Function at 0x427860
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [0x4b93f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x427846
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
mov eax, dword [0x4bbec0]
dec eax
cmp eax, 3
ja case.default.0x42760d
push ebx
jmp dword [eax*4 + 0x427850]
mov eax, dword [edi + 0x5b8]
cmp eax, 1
jne 0x427629
push edi
push 0
push 0x4115a0
jmp 0x427675
cmp eax, 2
jne 0x427638
push edi
push 0
push 0x414eb0
jmp 0x427675
cmp eax, 3
jne 0x42767d
push 0x4a55a0
lea eax, [edi + 0x594]
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.0040a190
add esp, 0xc
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x2a8]
call fcn.00409060
push edi
push 0
push 0x416620
call fcn.0046e20d
add esp, 0xc
mov dword [0x4bbec0], 2
jmp 0x42781c
mov eax, dword [edi + 0x290]
mov dword [edi + 0x12c], eax
lea eax, [edi + 0xc8]
push 1
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp byte [0x4c103a], 0
je 0x42781c
mov ebx, dword [0x4c1044]
test ebx, ebx
je 0x42781c
mov eax, dword [edi + 0x12c]
lea edx, [ebp - 0x294]
mov dword [ebp - 0x214], eax
mov eax, dword [0x4c10a4]
sub edx, eax
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x210], 1
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4276f2
mov eax, dword [0x4bbed4]
lea edx, [ebp - 0x20c]
sub edx, eax
nop
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x427710
lea eax, [ebp - 0x298]
mov dword [ebp - 0x2a4], 0x4a
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x2a4]
push eax
push dword [edi + 4]
mov dword [ebp - 0x2a0], 0x294
push 0x4a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x42781c
cmp byte [0x4c103a], 0
je 0x427803
mov ebx, dword [0x4c1044]
test ebx, ebx
je 0x427803
mov eax, dword [0x4c10a4]
lea edx, [ebp - 0x294]
mov dword [ebp - 0x298], 1
sub edx, eax
mov dword [ebp - 0x214], 0x64
mov dword [ebp - 0x210], 3
nop
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4277a0
mov eax, dword [0x4bbed4]
lea edx, [ebp - 0x20c]
sub edx, eax
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4277c0
lea eax, [ebp - 0x298]
mov dword [ebp - 0x2a4], 0x4a
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x2a4]
push eax
push dword [edi + 4]
mov dword [ebp - 0x2a0], 0x294
push 0x4a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4bbec0], 0
jmp 0x427815
inc dword [0x4bbed0]
mov byte [0x4bbecc], 1
pop ebx
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x427832
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004495f3
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402080
adc al, 0x76
inc edx
add byte [esi + esi*2 + 0x780f0042], cl
inc edx
add byte [eax + 0x77], bl
inc edx
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x4b93f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov byte [0x4bbecd], 1
push esi
push edi
mov dword [ebp - 0x2a4], ebx
mov dword [ebx + 0x12c], 0x64
mov dword [ebx + 0x5e0], 3
mov dword [0x4bbec0], 3
cmp dword [ebx + 0x5b8], 3
jne 0x427b81
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x4281ca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2ac], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x4281d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2b4], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x4281de
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2a0], esi
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x4281e8
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebx + 0x594]
add eax, 0x10
mov dword [ebp - 0x2bc], eax
lea eax, [ebp - 0x2ac]
push str._supgrade_rmup.exe
push eax
call fcn.0041ad10
mov edi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x2b0]
push edi
push eax
call fcn.0041d210
push dword [ebx + 0x594]
lea eax, [ebp - 0x2b4]
push str._srmup.exe
push eax
call fcn.0041ad10
push dword [ebp - 0x2b4]
lea eax, [ebp - 0x29c]
push eax
call fcn.0041d210
add esp, 0x28
lea eax, [ebp - 0x2bc]
push eax
push ecx
lea eax, [edi - 0x10]
mov ebx, esp
push eax
mov dword [ebp - 0x2b8], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 0x2a5], al
mov edi, esp
push dword [ebp - 0x2b8]
call fcn.00403380
mov ecx, dword [ebp - 0x2a4]
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.00424470
mov ecx, dword [0x4c10bc]
mov edi, dword [ebp - 0x2bc]
mov byte [ebp - 0x2a6], al
mov eax, dword [0x4c10b8]
sub ecx, eax
sar ecx, 2
test ecx, ecx
je 0x427a95
mov eax, dword [eax]
add eax, 0x10
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.00409eb0
add esp, 8
test al, al
je 0x427a95
mov eax, dword [ebp - 0x2b0]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [ebx], eax
mov ebx, esp
mov eax, dword [ebp - 0x29c]
add eax, 0xfffffff0
push eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0040ebe0
add esp, 8
test al, al
je 0x427a95
cmp byte [ebp - 0x2a5], 0
je 0x427a95
cmp byte [ebp - 0x2a6], 0
je 0x427a95
push dword [0x4c109c]
lea eax, [ebp - 0x2a0]
push str._s__resetnew
push eax
call fcn.0041ad10
mov esi, dword [ebp - 0x2a0]
add esp, 0xc
push 5
push 0x4a1628
push esi
push dword [ebp - 0x2ac]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x427ac3
push ecx
lea eax, [edi - 0x10]
mov ebx, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [ebx], eax
mov ebx, esp
push dword [ebp - 0x2b8]
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0040add0
add esp, 8
mov eax, dword [ebp - 0x2a4]
push 0
push 0
push 0x10
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x29c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427af8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2b0]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427b15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x427b2c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x427b43
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2b4]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427b60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2b8]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4281b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4281b5
mov byte [ebx + 0x5dc], 1
xor esi, esi
mov edx, dword [0x4c10bc]
mov eax, edx
mov ecx, dword [0x4c10b8]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x427bd6
mov eax, dword [ecx + esi*4]
cmp byte [eax + 0x24], 0
je 0x427bca
cmp byte [eax + 0x25], 0
je 0x427bca
cmp byte [eax + 0x29], 0
je 0x427bca
push eax
mov ecx, ebx
call fcn.0040e7e0
mov edx, dword [0x4c10bc]
mov ecx, dword [0x4c10b8]
mov eax, edx
inc esi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x427ba1
mov eax, edx
xor esi, esi
sub eax, ecx
sar eax, 2
test eax, eax
je 0x427c25
mov eax, dword [ecx + esi*4]
cmp byte [eax + 0x24], 0
je 0x427c19
cmp byte [eax + 0x25], 0
je 0x427c19
cmp byte [eax + 0x29], 0
je 0x427c06
push eax
mov ecx, ebx
call fcn.0040d4c0
mov ecx, dword [0x4c10b8]
mov eax, dword [ecx + esi*4]
mov byte [eax + 0x24], 0
mov edx, dword [0x4c10bc]
mov ecx, dword [0x4c10b8]
mov eax, edx
inc esi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x427be3
cmp byte [0x4c103a], 0
jne 0x427d90
cmp byte [0x4c103d], 0
jne 0x427d90
cmp byte [0x4c103e], 0
jne 0x427d90
mov eax, dword [0x4c110c]
test eax, eax
jne 0x427cf2
push str.MyTimeSetup
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x427cb5
push str.MyTimeSetup_Silent
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x427cb5
push str.MagicTraySetup
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x427cb5
push str.MagicTraySetup_Silent
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
jne 0x427cbc
mov ecx, ebx
call fcn.00433c40
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 4]
call esi
push 0
push dword [ebx + 0x30]
call esi
push 0
push dword [ebx + 0x68]
call esi
mov ecx, ebx
call fcn.0041a4a0
push 0
push 0
push 0x10
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4281b5
cmp eax, 2
jne 0x427d6a
push str.MyTimeSetup
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x427d4f
push str.MyTimeSetup_Silent
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x427d4f
push str.MagicTraySetup
push dword [0x4c10a4]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x427d4f
push str.MagicTraySetup_Silent
mov ecx, 0x4c10a4
call fcn.0040ebb0
test eax, eax
jne 0x427d56
mov ecx, ebx
call fcn.00433c40
push 0
push 0
push 0x10
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4281b5
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 4
push dword [ebx + 4]
call esi
push 5
push dword [ebx + 0x30]
call esi
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4281b5
mov eax, edx
xor esi, esi
sub eax, ecx
mov dword [ebp - 0x2a0], esi
sar eax, 2
or edi, 0xffffffff
test eax, eax
je 0x427f52
nop word [eax + eax]
lea eax, [esi*4]
mov dword [ebp - 0x2a4], eax
mov eax, dword [eax + ecx]
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x427de7
cmp ecx, dword [esi]
jne 0x427de7
lock inc dword [eax]
jmp 0x427e21
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x4281fc
mov ecx, dword [edi]
lea eax, [esi + 0x10]
mov dword [esi + 4], ecx
mov ecx, dword [edi]
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x29c]
push ecx
push eax
call fcn.00437560
add esp, 0x10
or edi, 0xffffffff
mov eax, dword [0x4c10b8]
add esi, 0x10
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x29c], esi
mov eax, dword [ecx + eax]
cmp byte [eax + 0x24], 0
je 0x427f13
cmp byte [eax + 0x29], 0
je 0x427f13
mov edi, dword [esi - 0xc]
test edi, edi
js 0x4281f2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x427e7a
push edi
lea ecx, [ebp - 0x29c]
call fcn.004024d0
mov esi, dword [ebp - 0x29c]
lea eax, [edi + 1]
push eax
push esi
call fcn.0046b5d9
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4281f2
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, dword [0x4c10a4]
test eax, eax
je 0x4281ca
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x427ece
test dx, dx
je 0x427eca
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x427ece
add ecx, 4
add eax, 4
test dx, dx
jne 0x427ea8
xor eax, eax
jmp 0x427ed3
sbb eax, eax
or eax, 1
test eax, eax
je 0x427efb
mov eax, dword [ebx + 0x5a8]
cmp dword [eax - 0xc], 0
jl 0x427f10
push esi
push eax
call fcn.0044b974
add esp, 8
test eax, eax
je 0x427f10
sub eax, dword [ebx + 0x5a8]
sar eax, 1
js 0x427f10
mov eax, dword [0x4c10b8]
mov ecx, dword [ebp - 0x2a4]
push dword [ecx + eax]
mov ecx, ebx
call fcn.0040e7e0
or edi, 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x427f2a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [0x4c10bc]
mov eax, edx
mov esi, dword [ebp - 0x2a0]
mov ecx, dword [0x4c10b8]
inc esi
sub eax, ecx
mov dword [ebp - 0x2a0], esi
sar eax, 2
cmp esi, eax
jb 0x427db0
sub edx, ecx
xor esi, esi
sar edx, 2
mov dword [ebp - 0x2a0], esi
test edx, edx
je 0x42810a
nop word [eax + eax]
lea eax, [esi*4]
mov dword [ebp - 0x2a4], eax
mov eax, dword [eax + ecx]
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x427fa7
cmp ecx, dword [esi]
jne 0x427fa7
lock inc dword [eax]
jmp 0x427fde
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x4281fc
mov ecx, dword [edi]
lea eax, [esi + 0x10]
mov dword [esi + 4], ecx
mov ecx, dword [edi]
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x29c]
push ecx
push eax
call fcn.00437560
add esp, 0x10
mov eax, dword [0x4c10b8]
add esi, 0x10
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x29c], esi
mov eax, dword [ecx + eax]
cmp byte [eax + 0x24], 0
je 0x4280cd
cmp byte [eax + 0x29], 0
je 0x4280cd
mov edi, dword [esi - 0xc]
test edi, edi
js 0x4281f2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x428037
push edi
lea ecx, [ebp - 0x29c]
call fcn.004024d0
mov esi, dword [ebp - 0x29c]
lea eax, [edi + 1]
push eax
push esi
call fcn.0046b5d9
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4281f2
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, dword [0x4c10a4]
test eax, eax
je 0x4281ca
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x42808b
test dx, dx
je 0x428087
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x42808b
add ecx, 4
add eax, 4
test dx, dx
jne 0x428065
xor eax, eax
jmp 0x428090
sbb eax, eax
or eax, 1
test eax, eax
je 0x4280b8
mov eax, dword [ebx + 0x5a8]
cmp dword [eax - 0xc], 0
jl 0x4280cd
push esi
push eax
call fcn.0044b974
add esp, 8
test eax, eax
je 0x4280cd
sub eax, dword [ebx + 0x5a8]
sar eax, 1
js 0x4280cd
mov eax, dword [0x4c10b8]
mov ecx, dword [ebp - 0x2a4]
push dword [ecx + eax]
mov ecx, ebx
call fcn.0040d4c0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4280e5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4c10bc]
mov esi, dword [ebp - 0x2a0]
mov ecx, dword [0x4c10b8]
inc esi
sub eax, ecx
mov dword [ebp - 0x2a0], esi
sar eax, 2
cmp esi, eax
jb 0x427f70
mov byte [ebx + 0x5dc], 0
lea edx, [ebp - 0x294]
mov eax, dword [0x4c10a4]
sub edx, eax
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x214], 0x64
mov dword [ebp - 0x210], 2
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x428140
mov eax, dword [0x4bbed4]
lea edx, [ebp - 0x20c]
sub edx, eax
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x428160
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x298]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c8]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x2c8], 0x4a
push 0x4a
push dword [0x4c1044]
mov dword [ebp - 0x2c4], 0x294
call esi
push 0
push 0
push 0x10
push dword [ebx + 4]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004495f3
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80070057
call fcn.00402080
call fcn.004026d0
int3