Function at 0x428a64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x58]
mov eax, 0x4cce84
call fcn.004a6de4
cmp byte [ebx + 2], 0
je 0x428a92
mov edx, dword [esi]
mov dword fs:[0], edx
mov eax, edx
jmp 0x428d15
cmp byte [ebp + 0xc], 0
je 0x428c6c
mov word [esi + 0x10], 0x14
mov edx, 0x4cc7d1
lea eax, [ebp - 0x10]
call fcn.004b11c4
inc dword [esi + 0x1c]
lea ecx, [ebp - 0x10]
push ecx
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
push edx
inc dword [esi + 0x1c]
call fcn.00406dbc
pop ecx
xor edx, edx
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x14]
inc dword [esi + 0x1c]
lea eax, [ebp - 0xc]
pop edx
call fcn.004b1330
lea eax, [ebp - 0x14]
push eax
mov edx, 0x4cc7d3
lea eax, [ebp - 0x18]
call fcn.004b11c4
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x18]
inc dword [esi + 0x1c]
lea ecx, [ebp - 4]
pop eax
call fcn.004b1330
dec dword [esi + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004b12d8
mov word [esi + 0x10], 8
mov word [esi + 0x10], 0x20
xor ecx, ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
push eax
inc dword [esi + 0x1c]
call fcn.00406b48
pop ecx
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4cc7e0
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
inc dword [esi + 0x1c]
call fcn.004b16f0
lea edx, [ebp - 0x20]
push edx
mov edx, 0x4cc7e2
lea eax, [ebp - 0x24]
call fcn.004b11c4
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x24]
inc dword [esi + 0x1c]
lea ecx, [ebp - 8]
pop eax
call fcn.004b1330
dec dword [esi + 0x1c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004b12d8
mov word [esi + 0x10], 8
push 5
xor ecx, ecx
mov word [esi + 0x10], 0x2c
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x28]
push eax
inc dword [esi + 0x1c]
call fcn.00406dbc
cmp dword [ebp - 0x28], 0
pop ecx
je 0x428bfd
mov edx, dword [ebp - 0x28]
jmp 0x428c02
mov edx, 0x4cc7eb
push edx
cmp dword [ebp - 8], 0
je 0x428c0e
mov eax, dword [ebp - 8]
jmp 0x428c13
mov eax, 0x4cc7ea
push eax
cmp dword [ebp - 4], 0
je 0x428c1f
mov edx, dword [ebp - 4]
jmp 0x428c24
mov edx, 0x4cc7e9
push edx
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
dec dword [esi + 0x1c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b12d8
mov word [esi + 0x10], 0
jmp 0x428d0c
call fcn.00406e48
test al, al
jne 0x428ca4
mov word [esi + 0x10], 0x38
mov edx, 0x4cc7ec
lea eax, [ebp - 0x2c]
call fcn.004b11c4
inc dword [esi + 0x1c]
mov dl, 1
mov eax, dword [eax]
call sym.NLSAgtConfig.exe__Processviewer_KillProcessByFileName_qqr17System_AnsiStringo
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004b12d8
cmp byte [ebx + 1], 0
je 0x428d0c
call fcn.00406e48
test al, al
je 0x428d0c
mov word [esi + 0x10], 0x44
xor ecx, ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ecx
push eax
inc dword [esi + 0x1c]
call fcn.00406b48
pop ecx
lea edx, [ebp - 0x30]
mov ecx, dword [edx]
push ecx
mov edx, 0x4cc7f9
lea eax, [ebp - 0x34]
call fcn.004b11c4
inc dword [esi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.00427b0c
add esp, 8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004b12d8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004b12d8
mov ecx, dword [esi]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret