Function at 0x40d7ca
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x4291b0]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
xor ebx, ebx
movzx edi, dx
mov eax, edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
mov esi, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0xc], 0x301
cmp eax, 0x300
ja 0x40e151
je 0x40e16a
cmp eax, 0x18
ja 0x40dd1c
je 0x40dce3
cmp eax, 7
ja 0x40db94
je 0x40db8b
sub eax, 1
je 0x40db77
sub eax, 1
je 0x40da67
sub eax, 1
je 0x40d928
sub eax, 1
je 0x40d95b
sub eax, 1
je 0x40d893
sub eax, 1
jne case.0x40dd37.30
inc word [0x42a936]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
xor ecx, ecx
mov edi, eax
call fcn.0042280e
push edi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
jmp 0x40e24a
mov edi, 0x429d98
jmp 0x40d8c6
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
cmp eax, 0x100b
je 0x40d8b5
cmp eax, 0x1009
je 0x40d8b5
cmp eax, 0x100c
jne 0x40d91e
call fcn.0040cb01
mov dword [0x429da4], ebx
mov dword [0x429da0], ebx
mov ecx, edi
call fcn.0040feb3
test eax, eax
je 0x40d89a
push 0x429f70
push 0x28
pop edx
mov ecx, 0x429ed0
call fcn.0040675d
push 0x429fc0
push 0x28
pop edx
mov ecx, 0x429f20
call fcn.0040675d
mov eax, dword [esp + 0x1c]
mov dword [0x42ab7c], eax
cmp word [0x429ed0], bx
jne 0x40d910
cmp word [0x429f20], bx
je 0x40d912
mov ebx, eax
mov ecx, ebx
call fcn.004240d4
jmp 0x40e24a
call fcn.0040f95d
jmp 0x40e24a
inc word [0x42a932]
mov eax, dword [0x429e18]
mov dword [0x429e14], eax
cmp dword [0x4292c0], ebx
jne 0x40d95b
push ebx
push ebx
mov edx, 0x42a8cc
call fcn.0041096a
test al, al
je 0x40d95b
call fcn.0040f4af
jmp 0x40e24a
cmp edi, 4
jne 0x40d967
inc word [0x42a934]
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x1f], bl
call fcn.0040c1ab
mov edi, 0x402048
mov edx, edi
cmp dword [0x4292c0], ebx
jne 0x40d992
mov edx, dword [0x42a8cc]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0040d59a
test eax, eax
jns 0x40d9db
cmp eax, 0x800704c7
je 0x40d9d2
cmp dword [0x4292c0], ebx
jne 0x40d9be
mov edi, dword [0x42a8cc]
lea edx, [esp + 0xc]
mov ecx, edi
call fcn.0040d391
mov byte [esp + 0x1b], 1
test eax, eax
jns 0x40d9db
mov ecx, eax
call fcn.0040f931
jmp 0x40da49
push 0x1fa
lea eax, [esp + 0x74]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test ecx, ecx
je 0x40da15
push ecx
lea edx, [esp + 0x74]
call fcn.0042574d
test eax, eax
js 0x40da15
cmp word [esp + 0x70], bx
je 0x40da15
lea eax, [esp + 0x70]
cmp byte [esp + 0x1b], bl
je 0x40da17
mov eax, ebx
push eax
push 1
lea edx, [esp + 0x14]
call fcn.0041096a
test al, al
je 0x40da40
push dword [esp + 0xc]
mov ecx, 0x42a8cc
call fcn.0040c1ab
mov dword [esp + 0xc], ebx
call fcn.0040f4af
jmp 0x40da49
mov ecx, dword [esp + 0xc]
call fcn.00411831
cmp dword [esp + 0xc], ebx
je 0x40da59
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea ecx, [esp + 0x10]
call fcn.0040a28e
jmp 0x40e24a
call fcn.0040e52e
test eax, eax
je 0x40e24a
mov eax, dword [0x429e18]
lea ecx, [esp + 0xc]
push ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
call fcn.0040c1ab
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
call fcn.0040d28a
test eax, eax
jns 0x40dab8
cmp eax, 0x800704c7
je 0x40db4d
lea ecx, [esp + 0xc]
call fcn.0040d0f5
test eax, eax
js 0x40db4d
mov eax, dword [0x429d8c]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov edi, dword [0x42aba0]
mov ebx, dword [0x42ab94]
mov dword [0x429d8c], eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [0x42a8cc]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
neg eax
mov ecx, 0x42a930
push edi
sbb eax, eax
and eax, dword [esp + 0x58]
push ebx
mov edx, eax
call fcn.00423d50
call fcn.0040ee69
mov ecx, eax
call fcn.00423eaa
mov edx, dword [0x429e18]
lea ecx, [esp + 0xc]
push 0
call fcn.00410f0c
test al, al
jne 0x40db5e
mov ecx, dword [esp + 0xc]
call fcn.00411831
mov eax, dword [esp + 0x1c]
mov dword [0x429d8c], eax
mov eax, 0x80004005
mov ecx, dword [esp + 0x10]
mov dword [0x429e18], ecx
mov ecx, eax
call fcn.0040f931
cmp dword [esp + 0xc], esi
je 0x40e24a
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0x40e24a
inc word [0x42a930]
xor ecx, ecx
inc ecx
call fcn.004116e7
jmp 0x40e24a
push ebx
push ebx
push 0x10
jmp 0x40e243
sub eax, 8
je 0x40dc77
sub eax, 7
je 0x40e24a
sub eax, 1
je 0x40dc64
sub eax, 5
je 0x40dd8b
sub eax, 1
je case.0x40dd37.29
sub eax, 1
jne case.0x40dd37.30
inc word [0x42a944]
mov eax, dword [0x42ada8]
mov dword [0x42ab74], 1
test eax, eax
je 0x40dbef
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x42adb6]
xor ecx, ecx
cmp byte [0x42adb5], cl
sete cl
dec ecx
and ecx, 0x100000
add ecx, 0x50001
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
mov dword [0x429df8], ecx
call fcn.004214a2
mov edi, 0x429dec
mov dword [0x429e00], 0x42aba8
push edi
mov dword [0x429e04], 0x800080
mov dword [0x429dfc], 0x42aca8
call dword [sym.imp.COMDLG32.dll_ReplaceTextW]
test eax, eax
jne 0x40dc5a
xor edx, edx
inc edx
mov ecx, edi
call fcn.00424510
mov dword [0x42ada8], eax
jmp 0x40e24a
inc word [0x42a938]
push ebx
push ebx
push 0xc7
jmp 0x40dd59
sub esp, 0x48
mov dword [esp + 0x5c], ebx
mov ecx, esp
mov dword [esp + 0x64], ebx
lea edx, [esp + 0x64]
lea esi, [esp + 0x5c]
lea eax, [ecx + 8]
mov dword [eax], 0x40119c
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [ecx + 0x40], eax
lea ecx, [esp + 0x58]
call fcn.0040ff9b
mov edi, eax
test edi, edi
jns 0x40dcc9
mov ecx, dword [ebp + 4]
mov edx, 0x379
push edi
push 0x4020dc
call fcn.0040750c
mov esi, dword [esp + 0x10]
jmp 0x40e24d
mov esi, dword [esp + 0x10]
push 5
push ebx
push 0x402234
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40e24a
inc word [0x42a946]
push ebx
push 0x40fa00
push dword [0x42a92c]
push 0xe
push dword [0x429e8c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
jne 0x40e24a
mov ecx, dword [0x429ea0]
call fcn.0040ccae
jmp 0x40e24a
cmp eax, 0x40
ja 0x40e10e
je 0x40e0f3
sub eax, 0x19
cmp eax, 0xb
ja case.0x40dd37.30
jmp dword [eax*4 + 0x40e272]
push 0xffffffffffffffff
push ebx
push 0xb1
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40e24a
cmp dword [0x42ab74], ebx
je 0x40dd8b
cmp word [0x42aca8], bx
je 0x40dd8b
cmp edi, 0x1d
sete dl
call fcn.00421297
jmp 0x40e24a
mov dword [0x42ab74], 1
cmp edi, 0x15
jne 0x40dda1
inc word [0x42a942]
mov eax, dword [0x42ada8]
test eax, eax
je 0x40ddb5
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp byte [0x42adb4], cl
sete cl
xor eax, eax
cmp byte [0x42adb5], al
sete al
dec eax
and eax, 0x100000
add eax, 0x50000
or ecx, eax
movzx eax, byte [0x42adb6]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
mov dword [0x429df8], ecx
call fcn.004214a2
mov edi, 0x429dec
mov dword [0x429e00], ebx
push edi
mov dword [0x429e04], 0x80
mov dword [0x429dfc], 0x42aca8
call dword [sym.imp.COMDLG32.dll_FindTextW]
test eax, eax
jne 0x40dc5a
xor edx, edx
jmp 0x40dc53
xor ecx, ecx
call fcn.004106b2
jmp 0x40e24a
mov ecx, dword [0x42ab94]
neg ecx
sbb ecx, ecx
and ecx, 0x100000
add ecx, 0x50200104
call fcn.0042153c
test eax, eax
je 0x40de68
xor eax, eax
cmp dword [0x42ab94], eax
sete al
mov dword [0x42ab94], eax
jmp 0x40defc
push 0x30
push dword [0x42929c]
push dword [0x429280]
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40e24a
lea eax, [esp + 0x24]
push eax
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x42aba0], ebx
je 0x40deca
push ebx
push dword [0x42adb0]
mov dword [0x42aba0], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
call fcn.0040cc0b
jmp 0x40defc
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov dword [0x42aba0], 1
call fcn.0040cc0b
call fcn.0040f0f0
push 5
push dword [0x42adb0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x42ab80], 1
jmp 0x40e24a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4e0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40df36
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40df44
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
mov ecx, 0x1f4
add eax, 0xa
cmp eax, ecx
jb 0x40df59
mov eax, ecx
push 0x64
push eax
push 0x4e1
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0040f396
jmp 0x40e24a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4e0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40dfa2
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40dfb0
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
sub eax, 0xa
cmp eax, 0xa
ja 0x40df59
push 0xa
pop eax
jmp 0x40df59
push 0x64
push 0x64
jmp 0x40df5c
inc word [0x42a948]
lea eax, [esp + 0x34]
push 0x3c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x40e24a
mov eax, dword [esp + 0x14]
push 0x5a
push edi
mov dword [esp + 0x3c], 0x3c
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], 0x429e30
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x2d0
push eax
push dword [0x4292c4]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
mov dword [esp + 0x48], 0x1010041
mov dword [0x429e30], eax
mov eax, 0x2000
push edi
push ebx
mov word [esp + 0x6c], ax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xfffffffffffffffe
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov ebx, eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
test edi, edi
je 0x40e24a
push dword [0x429e90]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x2d0
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
push 0x429e30
mov dword [0x429e30], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edi, eax
test edi, edi
je 0x40e0d8
push dword [0x429e2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 1
push edi
push 0x30
push dword [0x42adac]
mov dword [0x429e2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x44]
mov dword [0x4292c4], eax
push dword [0x429e94]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x42ab78], 1
jmp 0x40e24a
push 1
push ebx
push ebx
push 0x402158
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.0042407c
jmp 0x40e24a
sub eax, 0x41
je 0x40e126
sub eax, 1
jne case.0x40dd37.30
push 1
push ebx
push ebx
push 0x402108
jmp 0x40dcd6
push 2
push dword [0x429d88]
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x402234
push dword [0x42929c]
push dword [0x42a92c]
call dword [sym.imp.SHELL32.dll_ShellAboutW]
jmp 0x40e24a
mov ecx, dword [esp + 0xc]
sub eax, ecx
je 0x40e16e
sub eax, 1
je 0x40e1d5
sub eax, 1
je 0x40e16e
mov edi, ebx
jmp 0x40e24d
mov ecx, dword [esp + 0xc]
mov eax, 0x300
cmp di, ax
jne 0x40e181
inc word [0x42a93a]
jmp 0x40e196
cmp di, cx
jne 0x40e18f
inc word [0x42a93c]
jmp 0x40e196
inc word [0x42a940]
lea eax, [esp + 0x10]
mov dword [esp + 0x14], ebx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ebx
push eax
push 0xb0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x40e24a
mov edx, dword [esp + 0x20]
cmp edi, 0x1c
jne 0x40e1d5
mov edx, 0x150f
movzx edi, dx
mov eax, 0x302
cmp di, ax
jne 0x40e228
inc word [0x42a93e]
cmp dword [0x42ab70], ebx
jne 0x40e228
push 0x1fa
lea eax, [esp + 0x74]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.00425821
test eax, eax
js 0x40e228
cmp word [esp + 0x70], bx
je 0x40e228
lea ecx, [esp + 0x70]
call fcn.0040fdef
inc word [0x42a94e]
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [0x42adac]
cmp eax, ecx
je 0x40e240
cmp eax, dword [0x42a92c]
jne 0x40e24a
push ebx
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
inc edi
test esi, esi
je 0x40e258
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x274]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00426f20
mov esp, ebp
pop ebp
ret 4