Function at 0x42bc38
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Tools_
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f9d0
call fcn.0044e2f0
mov dword [esp + 0x14], eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 0x1c]
push dword [esp + 0xc]
call fcn.0044f540
call fcn.0045e850
mov ebp, dword [0x47356c]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Tools_
push edx
call fcn.0045e6f0
call fcn.0044e340
mov edx, eax
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x42bd19
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebx, dword [esp + 0x1c]
inc ebx
push ebx
push dword [esp + 0xc]
call fcn.00450130
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
jmp 0x42bd34
mov edx, dword [esp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
push 1
push 0
call fcn.004587f9
cmp dword [0x8937fc], 0
je 0x42bd60
push 0
push 0xb
call fcn.004587e7
jmp 0x42bef7
mov dword [0x8937fc], 1
push 0xc80001
mov eax, str.DiskPart_Partition_Tool
push eax
push 0x82
push 0x1d6
push 0
push 0
push 0xb
call fcn.00458836
mov ebp, dword [0x893880]
push dword [ebp + 0x4e0]
push 0x3c
push 0x1d6
push 6
push 0xa
push 0xa8
call fcn.004557df
push dword [esp + 0x10]
push 0x64
push 0x1d6
push 0x46
push 0xa
push 0xa9
call fcn.004557df
push dword [ebp + 0x4e4]
push 0x18
push 0x96
push 0x64
push 0
push 0xaa
call fcn.004535cc
push dword [ebp + 0x4e8]
push 0x18
push 0x96
push 0x64
push 0xa0
push 0xab
call fcn.004535cc
push dword [ebp + 0x260]
push 0x18
push 0x96
push 0x64
push 0x140
push 0xac
call fcn.004535cc
mov eax, 0x463d3a
push eax
mov eax, str.Notepad.exe
push eax
call fcn.00407ad1
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x42be8e
push 0x10
push 0x10
push dword [esp + 0x10]
push 0xab
call fcn.00451677
push eax
call fcn.00445435
push dword [esp + 8]
call sub.user32.dll_DestroyIcon
push 0x10
push 0x10
mov ebp, dword [0x473568]
push dword [ebp + 0x28]
push 0xaa
call fcn.00451677
push eax
call fcn.00445435
push 0x10
push 0x10
mov ebp, dword [0x473568]
push dword [ebp + 0x24]
push 0xac
call fcn.00451677
push eax
call fcn.00445435
mov ebp, dword [0x473568]
push dword [ebp + 8]
push 0
push pe_nt_image_headers32
push 0xb
call fcn.004584dd
push eax
call sub.user32.dll_SendMessageW
call fcn.0045872d
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x42bf15
add esp, 4
jmp 0x42bf88
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x42bf82
call fcn.0045ccf9
push eax
mov ebx, 0xaa
cmp ebx, dword [esp]
jne 0x42bf3e
mov dword [esp + 0xc], 1
add esp, 8
jmp 0x42bf88
mov ebx, 0xab
cmp ebx, dword [esp]
jne 0x42bf72
push 0xa
push 0
mov eax, dword [esp + 0x10]
push eax
mov ebp, dword [0x473558]
mov eax, dword [ebp + 0x4c]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x42bf81
mov ebx, 0xac
cmp ebx, dword [esp]
jne 0x42bf81
add esp, 8
jmp 0x42bf88
pop eax
pop eax
jmp 0x42bef7
push 0
push 0
call fcn.004587f9
push 1
push 0xb
call fcn.004587e7
cmp dword [esp + 4], 0
je 0x42bfb5
push dword [esp]
call fcn.0040ecd6
xor eax, eax
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0x10]
call fcn.0045e7f0
add esp, 0x18
pop ebx
pop ebp
ret 4