Function at 0x407cc9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00409d50
mov dword [ebp - 0x1c], 3
jmp 0x407b93
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xbd0]
add ecx, 0xec
call fcn.00409a00
cmp dword [ebp - 0x1c], eax
jge 0x407c59
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0xbcc]
push edx
mov ecx, dword [ebp - 0xbd0]
add ecx, 0xec
call fcn.00409a20
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xbcc]
call fcn.00409d70
mov dword [ebp - 0x4c], 0x30
push 0x2c
push 0
lea ecx, [ebp - 0x48]
push ecx
call fcn.00417120
add esp, 0xc
mov dword [ebp - 0x48], 0x20
lea edx, [ebp - 0x4c]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.00409df0
test eax, eax
je 0x407c54
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
push 0x30
push 0
lea edx, [ebp - 0x4c]
push edx
call fcn.00417120
add esp, 0xc
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x48], 0x20
lea eax, [ebp - 0x4c]
push eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0xbd0]
add ecx, 0xec
call fcn.00409df0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], edx
jmp 0x407c59
jmp 0x407b8a
cmp dword [ebp - 4], 0
je 0x407c65
cmp dword [ebp - 0x18], 0
jne 0x407c72
lea ecx, [ebp - 0x14]
call fcn.00409d70
jmp 0x4084f1
xor eax, eax
mov word [ebp - 0x10], ax
xor ecx, ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], cx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xbd0]
call fcn.00404b20
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xbd4], ecx
mov edx, dword [ebp - 0xbd4]
sub edx, 0x88
mov dword [ebp - 0xbd4], edx
cmp dword [ebp - 0xbd4], 8
ja case.0x407cc2.3
mov eax, dword [ebp - 0xbd4]
jmp dword [eax*4 + 0x408504]
push 5
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0x425a7c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4084e9
lea ecx, [ebp - 0x54]
call fcn.00410cc0
lea ecx, [ebp - 0x50]
call fcn.00410cc0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbd8], eax
lea ecx, [ebp - 0x54]
call fcn.00409e40
push eax
push 0xbc
mov edx, dword [ebp - 0xbd8]
push edx
mov eax, dword [ebp - 0xbd8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409400
push 0
lea ecx, [ebp - 0x50]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbdc], eax
lea ecx, [ebp - 0x54]
call fcn.00409e40
push eax
push 0xbd
mov ecx, dword [ebp - 0xbdc]
push ecx
mov edx, dword [ebp - 0xbdc]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp - 0x50]
call fcn.00409400
push 0
lea ecx, [ebp - 0x50]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbe0], eax
lea ecx, [ebp - 0x54]
call fcn.00409e40
push eax
push 3
mov eax, dword [ebp - 0xbe0]
push eax
mov ecx, dword [ebp - 0xbe0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x50]
call fcn.00409400
push 0
lea ecx, [ebp - 0x50]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbe4], eax
lea ecx, [ebp - 0x54]
call fcn.00409e40
push eax
push 4
mov edx, dword [ebp - 0xbe4]
push edx
mov eax, dword [ebp - 0xbe4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409400
push 0
lea ecx, [ebp - 0x50]
call fcn.004095b0
xor ecx, ecx
mov word [ebp - 0x2b8], cx
push 0x206
push 0
lea edx, [ebp - 0x2b6]
push edx
call fcn.00417120
add esp, 0xc
mov dword [ebp - 0xb0], 0x58
push 0x54
push 0
lea eax, [ebp - 0xac]
push eax
call fcn.00417120
add esp, 0xc
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xac], edx
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], 0x104
lea ecx, [ebp - 0x50]
call fcn.00409d40
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x7c], 0x1800
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x407ebe
push 1
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x2b8]
push eax
mov ecx, dword [ebp - 0xbd0]
call fcn.00407b00
lea ecx, [ebp - 0x50]
call fcn.00401130
lea ecx, [ebp - 0x54]
call fcn.00401130
jmp 0x4084e9
lea ecx, [ebp - 0x6d4]
call fcn.00410cc0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbe8], eax
lea ecx, [ebp - 0x6d4]
call fcn.00409e40
push eax
push 0xb9
mov ecx, dword [ebp - 0xbe8]
push ecx
mov edx, dword [ebp - 0xbe8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
xor edx, edx
mov word [ebp - 0x6d0], dx
push 0x206
push 0
lea eax, [ebp - 0x6ce]
push eax
call fcn.00417120
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x4c8], cx
push 0x206
push 0
lea edx, [ebp - 0x4c6]
push edx
call fcn.00417120
add esp, 0xc
mov dword [ebp - 0x6f4], 0
xor eax, eax
mov dword [ebp - 0x6f0], eax
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x6f4], edx
lea ecx, [ebp - 0x6d4]
call fcn.00409d40
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x6e4], 0x51
lea eax, [ebp - 0x6d0]
mov dword [ebp - 0x6ec], eax
lea ecx, [ebp - 0x6f4]
push ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x40800d
lea edx, [ebp - 0x4c8]
push edx
mov eax, dword [ebp - 0x2bc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40800d
push 1
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x4c8]
push edx
mov ecx, dword [ebp - 0xbd0]
call fcn.00407b00
lea ecx, [ebp - 0x6d4]
call fcn.00401130
jmp 0x4084e9
lea ecx, [ebp - 0x6fc]
call fcn.00410cc0
lea ecx, [ebp - 0x6f8]
call fcn.00410cc0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbec], eax
lea ecx, [ebp - 0x6fc]
call fcn.00409e40
push eax
push 0xbe
mov eax, dword [ebp - 0xbec]
push eax
mov ecx, dword [ebp - 0xbec]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
lea ecx, [ebp - 0x6fc]
push ecx
lea ecx, [ebp - 0x6f8]
call fcn.00409400
push 0
lea ecx, [ebp - 0x6f8]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbf0], eax
lea ecx, [ebp - 0x6fc]
call fcn.00409e40
push eax
push 0xbf
mov edx, dword [ebp - 0xbf0]
push edx
mov eax, dword [ebp - 0xbf0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
lea eax, [ebp - 0x6fc]
push eax
lea ecx, [ebp - 0x6f8]
call fcn.00409400
push 0
lea ecx, [ebp - 0x6f8]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbf4], eax
lea ecx, [ebp - 0x6fc]
call fcn.00409e40
push eax
push 3
mov ecx, dword [ebp - 0xbf4]
push ecx
mov edx, dword [ebp - 0xbf4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
lea edx, [ebp - 0x6fc]
push edx
lea ecx, [ebp - 0x6f8]
call fcn.00409400
push 0
lea ecx, [ebp - 0x6f8]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbf8], eax
lea ecx, [ebp - 0x6fc]
call fcn.00409e40
push eax
push 4
mov eax, dword [ebp - 0xbf8]
push eax
mov ecx, dword [ebp - 0xbf8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
lea ecx, [ebp - 0x6fc]
push ecx
lea ecx, [ebp - 0x6f8]
call fcn.00409400
push 0
lea ecx, [ebp - 0x6f8]
call fcn.004095b0
xor edx, edx
mov word [ebp - 0x960], dx
push 0x206
push 0
lea eax, [ebp - 0x95e]
push eax
call fcn.00417120
add esp, 0xc
mov dword [ebp - 0x758], 0x58
push 0x54
push 0
lea ecx, [ebp - 0x754]
push ecx
call fcn.00417120
add esp, 0xc
mov edx, dword [ebp - 0xbd0]
mov eax, dword [edx + 4]
mov dword [ebp - 0x754], eax
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x738], 0x104
lea ecx, [ebp - 0x6f8]
call fcn.00409d40
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x724], 0x1800
lea edx, [ebp - 0x758]
push edx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x408232
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x960]
push ecx
mov ecx, dword [ebp - 0xbd0]
call fcn.00407b00
lea ecx, [ebp - 0x6f8]
call fcn.00401130
lea ecx, [ebp - 0x6fc]
call fcn.00401130
jmp 0x4084e9
lea ecx, [ebp - 0x968]
call fcn.00410cc0
lea ecx, [ebp - 0x964]
call fcn.00410cc0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xbfc], eax
lea ecx, [ebp - 0x968]
call fcn.00409e40
push eax
push 0xc0
mov edx, dword [ebp - 0xbfc]
push edx
mov eax, dword [ebp - 0xbfc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x964]
call fcn.00409400
push 0
lea ecx, [ebp - 0x964]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xc00], eax
lea ecx, [ebp - 0x968]
call fcn.00409e40
push eax
push 0xc1
mov ecx, dword [ebp - 0xc00]
push ecx
mov edx, dword [ebp - 0xc00]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
lea edx, [ebp - 0x968]
push edx
lea ecx, [ebp - 0x964]
call fcn.00409400
push 0
lea ecx, [ebp - 0x964]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xc04], eax
lea ecx, [ebp - 0x968]
call fcn.00409e40
push eax
push 3
mov eax, dword [ebp - 0xc04]
push eax
mov ecx, dword [ebp - 0xc04]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
lea ecx, [ebp - 0x968]
push ecx
lea ecx, [ebp - 0x964]
call fcn.00409400
push 0
lea ecx, [ebp - 0x964]
call fcn.004095b0
mov ecx, dword [ebp - 0xbd0]
add ecx, 0x54
call fcn.00409d40
mov dword [ebp - 0xc08], eax
lea ecx, [ebp - 0x968]
call fcn.00409e40
push eax
push 4
mov edx, dword [ebp - 0xc08]
push edx
mov eax, dword [ebp - 0xc08]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x964]
call fcn.00409400
push 0
lea ecx, [ebp - 0x964]
call fcn.004095b0
xor ecx, ecx
mov word [ebp - 0xbc8], cx
push 0x206
push 0
lea edx, [ebp - 0xbc6]
push edx
call fcn.00417120
add esp, 0xc
mov dword [ebp - 0x9c0], 0x58
push 0x54
push 0
lea eax, [ebp - 0x9bc]
push eax
call fcn.00417120
add esp, 0xc
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x9bc], edx
lea eax, [ebp - 0xbc8]
mov dword [ebp - 0x9a4], eax
mov dword [ebp - 0x9a0], 0x104
lea ecx, [ebp - 0x964]
call fcn.00409d40
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0x98c], 0x1800
lea ecx, [ebp - 0x9c0]
push ecx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x408462
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xbc8]
push eax
mov ecx, dword [ebp - 0xbd0]
call fcn.00407b00
lea ecx, [ebp - 0x964]
call fcn.00401130
lea ecx, [ebp - 0x968]
call fcn.00401130
jmp 0x4084e9
mov ecx, dword [ebp - 0xbd0]
mov dword [ecx + 0x4c], 1
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0x30]
call edx
mov eax, dword [ebp - 0xbd0]
mov dword [eax + 0x4c], 0
jmp 0x4084e9
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0xbd0]
call fcn.00408620
jmp 0x4084e9
mov eax, dword [ebp - 0xbd0]
mov dword [eax + 0x4c], 1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0x1c]
call edx
mov eax, dword [ebp - 0xbd0]
mov dword [eax + 0x4c], 0
lea ecx, [ebp - 0x14]
call fcn.00409d70
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 0xc