Function at 0x41064e
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x420c58
call fcn.00414f70
sub esp, 0x258
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x1a
mov ebx, eax
call fcn.0040bd5e
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
pop ecx
xor edi, edi
push eax
push edi
push 0x403
push ebx
call esi
push edi
push edi
push 0xc00
push ebx
call esi
push 0x1b
call fcn.0040bd5e
pop ecx
mov edi, 0x400
mov ecx, dword [0x430890]
push eax
mov eax, dword [0x4884b0]
push 2
neg eax
sbb eax, eax
and eax, 3
neg ecx
sbb ecx, ecx
and ecx, 8
or eax, ecx
or eax, edi
push eax
push ebx
call esi
push 0x20
call fcn.0040bd5e
pop ecx
push eax
mov eax, dword [0x4884b0]
neg eax
sbb eax, eax
push 6
and eax, 8
or eax, edi
push eax
push ebx
call esi
push 0
push 0
push 0xc00
push ebx
call esi
push 0x1c
call fcn.0040bd5e
pop ecx
mov ecx, dword [0x4884a8]
push eax
mov eax, dword [0x4884ac]
push 3
neg eax
sbb eax, eax
and eax, 3
neg ecx
sbb ecx, ecx
and ecx, 8
or eax, ecx
or eax, edi
push eax
push ebx
call esi
push 0x1d
call fcn.0040bd5e
pop ecx
push eax
push 4
mov eax, dword [0x4884ac]
neg eax
sbb eax, eax
and eax, 8
or eax, edi
push eax
push ebx
call esi
push 0x15
call fcn.0040bd5e
pop ecx
push eax
mov eax, dword [0x487f78]
neg eax
sbb eax, eax
push 8
and eax, 8
or eax, edi
push eax
push ebx
call esi
push 0x51
call fcn.0040bd5e
pop ecx
push eax
mov eax, dword [0x4884b4]
neg eax
sbb eax, eax
push 9
and eax, 8
or eax, edi
push eax
push ebx
call esi
push 0x44
call fcn.0040bd5e
pop ecx
push eax
push 0xa
push edi
push ebx
call esi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x22
mov dword [ebp - 0x10], eax
call fcn.0040bd5e
pop ecx
push eax
push dword [ebp - 0x10]
push 0x410
push ebx
call esi
push dword [0x48849c]
push str.topmost
call fcn.0040bfa9
push 0x1f
mov dword [0x48849c], eax
call fcn.0040bd5e
add esp, 0xc
push eax
mov eax, dword [0x48849c]
neg eax
sbb eax, eax
push 0x2710
and eax, 8
or eax, edi
push eax
push ebx
call esi
push 0x23
call fcn.0040bd5e
pop ecx
push eax
mov eax, dword [0x430894]
neg eax
sbb eax, eax
push 0xb
and eax, 8
or eax, edi
push eax
push dword [ebp - 0x10]
call esi
push 0x24
call fcn.0040bd5e
pop ecx
push eax
mov eax, dword [0x4884b8]
neg eax
sbb eax, eax
push 0xc
and eax, 8
or eax, edi
push eax
push dword [ebp - 0x10]
call esi
push 0x5a
call fcn.0040bd5e
pop ecx
push eax
push 0xd
push edi
push ebx
call esi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [0x426d1c]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.00401126
push dword [eax]
push dword [ebp - 0x10]
push 0x410
push ebx
call esi
lea ecx, [ebp - 0x14]
call fcn.00401cbe
push str..exe_..
lea ecx, [ebp - 0x20]
call fcn.0040117e
mov dword [ebp - 0x14], eax
push dword [0x426d1c]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00401126
push dword [ebp - 0x14]
mov eax, dword [eax]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040bae5
push dword [eax]
push 0xabe0
push edi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x1c]
call fcn.00401cbe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00401cbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401cbe
push str..ini_..
lea ecx, [ebp - 0x14]
call fcn.0040117e
mov dword [ebp - 0x20], eax
push dword [0x426d1c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.00401126
push dword [ebp - 0x20]
mov eax, dword [eax]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040bae5
push dword [eax]
push 0xabe1
push edi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x24]
call fcn.00401cbe
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00401cbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401cbe
push str..ini
lea ecx, [ebp - 0x14]
call fcn.0040117e
mov dword [ebp - 0x20], eax
push dword [0x426d1c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 4
call fcn.00401126
push dword [ebp - 0x20]
mov eax, dword [eax]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040bae5
push dword [eax]
push 0xabe2
push edi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x24]
call fcn.00401cbe
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00401cbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401cbe
push 0
push 0
push 0xc00
push ebx
call esi
push dword [0x426d1c]
lea ecx, [ebp - 0x34]
call fcn.00401126
mov dword [ebp - 0x24], eax
push 0x430de4
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 6
call fcn.0040117e
mov dword [ebp - 0x20], eax
push 0xc9
mov byte [ebp - 4], 7
call fcn.0040bd5e
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00401126
push dword [ebp - 0x20]
mov eax, dword [eax]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040bae5
push dword [ebp - 0x24]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401000
push dword [eax]
push 0xabe3
push edi
push ebx
call esi
lea ecx, [ebp - 0x1c]
call fcn.00401cbe
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00401cbe
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.00401cbe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00401cbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401cbe
push 0xca
call fcn.0040bd5e
pop ecx
push eax
push 0xabe4
push edi
push ebx
call esi
push 0
push 0x10f
call fcn.0040de9a
pop ecx
pop ecx
push 0
push eax
call fcn.0040df1d
pop ecx
push eax
push 0
push 0xabe3
push ebx
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push 0
push 0xe
call fcn.0040de9a
pop ecx
pop ecx
push 0
push eax
call fcn.0040df1d
pop ecx
push eax
push 0
push 0xabe4
push ebx
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
call fcn.004105ca
test al, al
jne 0x410ad4
push 0
push 0
push 0xc00
push ebx
call esi
push 0x25
call fcn.0040bd5e
pop ecx
push eax
push 0xd809
push edi
push ebx
call esi
push 0
push 0
push 0xc00
push ebx
call esi
mov eax, dword [0x434780]
neg eax
sbb eax, eax
and al, 0xf8
add eax, 8
push eax
push 0xd809
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x21
call fcn.0040bd5e
pop ecx
push eax
push 7
push edi
push ebx
call esi
xor edi, edi
push edi
push edi
push 0xc00
push ebx
call esi
push 0x1a
call fcn.0040bd5e
pop ecx
push eax
push edi
push 0x403
push ebx
call esi
mov eax, dword [ebp - 0x18]
push 0x1e61
mov eax, dword [eax + 0x45020]
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040d7f0
mov esi, eax
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov edi, 0x403
push 0x1e61
push edi
push dword [ebp - 0x10]
call esi
push 0
push dword [ebp + 8]
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x100
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0x1e61
push edi
mov ebx, eax
push dword [ebp - 0x10]
call esi
xor edi, edi
cmp ebx, edi
je 0x410e93
cmp ebx, 2
jne 0x410bab
xor eax, eax
cmp dword [0x430890], edi
sete al
push eax
mov dword [0x430890], eax
push str.tray_if_close
jmp 0x410cf6
cmp ebx, 3
jne 0x410bcb
xor eax, eax
cmp dword [0x4884a8], edi
sete al
push eax
mov dword [0x4884a8], eax
push str.start_tray
jmp 0x410cf6
cmp ebx, 4
jne 0x410beb
xor eax, eax
cmp dword [0x4884ac], edi
sete al
push eax
mov dword [0x4884ac], eax
push str.start_hiden
jmp 0x410cf6
cmp ebx, 5
jne 0x410c0d
xor eax, eax
cmp dword [0x43088c], edi
sete al
push eax
push str.tray_if_minimize
mov dword [0x43088c], eax
call fcn.0040bf91
pop ecx
pop ecx
cmp ebx, 6
jne 0x410c2d
xor eax, eax
cmp dword [0x4884b0], edi
sete al
push eax
mov dword [0x4884b0], eax
push str.hide_if_close
jmp 0x410cf6
cmp ebx, 7
jne 0x410c3f
mov ecx, dword [ebp - 0x18]
call fcn.0040ea54
jmp 0x410e93
cmp ebx, 8
jne 0x410c4e
call fcn.0040bdc8
jmp 0x410e93
cmp ebx, 9
jne 0x410c80
xor eax, eax
cmp dword [0x4884b4], edi
sete al
push eax
push str.show_control_menu
mov dword [0x4884b4], eax
call fcn.0040bf91
pop ecx
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
call fcn.0040f829
jmp 0x410e93
cmp ebx, 0xa
jne 0x410cbe
lea ecx, [ebp - 0x4c]
call fcn.00402e74
push edi
push edi
push 0x31
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x4c]
push dword [eax + 0x45038]
call fcn.0040356c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00403239
jmp 0x410e93
cmp ebx, 0xb
jne 0x410cdb
xor eax, eax
cmp dword [0x430894], edi
sete al
push eax
mov dword [0x430894], eax
push str.hide_if_run
jmp 0x410cf6
cmp ebx, 0xc
jne 0x410d02
xor eax, eax
cmp dword [0x4884b8], edi
sete al
push eax
mov dword [0x4884b8], eax
push str.hide_if_run_favorit
call fcn.0040bf91
pop ecx
pop ecx
jmp 0x410e93
cmp ebx, 0xd
jne 0x410d14
mov ecx, dword [ebp - 0x18]
call fcn.00412116
jmp 0x410e93
cmp ebx, 0x2710
jne 0x410d61
xor eax, eax
cmp dword [0x48849c], edi
sete al
push eax
push str.topmost
mov dword [0x48849c], eax
call fcn.0040bf91
cmp dword [0x48849c], edi
pop ecx
pop ecx
push 3
push edi
push edi
push edi
push edi
je 0x410d4b
push 0xffffffffffffffff
jmp 0x410d4d
push 0xfffffffffffffffe
mov eax, dword [ebp - 0x18]
push dword [eax + 0x45038]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x410e93
cmp ebx, 0xabe0
jne 0x410d8e
lea eax, [ebp + 8]
push eax
call fcn.0040c3ef
pop ecx
push 5
push edi
push edi
push dword [ebp + 8]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
jmp 0x410e8e
cmp ebx, 0xabe1
jne 0x410dcc
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x487774
call fcn.00401126
lea eax, [ebp + 8]
push eax
call fcn.00410551
pop ecx
pop ecx
push 5
push edi
push edi
push dword [ebp + 8]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
jmp 0x410e8e
cmp ebx, 0xabe2
jne 0x410dee
push 5
push edi
push edi
push 0x487774
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x410e93
cmp ebx, 0xabe3
jne 0x410e02
push dword [0x4884a4]
call fcn.00412d38
pop ecx
cmp ebx, 0xabe4
jne 0x410e1d
mov eax, dword [ebp - 0x18]
push dword [eax + 0x45038]
call fcn.00409183
jmp 0x410cfc
cmp ebx, 0xd809
jne 0x410e93
xor eax, eax
cmp dword [0x434780], edi
sete al
push eax
push str.disable_dark_theme
mov dword [0x434780], eax
call fcn.0040bf91
pop ecx
lea eax, [ebp - 0x264]
pop ecx
push 0x104
push eax
push dword [0x4419b4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x38]
push eax
call fcn.00401126
push 5
push edi
lea eax, [ebp - 0x264]
push edi
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xfefe
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x38]
call fcn.00401cbe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4