Function at 0x408bc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push reloc.SHLWAPI.dll_PathFileExistsA
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x49b390]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x49b390]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov eax, 0x464
cmp ecx, eax
mov dword [esp + 0x10], ebx
ja 0x408830
je 0x40881b
mov eax, 0x113
cmp ecx, eax
ja 0x40876f
je 0x40857c
mov eax, ecx
dec eax
dec eax
je 0x4089c2
sub eax, 0xd
je 0x4084a5
dec eax
je 0x408460
sub eax, 4
je 0x408458
sub eax, 0x10
jne 0x408937
mov ecx, 0x204
mov eax, 0x143
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
jmp 0x408c85
xor eax, eax
inc eax
jmp 0x408c87
mov edi, dword [edi + 0x1cc]
cmp edi, 8
je 0x408495
cmp edi, 5
je 0x408495
cmp edi, 1
je 0x408495
cmp edi, 2
je 0x408495
cmp byte [0x4a6eb1], 0
je 0x40848c
cmp edi, 7
jne 0x408c85
cmp edi, 6
je 0x408c85
push esi
push edx
push 0x10
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x408c87
lea eax, [esp + 0x74]
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
cmp eax, dword [esp + 0x7c]
jle 0x40856b
lea eax, [esp + 0x58]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
add eax, eax
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [esp + 0x18]
mov dword [esp + 0x24], eax
call esi
push dword [esp + 0x14]
mov dword [esp + 0x28], eax
push ebx
mov ebx, edi
call fcn.004092e7
mov eax, dword [esp + 0x64]
sub eax, dword [esp + 0x5c]
push 0xcc0020
push dword [esp + 0x60]
push 0
push dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x74]
sub eax, dword [esp + 0x6c]
push eax
push dword [esp + 0x74]
push dword [esp + 0x74]
push dword [esp + 0x38]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x24]
push dword [esp + 0x18]
call esi
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x74]
push eax
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x408c85
cmp edx, 2
jne 0x4085a0
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x408c85
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, dword [edi + 0x1e4]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x1c], esi
je 0x4085c3
call fcn.0041021c
mov byte [edi + 0x82c], al
cmp byte [0x4a6eb0], bl
jne 0x4085d8
call fcn.0044ae73
test al, al
jne 0x4089c2
mov eax, dword [edi + 0x1cc]
cmp eax, ebx
jne 0x408608
mov eax, dword [0x4a6f00]
mov ecx, dword [0x4a6efc]
add eax, ecx
cmp esi, eax
jbe 0x4088ac
call fcn.0040715e
push 1
call fcn.00407862
jmp 0x4088ac
cmp eax, 4
jne 0x40871c
cmp byte [edi + 0x820], bl
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
je 0x408634
cmp byte [edi + 0x822], bl
je 0x408634
push ebx
push ebx
push 0x4cd
push dword [esp + 0x1c]
call esi
mov ecx, dword [0x4a6ee0]
mov eax, dword [0x4a6ee8]
cmp ecx, eax
mov ecx, dword [0x4a6eec]
jne 0x408653
mov edx, dword [0x4a6ee4]
cmp edx, ecx
je 0x4086bc
mov edx, dword [edi + 0x834]
cmp edx, ecx
ja 0x40868f
jb 0x408669
mov ecx, dword [edi + 0x830]
cmp ecx, eax
jae 0x40868f
mov dword [edi + 0x830], eax
mov eax, dword [0x4a6eec]
push ebx
mov dword [edi + 0x834], eax
call fcn.0045ca5f
pop ecx
mov dword [edi + 0x838], eax
mov dword [edi + 0x83c], edx
jmp 0x4086bc
push ebx
call fcn.0045ca5f
sub eax, dword [edi + 0x838]
pop ecx
sbb edx, dword [edi + 0x83c]
mov dword [esp + 0x28], edx
js 0x4086bc
jg 0x4086af
cmp eax, 0x2d
jbe 0x4086bc
push ebx
push ebx
push 0x4c8
push dword [esp + 0x1c]
call esi
cmp byte [0x4a6ef8], bl
jne 0x4088ac
mov eax, dword [0x4a6f00]
mov ecx, dword [0x4a6efc]
add eax, ecx
cmp dword [esp + 0x1c], eax
jbe 0x4088ac
cmp dword [0x4a6eec], ebx
mov byte [0x4a6ef8], 1
ja 0x4088ac
jb 0x408704
cmp dword [0x4a6ee8], 0x50000
jae 0x4088ac
mov byte [0x4a6ed8], 1
call fcn.0040715e
mov ecx, edi
call fcn.00407235
jmp 0x4088ac
cmp eax, 7
jne 0x408735
cmp byte [edi + 0x82c], bl
je 0x408735
mov ecx, edi
call fcn.0040a746
jmp 0x4088ac
cmp eax, 6
jne 0x4088ac
cmp byte [0x4a6eb3], bl
je 0x408758
call fcn.00409577
test al, al
jne 0x4088ac
jmp 0x408885
sub esi, dword [0x4a6f04]
cmp esi, 0x7530
jbe 0x4088ac
jmp 0x408885
mov eax, ecx
sub eax, 0x200
je 0x4087db
dec eax
je 0x4087ab
dec eax
je 0x408793
sub eax, 0xa1
jne 0x408937
call fcn.00409da8
jmp 0x408c85
mov eax, esi
shr eax, 0x10
movsx ecx, ax
movsx eax, si
push eax
mov edx, edi
call fcn.0040976f
jmp 0x408c85
mov eax, esi
shr eax, 0x10
movsx ebx, ax
movsx eax, si
push eax
call fcn.00409681
test al, al
jne 0x408c85
push esi
push 2
push 0xa1
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x408c85
mov eax, dword [edi + 0x1c4]
and dword [esp + 0x64], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x10
mov dword [esp + 0x60], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov eax, esi
shr eax, 0x10
movsx ebx, ax
movsx eax, si
push eax
call fcn.0040831a
jmp 0x408c85
cmp edx, 2
jne 0x408c85
mov byte [0x4a6eb3], 1
jmp 0x408c85
mov eax, 0x4c9
cmp ecx, eax
ja 0x408921
je 0x4088d2
mov eax, ecx
sub eax, 0x465
je 0x4088b8
dec eax
je 0x408896
dec eax
je 0x408876
sub eax, 0x61
jne 0x408937
cmp dword [edi + 0x1cc], eax
jne 0x40886a
push 1
jmp 0x408c80
call fcn.0040715e
push 5
jmp 0x408c80
cmp edx, 2
jne 0x408c85
mov dword [0x4a6d4c], esi
push 8
call fcn.00407862
call fcn.00408cda
jmp 0x408c85
cmp edx, 2
jne 0x408c85
mov byte [0x4a6eb3], 1
mov dword [0x4a6f0c], esi
mov esi, edi
call fcn.00406f04
jmp 0x408c85
cmp edx, 2
jne 0x408c85
mov dword [0x4a6f0c], 0x64
push 7
jmp 0x408c80
push 4
call fcn.00407862
call fcn.0040715e
mov ecx, edi
call fcn.00407235
cmp byte [0x4a6eb1], 0
je 0x4088fc
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00409640
cmp byte [0x4a6eb0], 0
jne 0x408c85
push 4
call fcn.00407862
call fcn.0040715e
mov ecx, edi
call fcn.00407235
jmp 0x408c85
mov eax, ecx
sub eax, 0x4cd
je 0x4089ce
dec eax
je 0x4089ae
dec eax
je 0x4089a4
dec eax
je 0x40893f
push esi
push edx
push ecx
jmp 0x408499
xor esi, esi
push 0x1a2
lea eax, [esp + 0xba]
push esi
push eax
mov word [esp + 0xc0], si
call fcn.0045c920
add esp, 0xc
push 0xd1
lea eax, [esp + 0xb8]
push eax
push dword [edi + 0x1ec]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x3c]
call fcn.00404670
lea edx, [esp + 0x3c]
mov ecx, edi
mov dword [esp + 0x270], esi
call fcn.0040a315
push esi
lea esi, [esp + 0x40]
jmp 0x408c70
call fcn.00408e84
jmp 0x408c85
push 2
call fcn.00407862
cmp byte [0x4a6eb0], 0
jne 0x408c85
mov ecx, edi
call fcn.0040a746
jmp 0x408c85
cmp dword [edi + 0x1cc], 6
je 0x408c85
mov ecx, dword [0x4a6ed4]
test ecx, ecx
push 8
pop ebx
mov esi, 0x4a6eb8
je 0x408a1b
mov eax, dword [ecx]
call dword [eax + 8]
cmp dword [0x4a6dcc], ebx
mov ecx, dword [0x4a6db8]
jae 0x408a05
mov ecx, 0x4a6db8
cmp dword [0x4a6ecc], ebx
mov eax, dword [0x4a6eb8]
jae 0x408a14
mov eax, esi
push eax
call fcn.00407d9e
pop ecx
call fcn.00408cda
push 6
call fcn.00407862
cmp dword [0x4a6ecc], ebx
mov eax, dword [0x4a6eb8]
jae 0x408a36
mov eax, esi
push eax
call fcn.0044a2ed
test eax, eax
pop ecx
je 0x408c79
lea esi, [edi + 0x154]
lea eax, [edi + 0x1a8]
mov ecx, esi
call fcn.0040b935
test al, al
setne al
mov byte [0x4a6ccc], al
mov eax, 0x4888b8
lea ecx, [esp + 0x58]
call fcn.00404670
push 0x49d9b0
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x278], 1
call fcn.00405073
push 0x4888c8
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
push 0x4888e4
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
push 0x488904
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
mov al, byte [edi + 0x42d]
test al, al
mov ebx, 0x488928
lea eax, [esp + 0x58]
je 0x408ad8
mov byte [0x4a6cc8], 1
push 0x488924
jmp 0x408ae0
mov byte [0x4a6cc8], 0
push ebx
push eax
call fcn.00405073
push 0x48892c
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
cmp byte [edi + 0x50d], 0
lea eax, [esp + 0x58]
je 0x408b10
mov byte [0x4a6cca], 1
push 0x488924
jmp 0x408b18
mov byte [0x4a6cca], 0
push ebx
push eax
call fcn.00405073
push 0x488944
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
cmp byte [edi + 0x5ed], 0
lea eax, [esp + 0x58]
je 0x408b41
push 0x488924
jmp 0x408b42
push ebx
push eax
call fcn.00405073
push 0x488958
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
cmp byte [edi + 0x49d], 0
lea eax, [esp + 0x58]
je 0x408b72
mov byte [0x4a6cc9], 1
push 0x488924
jmp 0x408b7a
mov byte [0x4a6cc9], 0
push ebx
push eax
call fcn.00405073
cmp dword [esi + 0x18], 8
jb 0x408b8b
mov esi, dword [esi + 4]
jmp 0x408b8e
add esi, 4
push esi
lea eax, [esp + 0x14]
push eax
call fcn.004045f7
lea eax, [esp + 0x10]
mov byte [esp + 0x270], 2
call fcn.0040aeee
mov edi, 0x48897c
jmp 0x408bc1
push 0x485248
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0040ad4e
invalid
push edi
lea esi, [esp + 0x14]
call fcn.0040aec3
cmp eax, 0xffffffff
jne 0x408bb1
lea eax, [esp + 0x20]
push 0x488984
push eax
mov ecx, esi
call fcn.0040aff2
pop ecx
pop ecx
mov byte [esp + 0x270], 3
push dword [eax]
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
mov byte [esp + 0x270], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.00401144
push 0x488990
lea eax, [esp + 0x5c]
push eax
call fcn.00405073
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0x70], 8
mov ecx, dword [esp + 0x5c]
mov dword [0x4a6f04], eax
jae 0x408c34
lea ecx, [esp + 0x5c]
cmp dword [0x4a6ecc], 8
mov eax, dword [0x4a6eb8]
jae 0x408c47
mov eax, 0x4a6eb8
push 5
xor esi, esi
push esi
push ecx
push eax
push 0x488994
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00408d4f
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401144
push esi
lea esi, [esp + 0x5c]
push 1
call fcn.004049f4
jmp 0x408c85
inc dword [0x4a6d54]
push ebx
call fcn.00407862
xor eax, eax
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.0045c29b
mov esp, ebp
pop ebp
ret 0xc