edi + 0x76c]
lea ecx, [eax + 4]
mov dword [ebp - 0x4e0], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ecx, eax
je 0x40c960
cmp dword [ecx], edx
je 0x40c980
add ecx, 4
cmp ecx, eax
jne 0x40c955
mov ecx, dword [ebp - 0x4e0]
cmp dword [ecx + 8], eax
je 0x40c973
mov dword [eax], edx
add dword [ecx + 4], 4
jmp 0x40c980
lea edx, [ebp - 0x4dc]
push edx
push eax
call fcn.0040dea0
push 0
push 0
push edi
push 0x40be50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x7a8], eax
jmp 0x40cc34
mov ecx, str.btn_browser
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c9cc
test dx, dx
je 0x40c9c8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c9cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c9a6
xor eax, eax
jmp 0x40c9d1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cb43
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.00436970
push eax
lea ecx, [ebp - 0x4dc]
call fcn.0040d580
mov eax, dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x42a]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x454]
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x43c], eax
xor eax, eax
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x42c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x440], 0x40d660
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
mov byte [ebp - 4], 5
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x454]
test ecx, ecx
push dword [ebp - 0x18]
cmove ecx, eax
xor eax, eax
mov dword [ebp - 0x454], ecx
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40cb2d
test byte [ebp - 0x444], 1
je 0x40cafa
lea ecx, [ebp - 0x222]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40cb2a
lea eax, [ebp - 0x222]
mov ecx, edi
push eax
call fcn.0040c010
test eax, eax
je 0x40cb2a
mov ecx, dword [edi + 0x770]
test ecx, ecx
je 0x40cb2a
add edi, 0x78c
cmp dword [edi + 0x14], 8
jb 0x40cb24
mov edi, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4dc]
jmp 0x40cc07
mov ecx, str.btn_ok
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cb76
test dx, dx
je 0x40cb72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cb76
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cb50
xor eax, eax
jmp 0x40cb7b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cb88
push eax
push eax
push 0x10
jmp 0x40cc2d
mov ecx, str.btn_license
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cbb6
test dx, dx
je 0x40cbb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cbb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cb90
xor eax, eax
jmp 0x40cbbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cc34
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.00436970
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0040d580
push 1
push 0
push 0
push dword [ebp - 0x4e0]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x4e0]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cc34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40cc34
push 0
push 0xf060
push 0x112
mov ecx, edi
call fcn.0043a290
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40cc53
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ce82
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040b820
int3