Function at 0x40e970
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422634
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x42d02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0xf
mov byte [ebp - 0x154], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
push 0x105
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00411180
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ea88
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.004055f0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x178]
call fcn.00406550
push str.SilkysConnect_
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.00402b10
cmp dword [ebp - 0x1b0], 0x10
lea eax, [ebp - 0x1c4]
push dword [ebp - 0x1b4]
cmovae eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x178]
push eax
mov byte [ebp - 4], 5
call fcn.004055f0
lea ecx, [ebp - 0x1c4]
call fcn.00402a10
lea ecx, [ebp - 0x1a8]
call fcn.00402a10
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
mov dword [ebp - 0x120], 0
cmovae eax, dword [ebp - 0x130]
mov byte [ebp - 4], 1
mov byte [eax], 0
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x40eb77
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eb6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f133
push edx
push ecx
call fcn.0041049c
add esp, 8
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp dword [ebp - 0x164], 0x10
lea eax, [ebp - 0x178]
mov ebx, dword [ebp - 0x168]
mov ecx, 0x16
cmovae eax, dword [ebp - 0x178]
mov byte [ebp - 4], 6
mov dword [ebp - 0x1ac], eax
cmp ebx, 0xf
ja 0x40ebe8
push ebx
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x120], ebx
push eax
call fcn.00411780
mov byte [ebp + ebx - 0x130], 0
jmp 0x40ec41
cmp ebx, 0x7fffffff
ja 0x40f138
mov edi, ebx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x40ec08
mov edi, 0x7fffffff
jmp 0x40ec0d
cmp edi, ecx
cmovb edi, ecx
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x130]
call fcn.00405590
push ebx
push dword [ebp - 0x1ac]
mov esi, eax
mov dword [ebp - 0x120], ebx
push esi
mov dword [ebp - 0x11c], edi
call fcn.00411780
mov byte [esi + ebx], 0
mov dword [ebp - 0x130], esi
add esp, 0xc
push str.doujin
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x130]
call fcn.00402b10
push eax
lea eax, [ebp - 0x1c4]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x154]
call fcn.00406550
cmp dword [ebp - 0x1b0], 0x10
lea eax, [ebp - 0x1c4]
push dword [ebp - 0x1b4]
cmovae eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x154]
push eax
mov byte [ebp - 4], 9
call fcn.004055f0
lea ecx, [ebp - 0x1c4]
call fcn.00402a10
lea ecx, [ebp - 0x1a8]
call fcn.00402a10
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x130]
mov byte [eax], 0
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x40ed0b
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ed01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f13d
push edx
push ecx
call fcn.0041049c
add esp, 8
mov ax, word [0x423c78]
mov dword [ebp - 0x190], 0
mov word [ebp - 0x190], ax
mov al, byte [0x423c7a]
mov dword [ebp - 0x17c], 0xf
mov dword [ebp - 0x180], 3
mov byte [ebp - 0x18e], al
mov byte [ebp - 0x18d], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
mov edi, dword [ebp - 0x144]
cmovae eax, dword [ebp - 0x154]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1ac], eax
cmp edi, 0xf
ja 0x40edc0
push edi
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x120], edi
push eax
call fcn.00411780
mov byte [ebp + edi - 0x130], 0
mov esi, dword [ebp - 0x11c]
mov ebx, dword [ebp - 0x130]
jmp 0x40ee1f
cmp edi, 0x7fffffff
ja 0x40f142
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x40ede0
mov esi, 0x7fffffff
jmp 0x40edeb
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x130]
call fcn.00405590
push edi
push dword [ebp - 0x1ac]
mov ebx, eax
mov dword [ebp - 0x120], edi
push ebx
mov dword [ebp - 0x11c], esi
call fcn.00411780
mov byte [ebx + edi], 0
mov dword [ebp - 0x130], ebx
add esp, 0xc
cmp esi, 0x10
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x130]
cmovae eax, ebx
lea ecx, [ebp - 0x190]
push eax
call fcn.00402bb0
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0xa
cmovae eax, dword [ebp - 0x130]
mov byte [eax], 0
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x40ee93
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ee89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f147
push edx
push ecx
call fcn.0041049c
add esp, 8
push 0x42360e
lea ecx, [ebp - 0x190]
call fcn.00402bb0
cmp dword [ebp - 0x17c], 0x10
lea eax, [ebp - 0x190]
push 1
cmovae eax, dword [ebp - 0x190]
push 0x42360e
push eax
push str.explorer
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x17c]
cmp edx, 0x10
jb 0x40ef08
mov ecx, dword [ebp - 0x190]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eefe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f147
push edx
push ecx
call fcn.0041049c
add esp, 8
mov esi, dword [ebp - 0x13c]
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x190], 0
test esi, esi
je 0x40efb9
mov edi, dword [ebp - 0x138]
cmp esi, edi
je 0x40ef54
nop dword [eax + eax]
mov ecx, esi
call fcn.00402a10
add esi, 0x18
cmp esi, edi
jne 0x40ef40
mov esi, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40ef91
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f147
push ecx
push esi
call fcn.0041049c
add esp, 8
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
mov dword [ebp - 0x144], 0
cmovae eax, dword [ebp - 0x154]
mov byte [eax], 0
mov edx, dword [ebp - 0x140]
cmp edx, 0x10
jb 0x40f014
mov ecx, dword [ebp - 0x154]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40f00a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f147
push edx
push ecx
call fcn.0041049c
add esp, 8
mov esi, dword [ebp - 0x160]
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0xf
mov byte [ebp - 0x154], 0
test esi, esi
je 0x40f0c0
mov edi, dword [ebp - 0x15c]
cmp esi, edi
je 0x40f05b
mov ecx, esi
call fcn.00402a10
add esi, 0x18
cmp esi, edi
jne 0x40f047
mov esi, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x158]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40f098
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f147
push ecx
push esi
call fcn.0041049c
add esp, 8
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
cmp dword [ebp - 0x164], 0x10
lea eax, [ebp - 0x178]
mov dword [ebp - 0x168], 0
cmovae eax, dword [ebp - 0x178]
mov byte [eax], 0
mov edx, dword [ebp - 0x164]
cmp edx, 0x10
jb 0x40f117
mov ecx, dword [ebp - 0x178]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40f10d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f147
push edx
push ecx
call fcn.0041049c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004104aa
mov esp, ebp
pop ebp
ret
call fcn.004135ef
call fcn.00405580
call fcn.004135ef
call fcn.00405580
call fcn.004135ef
int3