Function at 0x429b2e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fb7d9
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x5415b0]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0040cead
mov esi, dword [ebp + 0xc]
mov ebx, eax
cmp esi, 1
je 0x429e5b
cmp esi, 2
je 0x429e4f
cmp esi, 3
je 0x429d97
jle 0x429e73
cmp esi, 6
jle 0x429bb8
cmp esi, 7
jne 0x429e73
push dword [ebp + 8]
mov ecx, edi
call fcn.00429f44
jmp 0x429e73
lea ecx, [esp + 0x1c]
call fcn.0040ce61
lea eax, [esp + 0x1c]
mov dword [esp + 0x190], 2
push eax
push dword [ebp + 8]
mov ecx, ebx
call fcn.0040dcc2
test eax, eax
je 0x429d89
cmp esi, 4
jne 0x429c22
mov eax, dword [0x542750]
mov dword [esp + 0x14], eax
mov byte [esp + 0x190], 3
lea eax, [esp + 0x14]
push dword [esp + 0x28]
push str.url.dll_FileProtocolHandler__s
push eax
call fcn.0040301c
add esp, 0xc
xor esi, esi
push 1
push esi
push dword [esp + 0x1c]
push str.rundll32.exe
jmp 0x429d74
cmp esi, 5
jne 0x429cdd
mov ecx, dword [esp + 0x2c]
call fcn.00404b29
test eax, eax
je 0x429c53
push 1
xor esi, esi
push esi
push esi
push dword [esp + 0x38]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x429d89
push ecx
lea ecx, [esp + 0x88]
call fcn.0041c484
mov byte [esp + 0x190], 4
lea ecx, [esp + 0x14]
and dword [esp + 0x170], 0
call fcn.0041c9c3
push eax
lea ecx, [esp + 0x178]
mov byte [esp + 0x194], 5
call fcn.00402a9f
lea ecx, [esp + 0x14]
mov byte [esp + 0x190], 4
call fcn.00403030
push 0x51ed8c
lea ecx, [esp + 0x17c]
call fcn.004028a2
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x8c]
call fcn.0042345d
lea ecx, [esp + 0x84]
mov byte [esp + 0x190], 2
call fcn.0041c50f
jmp 0x429d89
cmp esi, 6
jne 0x429d89
mov eax, dword [0x542750]
mov dword [esp + 0x14], eax
mov byte [esp + 0x190], 6
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.00404b29
test eax, eax
je 0x429d1b
push esi
lea eax, [esp + 0x18]
push str._select___s
push eax
call fcn.0040301c
add esp, 0xc
jmp 0x429d66
push 0x5c
push esi
call fcn.004d73be
pop ecx
pop ecx
test eax, eax
je 0x429d66
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x429d66
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
call fcn.0040e02f
mov byte [esp + 0x190], 7
push dword [eax]
lea eax, [esp + 0x18]
push str._root___s
push eax
call fcn.0040301c
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00403030
push 5
xor esi, esi
push esi
push dword [esp + 0x1c]
push str.Explorer.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x14]
call fcn.00403030
lea ecx, [esp + 0x1c]
call fcn.0040d1e2
jmp 0x429e73
lea ecx, [esp + 0x84]
call fcn.0043ec64
xor esi, esi
lea ecx, [esp + 0xd4]
mov dword [esp + 0x190], esi
push 0x50feac
mov dword [esp + 0x88], vtable.CSkinDeleteTaskDlg.2.0
mov dword [esp + 0xb0], vtable.CSkinDeleteTaskDlg.1.0
mov dword [esp + method.CSkinDeleteTaskDlg.virtual_0], vtable.CSkinDeleteTaskDlg.0
mov dword [esp + 0x120], 0x81
call fcn.004028a2
push ecx
mov dword [esp + 0x194], 1
lea ecx, [esp + 0x88]
push dword [edi + 4]
call fcn.0042345d
cmp eax, 1
je 0x429e0e
cmp eax, 2
jne 0x429e39
cmp eax, 2
mov ecx, ebx
sete al
movzx eax, al
push eax
push dword [ebp + 8]
call fcn.0040dbdf
push ecx
push esi
mov ecx, edi
call fcn.00429ad9
mov ecx, edi
call fcn.00428cb5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
or dword [esp + 0x190], 0xffffffff
lea ecx, [esp + 0x84]
call fcn.0041b61b
jmp 0x429e73
push dword [ebp + 8]
mov ecx, ebx
call fcn.0040d6b9
jmp 0x429e65
push dword [ebp + 8]
mov ecx, ebx
call fcn.0040d782
mov ecx, edi
call fcn.00428cb5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret 8