Function at 0x42e782
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fa07b
mov eax, dword fs:[0]
push eax
sub esp, 0x3d8
mov eax, dword [0x5550ec]
xor eax, esp
mov dword [esp + 0x3d0], eax
push ebx
push esi
push edi
mov eax, dword [0x5550ec]
xor eax, esp
push eax
lea eax, [esp + 0x3e8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], 0
je 0x42e7e2
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edi, eax
jmp 0x42e7e4
xor edi, edi
test edi, edi
je 0x42edb7
lea eax, [esp + 0x6c]
mov esi, 0xfde9
push esi
mov dword [esp + 0x6c], eax
push edi
lea eax, [esp + 0x70]
push eax
call fcn.004334d3
and dword [esp + 0x3f0], 0
push dword [esp + 0x68]
lea ecx, [esp + 0x2f8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x6c]
mov byte [esp + 0x3f0], 2
cmp dword [esp + 0x68], eax
je 0x42e83b
push dword [esp + 0x68]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea ecx, [esp + 0x364]
call fcn.004d3270
push 0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3f4], 3
call fcn.004d0f50
mov byte [esp + 0x3f0], 4
cmp dword [esp + 0x30c], 0x10
mov eax, dword [esp + 0x2f8]
jae 0x42e87a
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 1
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x370]
mov byte [esp + 0x3fc], 5
call fcn.004d4e30
mov bl, al
neg bl
sbb bl, bl
lea ecx, [esp + 0x4c]
inc bl
mov byte [esp + 0x3f0], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
test bl, bl
je 0x42e914
cmp dword [0x55ac14], 0
je 0x42ed7d
push edi
push str.parse_error:
push 0x511610
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5115dc
lea eax, [esp + 0x28]
push eax
push 0x5115d8
push ecx
mov dword [esp + 0x34], 0x3de
call fcn.004022da
add esp, 4
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
jmp 0x42ed62
lea ecx, [esp + 0x2c]
call fcn.004cfc60
test al, al
jne 0x42ed24
lea ecx, [esp + 0x2c]
call fcn.004cfcb0
test al, al
je 0x42ed24
lea eax, [esp + 0x348]
push eax
push 0x50c07c
lea ecx, [esp + 0x34]
call fcn.004d2220
mov ecx, eax
call fcn.004cfad0
lea eax, [esp + 0x310]
push eax
push str.eventid
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 6
call fcn.004d2220
mov ecx, eax
call fcn.004cfad0
lea eax, [esp + 0x32c]
push eax
push str.content
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 7
call fcn.004d2220
mov ecx, eax
call fcn.004cfad0
mov byte [esp + 0x3f0], 8
cmp dword [esp + 0x328], 0x10
mov eax, dword [esp + 0x314]
jae 0x42e9bd
lea eax, [esp + 0x314]
push esi
push eax
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x1fc]
push eax
mov dword [esp + 0x1fc], ecx
call fcn.004062ed
mov byte [esp + 0x3f0], 9
push dword [esp + 0x1f0]
lea eax, [esp + 0x28]
push eax
call fcn.00402cc5
lea eax, [esp + 0x1f4]
mov byte [esp + 0x3f0], 0xb
cmp dword [esp + 0x1f0], eax
je 0x42ea19
push dword [esp + 0x1f0]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ecx, dword [esp + 0x14]
add ecx, 0x3d4
mov eax, dword [ecx]
lea edx, [esp + 0x24]
push edx
call dword [eax + 0x10]
cmp dword [esp + 0x344], 0x10
mov eax, dword [esp + 0x330]
jae 0x42ea45
lea eax, [esp + 0x330]
push esi
push eax
lea eax, [esp + 0xf4]
lea ecx, [esp + 0xf8]
push eax
mov dword [esp + 0xf8], ecx
call fcn.004062ed
mov byte [esp + 0x3f0], 0xc
push dword [esp + 0xec]
lea eax, [esp + 0x1c]
push eax
call fcn.00402cc5
lea eax, [esp + 0xf0]
mov byte [esp + 0x3f0], 0xe
cmp dword [esp + 0xec], eax
je 0x42eaa1
push dword [esp + 0xec]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jne 0x42eb64
cmp dword [0x55ac14], 0
je 0x42eb08
push str.commandline_is_empty
push 0x511610
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5115dc
lea eax, [esp + 0x24]
push eax
push 0x5115d8
mov dword [esp + 0x2c], 0x3f2
call fcn.004022da
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
mov esi, eax
call fcn.0040234b
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.004012f9
lea ecx, [esp + 0x32c]
mov byte [esp + 0x3f0], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x310]
mov byte [esp + 0x3f0], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x348]
mov byte [esp + 0x3f0], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x42ed7d
xor ebx, ebx
lea ecx, [esp + 0x1c]
call fcn.004907c2
mov byte [esp + 0x3f0], 0xf
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], ebx
jne 0x42ebe9
cmp dword [0x55ac14], ebx
je 0x42ebd8
push str.modulepath_is_empty
push 0x511610
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5115dc
lea eax, [esp + 0x24]
push eax
push 0x5115d8
mov dword [esp + 0x2c], 0x3f9
call fcn.004022da
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
mov esi, eax
call fcn.0040234b
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x42eb08
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004c7aee
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x400], 0x10
call fcn.004c7b51
add esp, 0x10
mov byte [esp + 0x3f0], 0x11
mov eax, dword [esp + 0x20]
push dword [eax - 0xc]
push eax
lea eax, [esp + 0x24]
call fcn.004029fb
push 1
push ebx
push dword [esp + 0x30]
push dword [esp + 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x55ac14], ebx
cdq
mov dword [esp + 0x44], eax
mov edi, edx
je 0x42ecef
cmp edi, ebx
jl 0x42ec67
jg 0x42ec60
cmp eax, 0x20
jbe 0x42ec67
mov byte [esp + 0x13], 1
jmp 0x42ec6b
mov byte [esp + 0x13], bl
lea eax, [esp + 0x13]
push eax
push str.___result:
push dword [esp + 0x30]
lea eax, [esp + 0x20]
push 0x50c1e0
push dword [esp + 0x2c]
mov dword [esp + 0x28], 0x403
push str.ShellExecute_
push 0x511610
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5115dc
push eax
push 0x5115d8
push ecx
call fcn.004022da
add esp, 4
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.004333be
mov esi, eax
call fcn.0040234b
cmp edi, ebx
jl 0x42ed03
jg 0x42ecfc
cmp dword [esp + 0x44], 0x20
jbe 0x42ed03
mov byte [esp + 0x13], 1
jmp 0x42ed07
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x42ebd8
cmp dword [0x55ac14], 0
je 0x42ed7d
push str.root_is_null
push 0x511610
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5115dc
lea eax, [esp + 0x24]
push eax
push 0x5115d8
mov dword [esp + 0x2c], 0x3e4
call fcn.004022da
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
mov esi, eax
call fcn.0040234b
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3f0], 3
call fcn.004d1130
lea ecx, [esp + 0x364]
mov byte [esp + 0x3f0], 2
call fcn.00423072
or dword [esp + 0x3f0], 0xffffffff
lea ecx, [esp + 0x2f4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [0x55a320]
mov ecx, 0x55a320
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x3f0], 0x12
cmp byte [esp + 0x13], al
setne al
push eax
push 0x511d00
lea eax, [esp + 0x28]
call fcn.00401a17
mov eax, dword [esp + 0x48]
test eax, eax
mov esi, dword [esp + 0x28]
pop ecx
pop ecx
je 0x42ee03
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
lea eax, [esi - 0x10]
call fcn.004012f9
mov ecx, dword [esp + 0x3e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3d0]
xor ecx, esp
call fcn.004d6e66
mov esp, ebp
pop ebp
ret 0xc