Function at 0x4024a0
Capabilities:
Create process on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
cmp eax, 0x7c
ja 0x40266d
je 0x402649
add eax, 0xffffff9b
cmp eax, 7
ja case.default.0x4024c0
jmp dword [eax*4 + 0x402774]
lea eax, [esp + 0xc]
push eax
push 0
call fcn.00407440
add esp, 8
cmp word [0x40e28a], 0x1458
jne 0x4024fa
cmp word [0x40ff5a], 0xd
jne 0x4024fa
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00403e70
add esp, 4
pop ecx
ret
mov edx, dword [esp + 0xc]
push edx
call fcn.004027a0
add esp, 4
pop ecx
ret
lea eax, [esp + 0xc]
push eax
push 1
call fcn.00407440
add esp, 8
cmp word [0x40e28a], 0x1458
jne 0x4024fa
cmp word [0x40ff5a], 0xd
jne 0x4024fa
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00403e70
add esp, 4
pop ecx
ret
lea eax, [esp + 0xc]
push eax
push 2
call fcn.00407440
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004027a0
add esp, 0xc
pop ecx
ret
lea edx, [esp + 0xc]
push edx
push 3
call fcn.00407440
mov eax, dword [0x40e2bc]
add esp, 8
test eax, eax
je 0x40257e
mov eax, dword [esp + 0xc]
push eax
call fcn.004027a0
add esp, 4
pop ecx
ret
cmp word [0x40e28a], 0x1458
jne 0x4025a2
cmp word [0x40ff5a], 0xd
jne 0x4025a2
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00403e70
add esp, 4
pop ecx
ret
cmp word [esp + 0xc], 0
jne 0x4025ec
push 0
call fcn.00407ac0
jmp 0x4025e9
lea eax, [esp + 0xc]
push eax
push 4
call fcn.00407440
mov eax, dword [0x40e2bc]
add esp, 8
test eax, eax
je 0x4025da
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004027a0
add esp, 4
pop ecx
ret
cmp word [esp + 0xc], 0
jne 0x4025ec
push 0
call fcn.00407af0
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00402a80
add esp, 4
pop ecx
ret
lea eax, [esp + 0xc]
push eax
push 5
call fcn.00407440
mov eax, dword [0x40e2bc]
add esp, 8
test eax, eax
je case.default.0x4024c0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004027a0
add esp, 4
pop ecx
ret
push 0x40ff58
call fcn.00407a00
add esp, 4
test eax, eax
je case.default.0x4024c0
call fcn.00404790
pop ecx
ret
call fcn.00403b40
pop ecx
ret
lea edx, [esp]
push edx
call fcn.00407380
add esp, 4
test eax, eax
je case.default.0x4024c0
mov eax, dword [esp]
push eax
call fcn.00405d90
add esp, 4
pop ecx
ret
cmp eax, 0x9c44
ja 0x4026d5
je 0x4026ce
sub eax, 0xc8
je 0x4026c7
sub eax, 0x9b7a
je 0x4026b2
dec eax
jne case.default.0x4024c0
call fcn.00404a50
test eax, eax
je 0x4026a3
push str.SNDREC32.EXE
call fcn.00404b00
add esp, 4
pop ecx
ret
push 5
push str.SNDREC32.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ecx
ret
mov ecx, dword [0x40e278]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret
call fcn.00404a30
pop ecx
ret
call fcn.00402cb0
pop ecx
ret
sub eax, 0x9c45
je 0x40274a
dec eax
je 0x40272b
dec eax
jne case.default.0x4024c0
mov eax, dword [0x40e2c0]
push 5
test eax, eax
jne 0x40270e
push str.rundll32.exe_shell32.dll_Control_RunDLL_alsndmgr.cpl__
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x40e27c]
test eax, eax
je case.default.0x4024c0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop ecx
ret
push str.RTLCPL.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x40e280]
test eax, eax
je case.default.0x4024c0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop ecx
ret
call fcn.00404a50
test eax, eax
je 0x40273b
call fcn.00404a90
pop ecx
ret
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL_mmsys.cpl__
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ecx
ret
call fcn.00404a50
test eax, eax
je 0x402762
push str.SNDVOL32.EXE
call fcn.00404b00
add esp, 4
pop ecx
ret
push 5
push str.SNDVOL32.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ecx
ret