Function at 0x407380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x4142c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x410898]
mov word [ebp - 0x218], ax
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00409c60
add esp, 0xc
mov dx, word [0x41089c]
mov word [ebp - 0x428], dx
push 0x208
push 0
lea eax, [ebp - 0x426]
push eax
call fcn.00409c60
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x407695
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x444]
call fcn.00401410
lea ecx, [ebp - 0x440]
call fcn.00407a10
lea ecx, [ebp - 0x494]
call fcn.00407a10
lea ecx, [ebp - 0x42c]
call fcn.00407a10
push 0x5c
lea ecx, [ebp - 0x444]
call fcn.00407b30
push eax
lea eax, [ebp - 0x4bc]
push eax
lea ecx, [ebp - 0x444]
call fcn.00407bd0
push eax
lea ecx, [ebp - 0x440]
call fcn.00407a30
lea ecx, [ebp - 0x4bc]
call fcn.00401450
push 0x4108a0
lea ecx, [ebp - 0x440]
call fcn.00407a50
push str.club_application
lea ecx, [ebp - 0x440]
call fcn.00407a50
push 0x4108a4
lea ecx, [ebp - 0x440]
call fcn.00407a50
push str.ClubSanDisk.exe
lea ecx, [ebp - 0x440]
call fcn.00407a50
push 0x44
push 0
lea ecx, [ebp - 0x490]
push ecx
call fcn.00409c60
add esp, 0xc
mov dword [ebp - 0x490], 0x44
push 0x10
push 0
lea edx, [ebp - 0x43c]
push edx
call fcn.00409c60
add esp, 0xc
call fcn.00407360
test eax, eax
jne 0x407669
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x490]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x440]
call fcn.00402450
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
je 0x407669
push 0xff00ff
push 0xcb
lea ecx, [ebp - 0x4b4]
call fcn.00408590
lea ecx, [ebp - 0x4b4]
call fcn.004087e0
mov dword [ebp - 0x4b8], 0
call fcn.00407360
test eax, eax
jne 0x407639
mov edx, dword [ebp - 0x4b8]
and edx, 0x80000007
jns 0x40756a
dec edx
or edx, 0xfffffff8
inc edx
mov dword [ebp - 0x4c0], edx
cmp dword [ebp - 0x4c0], 7
ja case.default.0x407583
mov eax, dword [ebp - 0x4c0]
jmp dword [eax*4 + 0x4076a4]
push 0xcb
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xcc
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xcd
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xce
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xcf
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xd0
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xd1
lea ecx, [ebp - 0x4b4]
call fcn.00408840
jmp case.default.0x407583
push 0xd2
lea ecx, [ebp - 0x4b4]
call fcn.00408840
push 0xc8
call fcn.00407190
add esp, 4
mov ecx, dword [ebp - 0x4b8]
add ecx, 1
mov dword [ebp - 0x4b8], ecx
jmp 0x40754a
lea ecx, [ebp - 0x4b4]
call fcn.00408940
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x4b4]
call fcn.004085d0
lea ecx, [ebp - 0x42c]
call fcn.00401450
lea ecx, [ebp - 0x494]
call fcn.00401450
lea ecx, [ebp - 0x440]
call fcn.00401450
lea ecx, [ebp - 0x444]
call fcn.00401450
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409937
mov esp, ebp
pop ebp
ret