Function at 0x402839
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov ecx, 0x44
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x402847
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x140
je 0x402c67
jg 0x40291c
mov edi, dword [ebp + 0xc]
cmp edi, 0xaa
je 0x402a59
jg 0x4028ca
mov edi, dword [ebp + 0xc]
cmp edi, 0x8c
je 0x402a2b
jg 0x4028aa
mov edi, dword [ebp + 0xc]
cmp edi, 0x6e
jl case.0x4028e3.3
cmp edi, 0x73
jg case.0x4028e3.3
sub edi, 0x6e
jmp dword [edi*4 + 0x517110]
mov edi, dword [ebp + 0xc]
cmp edi, 0xa0
je 0x402a3b
cmp edi, 0xa1
je 0x402a4a
jmp case.0x4028e3.3
mov edi, dword [ebp + 0xc]
cmp edi, 0xd2
jl 0x4028ea
cmp edi, 0xe5
jg case.default.0x4028e3
sub edi, 0xd2
jmp dword [edi*4 + 0x517128]
cmp dword [ebp + 0xc], 0xb4
je 0x402a87
jmp case.0x4028e3.3
mov edi, dword [ebp + 0xc]
cmp edi, 0x136
je 0x402c2f
cmp edi, 0x137
je 0x402c2f
jmp case.0x4028e3.3
mov edi, dword [ebp + 0xc]
cmp edi, 0x168
je 0x402d17
jg 0x402962
mov edi, dword [ebp + 0xc]
cmp edi, 0x154
je 0x402cd9
jg 0x402950
cmp dword [ebp + 0xc], 0x14a
je 0x402c82
jmp case.0x4028e3.3
cmp dword [ebp + 0xc], 0x15e
je 0x402cf8
jmp case.0x4028e3.3
mov edi, dword [ebp + 0xc]
cmp edi, 0x17c
je 0x402dbd
cmp edi, 0x17d
je 0x402dd9
cmp edi, 0x17e
je 0x402df5
jg 0x4029b7
mov edi, dword [ebp + 0xc]
cmp edi, 0x172
je 0x402d36
cmp edi, 0x173
je 0x402d65
cmp edi, 0x174
je 0x402d91
jmp case.0x4028e3.3
cmp dword [ebp + 0xc], 0x1a4
je 0x4029c5
jmp case.0x4028e3.3
push 0
push 0x4025cf
push dword [0x4aec44]
push 0x320
push dword [0x4b47b8]
call sub.USER32.DLL_DialogBoxParamA
jmp case.0x4028e3.3
call fcn.00474ba0
call fcn.004865a5
mov edi, dword [ebp + 0xc]
sub edi, 0x6e
or edi, 0x55aa4200
mov dword [0x4b52e4], edi
cmp dword [ebp + 0xc], 0x73
jne 0x402a1c
cmp dword [0x4a4c00], 0
jne 0x402a1c
call fcn.00484a4d
call fcn.00402f89
mov dword [0x4a248c], 1
jmp case.0x4028e3.3
push dword [ebp + 8]
call fcn.0048598e
add esp, 4
jmp case.0x4028e3.3
mov dword [0x4a1c84], 1
jmp case.0x4028e3.3
mov dword [0x4a1c84], 2
jmp case.0x4028e3.3
call fcn.0040246b
cmp eax, 0
je 0x402a76
push dword [0x4aec74]
call fcn.00402353
add esp, 4
jmp case.0x4028e3.3
push 1
push 0x4a4954
call sub.KERNEL32.dll_WinExec
jmp case.0x4028e3.3
push 0
push 0
push 0x10
push dword [ebp + 8]
call sub.USER32.DLL_PostMessageA
jmp case.0x4028e3.3
xor dword [0x4aec40], 1
call fcn.00402e14
jmp case.0x4028e3.3
cmp dword [0x50be38], 0
je case.0x4028e3.3
mov edi, dword [0x4a247c]
cmp edi, 0
je case.0x4028e3.3
test dword [edi + 0x44], 1
je case.0x4028e3.3
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0xa]
push edi
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 6]
push edi
push dword [0x4a247c]
call fcn.00433d24
add esp, 0x14
mov edi, eax
mov word [ebp - 0xe], di
lea edi, [ebp - 0xe]
push edi
movsx edi, word [ebp - 8]
movsx esi, word [ebp - 0xc]
sub esi, edi
add esi, 1
movsx esi, si
push esi
movsx esi, word [ebp - 6]
movsx ebx, word [ebp - 0xa]
sub ebx, esi
add ebx, 1
movsx ebx, bx
push ebx
push edi
push esi
call fcn.004339c9
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je case.0x4028e3.3
cmp dword [ebp + 0xc], 0xd4
jne 0x402b4b
push dword [ebp - 4]
call fcn.004027d1
add esp, 4
jmp 0x402b7f
mov edi, dword [0x4a247c]
movsx edi, word [edi + 0x48]
push edi
push 0x4ae904
push str._sObject__d.png
lea edi, [ebp - 0x10e]
push edi
call fcn.00491c0d
add esp, 0x10
lea edi, [ebp - 0x10e]
push edi
push dword [ebp - 4]
call dword [0x50be30]
push dword [ebp - 4]
push 0x4becc8
call fcn.0041ab48
add esp, 8
jmp case.0x4028e3.3
xor dword [0x4aec38], 1
call fcn.00402e4c
jmp case.0x4028e3.3
mov edi, dword [ebp + 0xc]
sub edi, 0xdb
mov dword [ebp - 4], edi
mov edi, dword [ebp - 4]
cmp dword [0x4aec64], edi
je 0x402c20
sub edi, 1
shl edi, 7
cmp byte [edi + 0x4b42b4], 0
je 0x402c20
mov edi, dword [ebp - 4]
mov dword [0x4a1cac], edi
mov dword [0x4aec64], edi
call fcn.00402e4c
push dword [0x4aec6c]
call sub.KERNEL32.dll_GlobalFree
push 0x4b4284
push 0x4ae684
mov edi, dword [0x4aec64]
sub edi, 1
shl edi, 7
lea edi, [edi + 0x4b42b4]
push edi
call fcn.0047ee80
add esp, 0xc
mov dword [0x4aec6c], eax
push 1
call fcn.0040b8c1
add esp, 4
mov dword [0x4a248c], 1
jmp case.0x4028e3.3
mov edi, dword [ebp + 0xc]
sub edi, 0x135
mov dword [ebp - 4], edi
mov edi, dword [ebp - 4]
cmp dword [0x4b490c], edi
je case.0x4028e3.3
mov edi, dword [ebp - 4]
mov dword [0x4b490c], edi
call fcn.00402f89
push 1
call fcn.0040b8c1
add esp, 4
jmp case.0x4028e3.3
xor dword [0x4a14e0], 1
push 1
call fcn.0040b8c1
add esp, 4
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a25a8], 0
je 0x402cae
mov dword [0x4a25a8], 0
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [0x4aec44]
call sub.USER32.DLL_SetWindowPos
jmp 0x402ccf
mov dword [0x4a25a8], 1
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [0x4aec44]
call sub.USER32.DLL_SetWindowPos
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4b4ae0], 0
jne 0x402ce9
call fcn.0047e3ed
jmp 0x402cee
call fcn.0047e442
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4aec30], 0
jne 0x402d08
call fcn.00487f64
jmp 0x402d0d
call fcn.00487fd1
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a1ca0], 0
jne 0x402d27
call fcn.00476ba6
jmp 0x402d2c
call fcn.00476beb
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4af564], 0
jne 0x402d4e
push 0x4af564
call fcn.0047d029
add esp, 4
jmp 0x402d5b
push 0x4af564
call fcn.0047d064
add esp, 4
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a4c14], 0
jne 0x402d7d
push 0x4a4c14
call fcn.0047d029
add esp, 4
jmp 0x402d8a
push 0x4a4c14
call fcn.0047d064
add esp, 4
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a9934], 0
jne 0x402da9
push 0x4a9934
call fcn.0047d029
add esp, 4
jmp 0x402db6
push 0x4a9934
call fcn.0047d064
add esp, 4
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a4bf0], 0
jne 0x402dcd
call fcn.00474d2d
jmp 0x402dd2
call fcn.00474ce5
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a2490], 0
jne 0x402de9
call fcn.0048672d
jmp 0x402dee
call fcn.004866a9
call fcn.00402f89
jmp case.0x4028e3.3
cmp dword [0x4a4c00], 0
jne 0x402e05
call fcn.00484a4d
jmp 0x402e0a
call fcn.00484a82
call fcn.00402f89
pop edi
pop esi
pop ebx
leave
ret