Function at 0x41ea60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55007b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
push ebx
push esi
push edi
mov eax, dword [0x5b88c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp ebx, 4
jne 0x41ec37
cmp esi, 1
jne 0x41eafe
mov ecx, 0x5bb1c0
call fcn.00411070
test eax, eax
je 0x41eacc
push 0xa
mov ecx, edi
call fcn.0041e840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je 0x41ead3
mov edi, dword [edi + 0x20]
push 1
push 0
push 0
push str.http:__www.diphso.no
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x1e5
jne 0x41eb24
mov ecx, 0x5bba44
call fcn.004076c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x13ec
jne 0x41eb69
push 0x560384
push 5
push 0x5b9e6c
mov byte [0x5b9e71], 1
call fcn.005363ab
mov eax, dword [edi + 0x20]
add esp, 0xc
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jle 0x41ebd1
mov ecx, dword [0x5bbbd4]
add ecx, 0x13ed
cmp esi, ecx
jge 0x41ebd1
add esi, 0xffffec13
push esi
mov ecx, 0x5bba44
mov byte [0x5b9e71], 0
call fcn.004080c0
imul esi, esi, 0x19e
add esi, 0x5bbd5e
push esi
push 5
push 0x5b9e6c
call fcn.005363ab
mov edx, dword [edi + 0x20]
add esp, 0xc
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x1388
jne 0x41ec37
mov eax, dword [0x5b9e58]
push eax
lea ecx, [ebp - 0x220]
call fcn.00404d00
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00434b4d
push 1
mov byte [0x5c9bd0], 1
mov ecx, dword [edi + 0x20]
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
call fcn.00404e60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0xb
jne 0x41ec6e
test edi, edi
je 0x41ec43
mov edi, dword [edi + 0x20]
push 1
push 0
push 0
push str.http:__www.diphso.no_FotoMixHelp_Introduction.htm
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x1e4
jne 0x41eca8
test edi, edi
je 0x41ec7d
mov edi, dword [edi + 0x20]
push 1
push 0
push 0
push str.http:__www.facebook.com_pages_Digital_Photo_Software_149014641822721
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, 4
jne 0x41ed5a
cmp esi, ebx
jne 0x41ecd2
push 2
mov ecx, edi
call fcn.0041e840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 5
jne 0x41ecf4
push 1
mov ecx, edi
call fcn.0041e840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 6
jne 0x41ed16
push 3
mov ecx, edi
call fcn.0041e840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 7
jne 0x41ed38
push 5
mov ecx, edi
call fcn.0041e840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 8
jne 0x41ed5a
push 4
mov ecx, edi
call fcn.0041e840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [0x5c7410], 0
mov edi, dword [ebp + 0xc]
je 0x41ed7b
push esi
push edi
push ebx
mov ecx, 0x5c72dc
call fcn.004280c0
test al, al
jne case.default.0x41ed8a
mov eax, dword [0x5c4d00]
dec eax
cmp eax, 9
ja case.default.0x41ed8a
jmp dword [eax*4 + 0x41eedc]
push esi
push edi
push ebx
mov ecx, 0x5c7514
call fcn.0042f630
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c7628
call fcn.004299d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c76b4
call fcn.0042bf50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c7a40
call fcn.0042a960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c7bd8
call fcn.0042e5a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c7ce4
call fcn.00432760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c81f0
call fcn.0042d230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c8384
call fcn.0042d7d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c84a0
call fcn.00430bd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push ebx
mov ecx, 0x5c85c8
call fcn.004311e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc