Function at 0x40cab0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x623aa7
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x6b94f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00438990
mov esi, eax
call fcn.00401700
mov ecx, eax
test ecx, ecx
je 0x40d060
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4e4], eax
push esi
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 1
call fcn.0040db80
test al, al
jne 0x40cb4b
push esi
lea ecx, [ebp - 0x4e4]
call fcn.0040dd70
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 3
call fcn.00438740
mov esi, dword [ebp - 0x4e4]
mov ecx, str.sysclosebutton
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cb8d
test dx, dx
je 0x40cb89
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cb8d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cb67
xor eax, eax
jmp 0x40cb92
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d011
mov ecx, str.btn_cancel
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cbc7
test dx, dx
je 0x40cbc3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cbc7
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cba1
xor eax, eax
jmp 0x40cbcc
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d011
mov ecx, str.sysminbutton
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cc06
test dx, dx
je 0x40cc02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cc06
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cbe0
xor eax, eax
jmp 0x40cc0b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cc1a
push eax
push 0xf020
jmp 0x40d018
mov ecx, str.btn_inst
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cc47
test dx, dx
je 0x40cc43
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cc47
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cc21
xor eax, eax
jmp 0x40cc4c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cd8f
mov ecx, dword [edi + 0x77c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x218]
mov ecx, dword [edi + 0x774]
push 0
mov eax, dword [ecx]
call dword [eax + 0x118]
mov ecx, dword [edi + 0x778]
test ecx, ecx
je 0x40cc88
mov eax, dword [ecx]
push 0
call dword [eax + 0x118]
push 0
mov ecx, edi
call fcn.0040c9e0
lea eax, [edi + 0x790]
push eax
call fcn.0041e558
add esp, 4
test eax, eax
jne 0x40ccb4
push 0x6a4ae8
lea ecx, [edi + 0x790]
call fcn.00406420
cmp dword [edi + 0x7a4], 8
lea eax, [edi + 0x790]
jb 0x40ccc5
mov eax, dword [eax]
push eax
call fcn.004062b0
mov ecx, eax
call fcn.004210be
push 0
push 0x6c4b28
push 0x6c4974
push 0
push str.opt_startService
lea ecx, [edi + 0x30]
call fcn.0042cd00
push eax
call fcn.00529245
add esp, 0x14
test eax, eax
je 0x40cd11
mov ecx, eax
call fcn.004370b0
movzx eax, al
push eax
call fcn.004062b0
mov ecx, eax
call fcn.0042103a
lea eax, [edi + 0x76c]
mov dword [edi + 0x7a8], 1
mov dword [ebp - 0x4dc], eax
call fcn.0040b380
lea edx, [edi + 0x76c]
lea ecx, [eax + 4]
mov dword [ebp - 0x4e0], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ecx, eax
je 0x40cd50
cmp dword [ecx], edx
je 0x40cd70
add ecx, 4
cmp ecx, eax
jne 0x40cd45
mov ecx, dword [ebp - 0x4e0]
cmp dword [ecx + 8], eax
je 0x40cd63
mov dword [eax], edx
add dword [ecx + 4], 4
jmp 0x40cd70
lea edx, [ebp - 0x4dc]
push edx
push eax
call fcn.0040e080
push 0
push 0
push edi
push 0x40c230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x7ac], eax
jmp 0x40d024
mov ecx, str.btn_browser
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cdbc
test dx, dx
je 0x40cdb8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cdbc
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cd96
xor eax, eax
jmp 0x40cdc1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cf33
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.00438990
push eax
lea ecx, [ebp - 0x4dc]
call fcn.0040d9d0
mov eax, dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x42a]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x454]
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x43c], eax
xor eax, eax
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x42c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x440], 0x40da50
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
mov byte [ebp - 4], 5
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x454]
test ecx, ecx
push dword [ebp - 0x18]
cmove ecx, eax
xor eax, eax
mov dword [ebp - 0x454], ecx
mov word [ebp - 0x222], ax
mov word [ebp - 0x42a], ax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40cf1d
test byte [ebp - 0x444], 1
je 0x40ceea
lea ecx, [ebp - 0x222]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40cf1a
lea eax, [ebp - 0x222]
mov ecx, edi
push eax
call fcn.0040c3f0
test eax, eax
je 0x40cf1a
mov ecx, dword [edi + 0x770]
test ecx, ecx
je 0x40cf1a
add edi, 0x790
cmp dword [edi + 0x14], 8
jb 0x40cf14
mov edi, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4dc]
jmp 0x40cff7
mov ecx, str.btn_ok
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cf66
test dx, dx
je 0x40cf62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cf66
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cf40
xor eax, eax
jmp 0x40cf6b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cf78
push eax
push eax
push 0x10
jmp 0x40d01d
mov ecx, str.btn_license
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cfa6
test dx, dx
je 0x40cfa2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cfa6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cf80
xor eax, eax
jmp 0x40cfab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d024
mov ecx, dword [ebp - 0x4dc]
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
mov ecx, eax
call fcn.00438990
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0040d9d0
push 1
push 0
push 0
push dword [ebp - 0x4e0]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x4e0]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d024
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40d024
push 0
push 0xf060
push 0x112
mov ecx, edi
call fcn.0043c2b0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d043
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050eeb2
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040bc20
int3