Function at 0x42ded0
Capabilities:
Create process on windows

Disassembly:
push 0x3c
mov eax, 0x48dc50
call fcn.0046ace6
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
call fcn.0044890c
push eax
lea ecx, [ebp - 0x28]
call fcn.004035c3
lea ecx, [ebp - 0x30]
mov eax, 0x400
push ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], eax
call fcn.004079d4
push eax
push str.Open
push 4
pop ebx
push ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.NypJNjcTGj0wPyBSPDgJODQeOCspOERE
call fcn.004023cb
lea eax, [ebp - 0x24]
push eax
call fcn.00403d46
add esp, 0x28
push dword [eax]
push 2
push esi
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringA]
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401240
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
call fcn.004067f6
call fcn.0044890c
push eax
lea ecx, [ebp - 0x24]
call fcn.004035c3
mov byte [ebp - 4], 2
call fcn.0044890c
push eax
lea ecx, [ebp - 0x38]
call fcn.004035c3
push ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.MipIMzQDGgg_EB5WPB4WMzY9Dio3PRotPxMwFjUtKDc0ExYcLBM8HD8eDks8LQ4cNCg3Mzo9LE09EjxLOCsgHTIoPzQ3AygtNzhJVjwAESkpK00uPjoSNi09NEA4AwE3NhE0DigtIDg2OzxJODwSGjc4NC49Aw4cPBUwSyk7MDU3ETxNOhAKTSs8KEQ
mov byte [ebp - 4], 3
call fcn.004023cb
lea eax, [ebp - 0x2c]
push eax
call fcn.00403d46
add esp, 0x28
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00403711
mov byte [ebp - 4], 5
call fcn.0044890c
push eax
lea ecx, [ebp - 0x18]
call fcn.004035c3
mov byte [ebp - 4], 6
call fcn.0044890c
push eax
lea ecx, [ebp - 0x20]
call fcn.004035c3
lea eax, [ebp - 0x34]
push 0x96
push eax
mov byte [ebp - 4], 7
mov byte [ebp - 0xd], 0
call fcn.0042c9da
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.004039c9
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
push 0x49d310
push dword [ebp - 0x20]
call fcn.0046c19c
pop ecx
pop ecx
test eax, eax
jne 0x42e038
push ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.NBNJMi8TGg0qKApWPDgJKTY6Fk06EygNKCseUjwBTTUpKzAWKzhERA
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
add esp, 0x28
mov byte [ebp - 4], 9
jmp 0x42e0ac
push 0x49d2f8
push dword [ebp - 0x20]
call fcn.0046c19c
pop ecx
pop ecx
test eax, eax
jne 0x42e073
push 2
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.PT8gHzw4ChoxASA7LwEOOzE4REQ
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
add esp, 0x28
mov byte [ebp - 4], 0xa
jmp 0x42e0ac
push 0x49d2a0
push dword [ebp - 0x20]
call fcn.0046c19c
pop ecx
pop ecx
test eax, eax
jne 0x42e0c9
push 5
push 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.NBAWMzQDGi0tLUlAPBMBLik9DTc2AxotKi0gTTg7ME02ET83KhMsDTgqTQk8LQ4MNSpJDjcQSUA9EihE
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
add esp, 0x28
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.004038c9
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
push esi
mov edi, 0x496156
push edi
push dword [ebp - 0x14]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.00435bd9
add esp, 0x14
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.004039c9
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx - 0xc]
test eax, eax
jne 0x42e140
push 0x100
push edi
push dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.00435bd9
add esp, 0x14
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xd
call fcn.004039c9
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
mov ebx, dword [ebp - 0x18]
cmp dword [ebx - 0xc], 0
je 0x42e198
push 0
push 2
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.PDo0KDE4PDM_KyA1MT8aGjgrDkQ
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
add esp, 0x28
push dword [eax]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], 1
call fcn.0040368a
test eax, eax
je 0x42e192
push 0x49d2a0
push dword [ebp - 0x20]
call fcn.0046c19c
pop ecx
pop ecx
test eax, eax
je 0x42e198
mov byte [ebp - 0xe], 0
jmp 0x42e19c
mov byte [ebp - 0xe], 1
test byte [ebp - 0x1c], 1
je 0x42e1b1
mov ecx, dword [ebp - 0x34]
and dword [ebp - 0x1c], 0xfffffffe
add ecx, 0xfffffff0
call fcn.00401240
cmp byte [ebp - 0xe], 0
je 0x42e271
push 1
push 0
push 0
push dword [ebp + 8]
push 3
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.MihNQS0TQRw8ERZWPRIrPA
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
add esp, 0x28
push dword [eax]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00401240
push 0
push 5
push 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.NBAKQSgtGigqKElJKSo4MDQRPzc2AxotKi0gTTg7ME02ET83KhMsDTgqTQk8LQ4MNSpJDjcQSUA9EihE
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
or dword [ebp - 0x1c], 2
add esp, 0x28
push dword [eax]
lea ecx, [ebp - 0x28]
call fcn.0040368a
cmp eax, 0xffffffff
jle 0x42e249
push 0x49d2a0
push dword [ebp - 0x20]
call fcn.0046c19c
pop ecx
pop ecx
mov byte [ebp - 0xe], 1
test eax, eax
je 0x42e24d
mov byte [ebp - 0xe], 0
test byte [ebp - 0x1c], 2
je 0x42e25e
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00401240
cmp byte [ebp - 0xe], 0
je 0x42e33b
mov byte [ebp - 0xd], 1
jmp 0x42e33b
push 0
push 3
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.NBNJHj09Dk49EwpPMgAODDYePDswLTxNKTsWRA
call fcn.004023cb
lea eax, [ebp - 0x34]
push eax
call fcn.00403d46
add esp, 0x28
push dword [eax]
lea ecx, [ebp - 0x18]
call fcn.0040368a
mov ecx, dword [ebp - 0x34]
cmp eax, 0xffffffff
setg byte [ebp - 0xf]
add ecx, 0xfffffff0
call fcn.00401240
cmp byte [ebp - 0xf], 0
je 0x42e2bb
mov byte [ebp - 0xd], 1
push 0x4a2760
lea ecx, [ebp - 0x24]
call fcn.00403a16
push dword [ebx - 0xc]
lea ecx, [ebp - 0x24]
push ebx
call fcn.004038c9
push 0x4a2760
lea ecx, [ebp - 0x24]
call fcn.00403a8a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x34]
push 0x4c88e0
push eax
call fcn.00403a33
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xe
call fcn.00409689
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
lea ecx, [ebp - 0xe]
call fcn.004407b0
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe]
mov byte [ebp - 4], 0xf
call fcn.004407b3
lea ecx, [ebp - 0xe]
mov byte [ebp - 4], 7
call fcn.00479b2d
cmp byte [ebp + 0xc], 0
je 0x42e450
cmp byte [ebp - 0xd], 0
jne 0x42e450
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
call fcn.004039c9
push 5
push 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.NBAWMzQDGi0tLUlAPBMBLik9DTc2AxotKi0gTTg7ME02ET83KhMsDTgqTQk8LQ4MNSpJDjcQSUA9EihE
call fcn.004023cb
lea eax, [ebp + 0xc]
push eax
call fcn.00403d46
add esp, 0x28
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x10
call fcn.004038c9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
push 0
push edi
push dword [ebp - 0x14]
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.00435bd9
add esp, 0x14
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x11
call fcn.004039c9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
mov ebx, dword [ebp - 0x18]
cmp dword [ebx - 0xc], 0
jne 0x42e40f
push 0x100
push edi
push dword [ebp - 0x14]
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.00435bd9
add esp, 0x14
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x12
call fcn.004039c9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
mov ebx, dword [ebp - 0x18]
cmp dword [ebx - 0xc], 0
jle 0x42e450
push 2
push 0
push dword [ebp + 8]
push ebx
push 3
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.MihNQS0TQRw8ERZWPRIrPA
call fcn.004023cb
lea eax, [ebp + 0xc]
push eax
call fcn.00403d46
add esp, 0x28
push dword [eax]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401240
lea ecx, [ebx - 0x10]
call fcn.00401240
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401240
call fcn.0046adbe
ret