Function at 0x4285b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4285b9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x428cc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406a00
sub ax, 1
jae 0x428c9a
movzx eax, bx
cmp eax, 0x12f
jg 0x428633
je 0x428a12
cmp eax, 0xcb
jg 0x428620
je 0x4287fb
sub eax, 2
je 0x428679
sub eax, 0x6b
je 0x428a9d
dec eax
je 0x428b83
jmp 0x428c9a
sub eax, 0xcc
je 0x42884c
dec eax
je 0x428685
jmp 0x428c9a
cmp eax, 0x1f6
jg 0x428662
je 0x428be8
sub eax, 0x130
je 0x428a63
dec eax
je 0x428886
sub eax, 0xc4
je 0x428c85
jmp 0x428c9a
sub eax, 0x1f7
je 0x428c21
dec eax
je 0x428c53
jmp 0x428c9a
mov eax, esi
call fcn.00423d24
jmp 0x428c9a
mov eax, dword [0x42e0b8]
cmp byte [eax], 0
jne 0x428747
mov eax, dword [0x42e0e0]
cmp byte [eax + 0x18], 1
jne 0x428747
push 0x1060
push 0x10
push 0x10
push 1
push 0xbbb
mov eax, dword [0x42f65c]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x42e0f0]
mov dword [edx], eax
mov eax, dword [0x42e0f0]
cmp dword [eax], 0
je 0x4286f4
push 0x10
push 0x10
push 1
push 0
push 0xcd
push esi
call sub.user32.dll_GetDlgItem
mov edx, dword [0x42e0f0]
mov edx, dword [edx]
mov ecx, 1
call fcn.0040b7c8
mov eax, dword [0x42e0b8]
mov byte [eax], 1
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, 0x423d14
call fcn.00406104
mov eax, dword [ebp - 0xc]
push eax
mov eax, 0x428ce0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
pop eax
call fcn.0040b8d8
mov eax, dword [ebp - 8]
call fcn.00404e1c
push eax
push 0xcd
push esi
call sub.user32.dll_GetDlgItem
pop edx
call fcn.0040d760
jmp 0x428c9a
mov eax, dword [0x42e0e0]
cmp byte [eax + 0x24], 1
jne 0x428c9a
push 0x1060
push 0x10
push 0x10
push 1
push 0xbbc
mov eax, dword [0x42f65c]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x42e0f0]
mov dword [edx], eax
mov eax, dword [0x42e0f0]
cmp dword [eax], 0
je 0x4287a8
push 0x10
push 0x10
push 1
push 0
push 0xcd
push esi
call sub.user32.dll_GetDlgItem
mov edx, dword [0x42e0f0]
mov edx, dword [edx]
mov ecx, 1
call fcn.0040b7c8
mov eax, dword [0x42e0b8]
mov byte [eax], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x423d14
call fcn.00406104
mov eax, dword [ebp - 0x1c]
push eax
mov eax, 0x428cec
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
pop eax
call fcn.0040b8d8
mov eax, dword [ebp - 0x18]
call fcn.00404e1c
push eax
push 0xcd
push esi
call sub.user32.dll_GetDlgItem
pop edx
call fcn.0040d760
jmp 0x428c9a
lea ecx, [ebp - 4]
mov edx, 0x428cf0
mov eax, esi
call fcn.0040dc6c
test al, al
je 0x428c9a
mov eax, dword [ebp - 4]
call fcn.00404e1c
push eax
push 0xca
push esi
call sub.user32.dll_SetDlgItemTextA
lea edx, [ebp - 0x20]
mov eax, 0x423cfc
call fcn.00406104
mov eax, dword [ebp - 0x20]
call fcn.00404e1c
push eax
push 0xc9
push esi
call sub.user32.dll_SetDlgItemTextA
jmp 0x428c9a
mov eax, dword [0x42e0b8]
cmp byte [eax], 0
je 0x42886e
push 0
mov ecx, 0x424dc0
mov dl, 1
mov eax, dword [0x41886c]
call fcn.0041892c
jmp 0x428c9a
push 0
mov ecx, 0x425228
mov dl, 1
mov eax, dword [0x41886c]
call fcn.0041892c
jmp 0x428c9a
mov eax, dword [0x42e0bc]
cmp byte [eax], 0
jne 0x428953
mov eax, dword [0x42e0e0]
cmp byte [eax + 0x58], 1
je 0x4288ae
mov eax, dword [0x42e0e0]
cmp byte [eax + 0x38], 1
jne 0x428953
push 0x1060
push 0x10
push 0x10
push 1
push 0xbbb
mov eax, dword [0x42f65c]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x42e0f0]
mov dword [edx], eax
mov eax, dword [0x42e0f0]
cmp dword [eax], 0
je 0x428900
push 0x10
push 0x10
push 1
push 0
push 0x131
push esi
call sub.user32.dll_GetDlgItem
mov edx, dword [0x42e0f0]
mov edx, dword [edx]
mov ecx, 1
call fcn.0040b7c8
mov eax, dword [0x42e0bc]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x423d14
call fcn.00406104
mov eax, dword [ebp - 0x28]
push eax
mov eax, 0x428ce0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
pop eax
call fcn.0040b8d8
mov eax, dword [ebp - 0x24]
call fcn.00404e1c
push eax
push 0x131
push esi
call sub.user32.dll_GetDlgItem
pop edx
call fcn.0040d760
jmp 0x428c9a
mov eax, dword [0x42e0e0]
cmp byte [eax + 0x7c], 1
je 0x42896d
mov eax, dword [0x42e0e0]
cmp byte [eax + 0x44], 1
jne 0x428c9a
push 0x1060
push 0x10
push 0x10
push 1
push 0xbbc
mov eax, dword [0x42f65c]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x42e0f0]
mov dword [edx], eax
mov eax, dword [0x42e0f0]
cmp dword [eax], 0
je 0x4289bf
push 0x10
push 0x10
push 1
push 0
push 0x131
push esi
call sub.user32.dll_GetDlgItem
mov edx, dword [0x42e0f0]
mov edx, dword [edx]
mov ecx, 1
call fcn.0040b7c8
mov eax, dword [0x42e0bc]
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x423d14
call fcn.00406104
mov eax, dword [ebp - 0x30]
push eax
mov eax, 0x428cec
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
pop eax
call fcn.0040b8d8
mov eax, dword [ebp - 0x2c]
call fcn.00404e1c
push eax
push 0x131
push esi
call sub.user32.dll_GetDlgItem
pop edx
call fcn.0040d760
jmp 0x428c9a
lea ecx, [ebp - 4]
mov edx, 0x428d00
mov eax, esi
call fcn.0040dc6c
test al, al
je 0x428c9a
mov eax, dword [ebp - 4]
call fcn.00404e1c
push eax
push 0x12e
push esi
call sub.user32.dll_SetDlgItemTextA
lea edx, [ebp - 0x34]
mov eax, 0x423cf4
call fcn.00406104
mov eax, dword [ebp - 0x34]
call fcn.00404e1c
push eax
push 0x12d
push esi
call sub.user32.dll_SetDlgItemTextA
jmp 0x428c9a
mov eax, dword [0x42e0bc]
cmp byte [eax], 0
je 0x428a85
push 0
mov ecx, 0x425690
mov dl, 1
mov eax, dword [0x41886c]
call fcn.0041892c
jmp 0x428c9a
push 0
mov ecx, 0x426df0
mov dl, 1
mov eax, dword [0x41886c]
call fcn.0041892c
jmp 0x428c9a
mov eax, dword [0x42e0e0]
cmp byte [eax + 0xa0], 0
je 0x428c9a
mov eax, dword [0x42e0e0]
cmp dword [eax + 0xa4], 0
je 0x428c9a
mov eax, dword [0x42e090]
cmp byte [eax], 1
jne 0x428b27
mov ebx, dword [0x42e0e0]
mov ebx, dword [ebx + 0xa4]
mov eax, ebx
call fcn.0040585c
mov ecx, eax
mov eax, dword [0x42e0e0]
mov edx, ebx
mov eax, esi
call fcn.004184cc
test al, al
je 0x428c9a
mov eax, dword [0x42e090]
mov byte [eax], 0
lea edx, [ebp - 0x38]
mov eax, 0x423ce4
call fcn.00406104
mov eax, dword [ebp - 0x38]
call fcn.00404e1c
push eax
push 0x6d
push esi
call sub.user32.dll_GetDlgItem
pop edx
call fcn.0040d760
jmp 0x428c9a
mov ebx, dword [0x42e0e0]
mov ebx, dword [ebx + 0xa4]
mov eax, ebx
call fcn.0040585c
mov ecx, eax
mov eax, dword [0x42e0e0]
mov edx, ebx
mov eax, esi
call fcn.00418194
test al, al
je 0x428c9a
mov eax, dword [0x42e090]
mov byte [eax], 1
lea edx, [ebp - 0x3c]
mov eax, 0x423d0c
call fcn.00406104
mov eax, dword [ebp - 0x3c]
call fcn.00404e1c
push eax
push 0x6d
push esi
call sub.user32.dll_GetDlgItem
pop edx
call fcn.0040d760
jmp 0x428c9a
mov eax, dword [0x42e0e0]
mov eax, dword [eax]
call fcn.0040585c
mov edi, eax
test edi, edi
jl 0x428c9a
inc edi
xor ebx, ebx
lea eax, [ebp - 0x40]
mov edx, dword [0x42e0e0]
mov edx, dword [edx]
mov edx, dword [edx + ebx*4]
call fcn.00404b54
mov edx, dword [ebp - 0x40]
mov eax, dword [0x42e180]
mov eax, dword [eax]
call fcn.00404d68
jne 0x428bdf
mov eax, dword [0x42e0e0]
mov eax, dword [eax + 8]
mov eax, dword [eax + ebx*4]
mov edx, dword [eax]
lea ecx, [ebp - 0x44]
mov eax, esi
call fcn.0040b764
mov eax, dword [ebp - 0x44]
call fcn.0040c8b0
inc ebx
dec edi
jne 0x428b9c
jmp 0x428c9a
mov eax, dword [0x42e0e0]
cmp dword [eax + 0xc0], 0
je 0x428c9a
push 5
push 0
push 0x428d1c
mov eax, dword [0x42e0e0]
mov eax, dword [eax + 0xc0]
call fcn.00404e1c
push eax
push 0x428d20
push esi
call sub.shell32.dll_ShellExecuteA
jmp 0x428c9a
mov eax, dword [0x42e0e0]
cmp dword [eax + 0xbc], 0
je 0x428c9a
push 5
push 0
push 0
mov eax, dword [0x42e0e0]
mov eax, dword [eax + 0xbc]
call fcn.00404e1c
push eax
push 0x428d20
push esi
call sub.shell32.dll_ShellExecuteA
jmp 0x428c9a
mov eax, dword [0x42e0e0]
cmp dword [eax + 0xc4], 0
je 0x428c9a
push 5
push 0
push 0
mov eax, dword [0x42e0e0]
mov eax, dword [eax + 0xc4]
call fcn.00404e1c
push eax
push 0x428d20
push esi
call sub.shell32.dll_ShellExecuteA
jmp 0x428c9a
mov eax, esi
call fcn.0041e550
push 0x69
push esi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428ccb
lea eax, [ebp - 0x44]
mov edx, 0xc
call fcn.00404980
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404980
ret