Function at 0x408e60
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x41b5ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x818
mov al, byte [0x420d68]
push ebx
push ebp
push esi
test al, al
push edi
mov esi, ecx
mov dword [esp + 0x14], 0
jne 0x408fee
lea ebx, [esi + 0x3d]
mov ecx, 8
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea ebp, [esi + 0x5d]
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, ebp
push 0x1f
push ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x10], al
mov edx, dword [esi + 0x948]
push edx
call edi
mov eax, dword [esi + 0x96c]
push 0x10
push ebp
push eax
call edi
cmp byte [ebx], 0
jne 0x408f0c
mov ecx, dword [esi + 4]
push 0x40
push 0x41f514
push 0x41f998
push ecx
mov dword [esi + 0x994], 4
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esi + 0x948]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x408fee
cmp byte [ebp], 0
jne 0x408f44
mov eax, dword [esi + 4]
push 0x40
push 0x41f514
push 0x41f98c
push eax
mov dword [esi + 0x994], 4
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esi + 0x96c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x408fee
push 0
lea ecx, [esi + 0x54c]
push 0
push 0x41f97c
mov dword [esp + 0x1c], ecx
call fcn.00402000
mov dl, byte [esi + 0x940]
mov ecx, 0x4219a0
push edx
push ebp
push ebx
call fcn.0040ded0
mov edi, eax
cmp edi, 0xfffffffe
je 0x408fdc
cmp edi, 0xffffffff
je 0x4094da
test edi, edi
jne 0x409009
mov eax, dword [0x420f60]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [0x420f60]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40903c
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 2
mov dword [esp + 0x14], eax
je 0x4094da
mov dl, byte [esi + 0x940]
mov ecx, 0x4219a0
push edx
push ebp
push ebx
call fcn.0040ded0
mov edi, eax
cmp edi, 0xfffffffe
jne 0x408f76
push 0
push 0
push 0x41f958
mov ecx, dword [esp + 0x1c]
call fcn.00402000
xor al, al
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x824
ret
push edi
lea eax, [esp + 0x42c]
push 0x41f938
push eax
call fcn.004131ef
add esp, 0xc
cmp edi, 0x3eb
push 0
push 0
jne 0x409032
push 0x41f924
jmp 0x408fe5
lea ecx, [esp + 0x430]
push ecx
jmp 0x408fe5
mov eax, dword [0x421674]
test eax, eax
je 0x4090d1
cmp dword [0x421668], 0x3010909
je 0x4090b3
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x44
push 0x41f514
push 0x41f908
push edx
call edi
cmp eax, 6
jne 0x4090b3
mov ebx, dword [esp + 0x10]
push 0
push 0
push 0x41f8ec
mov ecx, ebx
call fcn.00402000
mov ecx, esi
call fcn.0040aad0
test al, al
jne 0x4090b3
mov eax, dword [esi + 4]
push 0x40
push 0x41f514
push 0x41f8d8
push eax
call edi
push 0
push 0
push 0x41f8b8
mov ecx, ebx
call fcn.00402000
cmp dword [0x421674], 0x29
jne 0x4090c3
mov ecx, esi
call fcn.0040a610
push 0
push 0
push 0x42189b
jmp 0x408fe5
mov ecx, dword [0x4216b7]
mov dword [esi + 0x98c], ecx
mov ecx, esi
call fcn.0040e8b0
mov ecx, dword [esi + 0x98c]
cmp eax, ecx
mov al, byte [0x4216cf]
setne bl
test al, al
mov byte [esp + 0x14], bl
je 0x40912e
lea ecx, [esp + 0x18]
call fcn.00405300
push 1
mov ecx, eax
mov dword [esp + 0x834], 0
call fcn.00405410
or ebp, 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x830], ebp
call fcn.00405350
jmp 0x409162
lea ecx, [esp + 0x18]
call fcn.00405300
push 0
mov ecx, eax
mov dword [esp + 0x834], 1
call fcn.00405410
lea ecx, [esp + 0x18]
mov dword [esp + 0x830], 0xffffffff
call fcn.00405350
or ebp, 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00405300
mov edx, dword [0x4219b8]
mov ecx, eax
push edx
mov dword [esp + 0x834], 2
call fcn.004055e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x830], ebp
call fcn.00405350
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
add ecx, 0x1f4
push 1
mul ecx
shr edx, 6
mov dword [esi + 0x9a0], edx
mov dl, byte [0x4216ac]
mov byte [esi + 0x99c], dl
mov eax, dword [0x4216c8]
mov dword [0x420f5c], eax
mov dword [0x420f58], eax
mov eax, dword [0x4216ad]
mov byte [0x420d68], 1
mov ecx, esi
mov dword [esi + 0x998], eax
call fcn.00408110
mov ecx, dword [esp + 0x14]
neg bl
sbb ebx, ebx
push ecx
and ebx, 0x41f89c
mov ecx, esi
push ebx
push 1
push 1
call fcn.004095d0
lea ecx, [esp + 0x18]
call fcn.00405300
mov edx, dword [esi + 0x98c]
mov ecx, dword [0x4219b8]
push edx
push ecx
mov ecx, eax
mov dword [esp + 0x838], 3
call fcn.00405880
lea ecx, [esp + 0x18]
mov dword [esp + 0x830], ebp
call fcn.00405350
lea ecx, [esp + 0x18]
call fcn.00405300
mov edx, dword [0x4219b8]
mov ecx, eax
push edx
mov dword [esp + 0x834], 4
call fcn.00405770
lea ecx, [esp + 0x18]
mov dword [esp + 0x830], ebp
call fcn.00405350
mov ecx, esi
call fcn.00408b60
mov edi, 0x420bb8
mov eax, 0x42189b
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x4092a7
test cl, cl
je 0x4092a3
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x4092a7
add eax, 2
add edi, 2
test cl, cl
jne 0x40927f
xor eax, eax
jmp 0x4092ab
sbb eax, eax
sbb eax, ebp
test eax, eax
je 0x4092c1
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x42189b
call fcn.00402000
mov eax, dword [esi + 0x98c]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0040a4b0
mov edx, dword [esi + 0x998]
mov edi, eax
push edx
call fcn.004011b0
push eax
mov eax, dword [edi]
push eax
push 0x41f884
push 0x42189b
call fcn.004131ef
mov eax, dword [esp + 0x28]
mov edx, dword [0x41f0cc]
add esp, 0x14
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x409327
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x409327
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.00412b8c
add esp, 4
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x42189b
call fcn.00402000
push 1
mov ecx, esi
call fcn.0040adb0
mov ecx, 0x4219a0
call fcn.0040e0f0
mov eax, dword [0x420f60]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [0x420f60]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xbb8
push ecx
call ebx
cmp eax, 0x102
jne 0x409383
mov byte [0x420d68], 1
mov al, 1
jmp 0x408ff0
lea ecx, [esp + 0x18]
call fcn.00405300
push 0x400
push 0x421268
mov ecx, eax
mov dword [esp + 0x838], 5
call fcn.00405470
lea ecx, [esp + 0x18]
mov dword [esp + 0x830], ebp
call fcn.00405350
mov ecx, 0x4219a0
call fcn.0040e100
mov edx, dword [0x420f60]
push edx
call edi
mov eax, dword [0x420f60]
push 0xbb8
push eax
call ebx
cmp eax, 0x102
jne 0x4093ed
mov byte [0x420d68], 1
mov al, 1
jmp 0x408ff0
lea ecx, [esp + 0x20]
call fcn.00405300
push 0x300
push 0x420f64
mov ecx, eax
mov dword [esp + 0x838], 6
call fcn.00405440
lea ecx, [esp + 0x20]
mov dword [esp + 0x830], ebp
call fcn.00405350
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.0040b070
test al, al
je 0x4094d3
mov esi, 0x420bb8
mov eax, 0x4216e5
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x409468
test cl, cl
je 0x409464
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x409468
add eax, 2
add esi, 2
test cl, cl
jne 0x409440
xor eax, eax
jmp 0x40946c
sbb eax, eax
sbb eax, ebp
test eax, eax
je 0x4094d3
mov edi, 0x41f880
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4216e5
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x2c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov al, 1
jmp 0x408ff0
push 0
push 0
push 0x41f61c
jmp 0x408fe5