Function at 0x42cc9a
Capabilities:
Create process on windows

Disassembly:
push 0x12c
mov eax, 0x5a29de
call fcn.004348d9
xor eax, eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
push 7
pop ebx
mov esi, str.WnConfig.exe
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], eax
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0x12c]
push edi
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnCloud.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnWizard.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov dword [ebp - 0x118], ebx
mov esi, str.WnService.exe
mov word [ebp - 0x12c], ax
push esi
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnPlugin.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnCore.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnUserPage.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
mov byte [ebp - 4], bl
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnDictManager.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnImeRepair.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov esi, str.WnHandInput.exe
mov dword [ebp - 0x118], ebx
push esi
mov word [ebp - 0x12c], ax
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
and dword [ebp - 0x11c], 0
xor eax, eax
mov dword [ebp - 0x118], ebx
mov word [ebp - 0x12c], ax
mov esi, str.WnCloudDisk.exe
push esi
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push 0
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.004019a0
mov dword [ebp - 0x118], ebx
xor eax, eax
mov esi, str.wnwb.exe
mov word [ebp - 0x12c], ax
xor ebx, ebx
push esi
mov dword [ebp - 0x11c], ebx
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401a60
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0d0
push ebx
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], bl
call fcn.004019a0
mov esi, dword [ebp - 0x138]
jmp 0x42d127
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.00421362
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x42d0f4
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x114]
push str.taskkill__f__im__s
push eax
call fcn.00409a60
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ebx
push edi
call fcn.00401c80
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
add esi, 0x18
cmp esi, dword [ebp - 0x134]
jne 0x42d0dd
lea ecx, [ebp - 0x138]
call fcn.00407030
call fcn.00434894
ret