Function at 0x4016f6
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x165c
call fcn.0040fd60
push ebx
push esi
push edi
push dword [0x417964]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
xor ebx, ebx
mov edi, ebx
test esi, esi
jle 0x4017e6
push 0x400
push 0x208
lea eax, [ebp - 0x1464]
push eax
push edi
push dword [0x417964]
call dword [sym.imp.USER32.dll_GetMenuStringA]
lea eax, [ebp - 0x25c]
push eax
push ebx
lea eax, [ebp - 0x1464]
push 0x4117a4
push eax
call fcn.00402e9f
lea eax, [ebp - 0x158]
push eax
push 1
lea eax, [ebp - 0x1464]
push 0x4117a4
push eax
call fcn.00402e9f
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.004024b5
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.004024b5
lea eax, [ebp - 0x25c]
push eax
call fcn.004014ae
lea eax, [ebp - 0x158]
push eax
call fcn.004014ae
lea eax, [ebp - 0x25c]
push eax
call fcn.00401519
lea eax, [ebp - 0x158]
push eax
call fcn.00401519
add esp, 0x40
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x25c]
push ebx
push eax
call fcn.00402fbe
add esp, 0xc
inc edi
cmp edi, esi
jl 0x401720
mov esi, 0x41acc0
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x417e98], bl
je 0x401a8e
push esi
call fcn.004014ae
lea eax, [ebp - 0x125c]
mov dword [esp], 0x417e98
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x125c]
push 0x1000
push eax
call fcn.004024b5
lea eax, [ebp - 0x125c]
push eax
call fcn.004014ae
lea eax, [ebp - 0x125c]
push 0x4117a8
push eax
call fcn.00401efc
add esp, 0x14
test eax, eax
jne 0x4019b8
lea eax, [ebp - 0x125c]
push 0x4117ac
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x4019b8
lea eax, [ebp - 0x125c]
push 0x4117b0
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x4019b8
lea eax, [ebp - 0x125c]
push 0x4117d8
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117dc
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117e0
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117e4
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117e8
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117ec
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117f0
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117f4
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117f8
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x4117fc
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
jne 0x40199b
lea eax, [ebp - 0x125c]
push 0x411800
push eax
call fcn.00401efc
pop ecx
pop ecx
test eax, eax
je 0x401a8e
push 0xa
push esi
push ebx
lea eax, [ebp - 0x125c]
push eax
push str.open
push dword [0x41795c]
call edi
jmp 0x401a8e
cmp byte [ebp - 0x125c], 0x22
je 0x4019f3
lea eax, [ebp - 0x125c]
push eax
call fcn.00401658
pop ecx
test eax, eax
jne 0x4019f3
push esi
mov dword [0x417958], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 5
lea eax, [ebp - 0x125c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401a8e
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x125c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401a58
push ebx
push dword [0x41795c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
mov esi, 0x41acc0
jmp 0x401a8e
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0x165c]
push str._s_could_not_be_executed.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x165c]
push 0x10
push str.Error
push eax
push dword [0x41795c]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x417d94], ebx
je 0x401aa3
push 5
push ebx
push ebx
push esi
push str.explore
push ebx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret