Function at 0x417bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7a8
mov eax, dword [0x4a26b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4945b4
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x7a8], eax
test eax, eax
jne 0x417c8a
push 0x4945b4
push 1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x7a4]
push ecx
push 0x492d38
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 0x7a4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417e20
call fcn.0040a800
push 0x6a
lea esi, [ebp - 0x3c]
call fcn.00410c60
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x417d48
mov ebx, dword [eax]
jmp 0x417d4a
mov eax, dword [0x4a5590]
cmp eax, 0xffffffff
jne 0x417c9e
call fcn.0040a840
mov dword [0x4a5590], eax
test eax, eax
jne 0x417ca9
push 0x804
jmp 0x417cb3
cmp eax, 0x38
jne 0x417cca
push 0x409
cmp byte [0x4a558c], 0
jne 0x417cc4
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
jmp 0x417cca
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x6a
lea esi, [ebp - 0x3c]
call fcn.00410c60
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x417ce5
mov ebx, dword [eax]
jmp 0x417ce7
mov ebx, eax
push 0x69
lea esi, [ebp - 0x20]
call fcn.00410c60
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x417cfb
mov eax, dword [eax]
push 0x30
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0xc], edi
jb 0x417d18
mov eax, dword [ebp - 0x20]
push eax
call fcn.0041bd41
add esp, 4
xor ecx, ecx
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], cx
cmp dword [ebp - 0x28], edi
jb 0x417d3d
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0041bd41
add esp, 4
mov eax, dword [ebp - 0x7a8]
jmp 0x418280
mov ebx, eax
push 0x6b
lea esi, [ebp - 0x20]
call fcn.00410c60
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x417d5e
mov eax, dword [eax]
push 0x24
push ebx
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete bl
cmp dword [ebp - 0xc], edi
jb 0x417d82
mov edx, dword [ebp - 0x20]
push edx
call fcn.0041bd41
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], esi
mov word [ebp - 0x20], ax
cmp dword [ebp - 0x28], edi
jb 0x417da3
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0041bd41
add esp, 4
test bl, bl
je 0x417dfc
lea edx, [ebp - 0x7a4]
push edx
lea esi, [ebp - 0x20]
call fcn.00401080
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], edi
jae 0x417dc0
mov eax, esi
push 5
push 0x4930c0
push 0x4930c0
push eax
push 0x4930c0
xor esi, esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0xc], edi
jb 0x417dec
mov eax, dword [ebp - 0x20]
push eax
call fcn.0041bd41
add esp, 4
xor ecx, ecx
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], esi
mov word [ebp - 0x20], cx
mov eax, dword [ebp - 0x7a4]
cmp eax, esi
je 0x417e13
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x7a4], esi
mov eax, dword [ebp - 0x7a8]
cmp eax, esi
jmp 0x41827e
push esi
call fcn.00433a2e
add esp, 4
lea ecx, [ebp - 0x2b0]
call fcn.0043192f
push 0x53
lea ecx, [ebp - 0x29c]
mov dword [ebp - method.DuiLib::CNotifyPump.virtual_0], vtable.DuiLib::CNotifyPump.0
call fcn.004325c9
mov ebx, vtable.DuiLib::WindowImplBase.4.0
lea ecx, [ebp - 0x284]
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - fcn.00433533], vtable.DuiLib::WindowImplBase.2.0
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [ebp - 0x288], ebx
call fcn.00434b7d
push 0x68
lea esi, [ebp - 0x3c]
mov dword [ebp - method.CPageDialog4.virtual_0], 0x494afc
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], 0x494b8c
mov dword [ebp - 0x290], 0x494b94
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], 0x494b9c
mov dword [ebp - method.DuiLib::CTxtWinHost.virtual_88], 0x494ba4
call fcn.00410c60
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x417ed4
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [ebp - 0x2b0]
call fcn.00431f48
cmp dword [ebp - 0x28], edi
jb 0x417f13
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0041bd41
add esp, 4
lea ecx, [ebp - 0x2b0]
call fcn.00431a92
lea ecx, [ebp - 0x2b0]
call fcn.004319b9
cmp byte [0x4a7524], 0
jne 0x417f43
lea eax, [ebp - 0x2b0]
push eax
call fcn.004182a0
jmp 0x41825b
lea ecx, [ebp - 0x7a0]
call fcn.0043192f
push 0x53
lea ecx, [ebp - 0x78c]
mov dword [ebp - method.DuiLib::CNotifyPump.virtual_0], vtable.DuiLib::CNotifyPump.0
call fcn.004325c9
lea ecx, [ebp - 0x774]
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - fcn.00433533], vtable.DuiLib::WindowImplBase.2.0
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [ebp - 0x778], ebx
call fcn.00434b7d
push 0x68
lea esi, [ebp - 0x3c]
mov dword [ebp - method.CPageDialog4.virtual_0], 0x494bac
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], 0x494c3c
mov dword [ebp - 0x780], 0x494c44
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], 0x494c4c
mov dword [ebp - method.DuiLib::CTxtWinHost.virtual_88], 0x494c54
call fcn.00410c60
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x417fe4
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [ebp - 0x7a0]
call fcn.00431f48
cmp dword [ebp - 0x28], edi
jb 0x418023
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0041bd41
add esp, 4
lea ecx, [ebp - 0x7a0]
call fcn.00431a92
lea ecx, [ebp - 0x7a0]
call fcn.004319b9
cmp byte [0x4a7524], 0
jne 0x41805f
lea edx, [ebp - 0x7a0]
push edx
call fcn.004182a0
lea eax, [ebp - 0x2b0]
push eax
call fcn.004182a0
jmp 0x41825b
lea ecx, [ebp - 0x52c]
call fcn.0043192f
push 0x53
lea ecx, [ebp - 0x518]
mov dword [ebp - method.DuiLib::CNotifyPump.virtual_0], vtable.DuiLib::CNotifyPump.0
call fcn.004325c9
lea ecx, [ebp - 0x500]
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - fcn.00433533], vtable.DuiLib::WindowImplBase.2.0
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [ebp - 0x504], ebx
call fcn.00434b7d
lea ecx, [ebp - 0x2b4]
mov dword [ebp - method.CPageDialog4.virtual_0], 0x494c5c
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], 0x494cec
mov dword [ebp - fcn.00433533], 0x494cf4
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], 0x494cfc
mov dword [ebp - method.DuiLib::CTxtWinHost.virtual_88], 0x494d04
call fcn.0041b3e0
push 0x68
lea esi, [ebp - 0x3c]
call fcn.00410c60
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x41810b
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [ebp - 0x52c]
call fcn.00431f48
cmp dword [ebp - 0x28], edi
jb 0x41814a
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0041bd41
add esp, 4
lea ecx, [ebp - 0x52c]
call fcn.00431a92
lea ecx, [ebp - 0x52c]
call fcn.004319b9
cmp byte [0x4a7524], 0
jne 0x418192
lea edx, [ebp - 0x52c]
push edx
call fcn.00418320
lea eax, [ebp - 0x7a0]
push eax
call fcn.004182a0
lea ecx, [ebp - 0x2b0]
push ecx
call fcn.004182a0
jmp 0x41825b
lea ecx, [ebp - 0x2b4]
call fcn.0041b3f0
mov edi, vtable.DuiLib::WindowImplBase.2.0
mov esi, vtable.DuiLib::WindowImplBase.3.0
lea ecx, [ebp - 0x500]
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - 0x50c], edi
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x504], ebx
call fcn.00435263
lea ecx, [ebp - 0x518]
call fcn.00432c05
lea ecx, [ebp - 0x774]
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - 0x780], edi
mov dword [ebp - 0x77c], esi
mov dword [ebp - 0x778], ebx
call fcn.00435263
lea ecx, [ebp - 0x78c]
call fcn.00432c05
lea ecx, [ebp - 0x284]
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - 0x290], edi
mov dword [ebp - 0x28c], esi
mov dword [ebp - 0x288], ebx
call fcn.00435263
lea ecx, [ebp - 0x29c]
call fcn.00432c05
mov eax, dword [ebp - 0x7a4]
test eax, eax
je 0x418276
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a8]
test eax, eax
je 0x418287
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041b847
mov esp, ebp
pop ebp
ret 0x10