Function at 0x42ba30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51583c
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x56d51c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 0x1c], 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x134], ecx
jne 0x42c25b
mov esi, dword [edi + 0x28]
push 0
push ecx
push edx
push eax
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0042b290
mov dword [edi + 0x28], esi
test eax, eax
jne 0x42baf1
mov eax, dword [ebp + 0xc]
cmp eax, 0x47
jne 0x42bafb
lea eax, [ebp - 0x120]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x120], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x11c]
lea ecx, [edi + 0xa8]
add eax, 0x16f
push eax
mov eax, dword [ebp - 0x120]
add eax, 0x142
push eax
call fcn.0041e780
mov ecx, dword [ebp - 0x134]
mov dword [ecx], 0
mov eax, 1
jmp 0x42c25d
cmp eax, 0x8c8d
jne 0x42bc55
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x42bc3f
mov eax, dword [ecx]
push 0x3f0
push ecx
call dword [eax + 0xf0]
mov ecx, eax
test ecx, ecx
je 0x42bc20
mov eax, dword [ebp - 0x13c]
mov esi, dword [ecx]
push 1
cdq
push edx
push eax
call dword [esi + 0xe0]
mov eax, dword [edi + 0x78]
push 0x3fa
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov esi, eax
test esi, esi
je 0x42bc20
push dword [ebp - 0x13c]
lea eax, [ebp - 0x110]
push str.ck_W
push 0x80
push eax
call fcn.004262a0
add esp, 0x10
call fcn.004052e0
mov ecx, eax
test ecx, ecx
je 0x42c27a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x42bbba
movzx eax, ax
lea ecx, [ebp - 0x138]
push eax
call fcn.0041da50
jmp 0x42bbe5
lea ecx, [ebp - 0x110]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42bbc3
sub ecx, edx
lea eax, [ebp - 0x110]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x138]
call fcn.00405aa0
mov eax, dword [esi]
lea ecx, [ebp - 0x138]
push 1
push ecx
push esi
mov dword [ebp - 4], 1
call dword [eax + 0x54]
mov edx, dword [ebp - 0x138]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42bc20
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x13c]
push str.Progress:__d
call fcn.00426120
mov eax, dword [ebp - 0x13c]
add esp, 8
mov dword [edi + 0x198], eax
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
cmp eax, 0x464
jne 0x42bc8d
lea eax, [ebp - 0x138]
mov ecx, edi
push eax
push dword [ebp - 0x140]
push dword [ebp - 0x13c]
push 0x464
call fcn.00429f30
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
cmp eax, 0x1400
jne 0x42bcf5
call fcn.00421270
mov ecx, eax
call fcn.00418920
test eax, eax
jne 0x42bae5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x42bcc2
push 9
push dword [edi + 4]
call esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42bcd6
push 5
push dword [edi + 4]
call esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
cmp eax, 0xbc3
jne 0x42bd22
lea eax, [ebp - 0x13c]
push eax
push 0
push 0
push 0
mov ecx, edi
call fcn.00429750
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
cmp eax, 0x21
jne 0x42bd57
push dword [edi + 4]
mov dword [edi + 0x70], 1
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x134]
mov dword [ecx], 0
cmp dword [edi + 0x70], 0
je 0x42c25b
mov eax, 1
jmp 0x42c25d
cmp eax, 0x111
jne 0x42c1fa
mov eax, dword [ebp - 0x13c]
mov edx, 0x3f1
movzx ecx, ax
cmp dx, cx
jne 0x42be4a
lea eax, [ebp - 0x13c]
push eax
lea ecx, [edi + 0xa8]
call fcn.0041d7a0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 4], 2
cmp dword [eax - 4], 1
jle 0x42bdb2
push dword [eax - 0xc]
lea ecx, [ebp - 0x13c]
call fcn.00405230
mov eax, dword [ebp - 0x13c]
push eax
push dword [edi + 4]
lea eax, [ebp - 0x138]
push eax
lea ecx, [edi + 0x84]
call fcn.00425d00
mov eax, dword [ebp - 0x138]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
je 0x42bdf0
lea eax, [ebp - 0x138]
push eax
lea ecx, [edi + 0xa8]
call fcn.0041e750
mov eax, dword [ebp - 0x138]
or esi, 0xffffffff
mov byte [ebp - 4], 2
lea edx, [eax - 0x10]
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42be0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x42bae5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
mov edx, 0x3e8
cmp dx, cx
jne 0x42be6b
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
push edx
push eax
jmp 0x42bd09
mov edx, 0x3e9
cmp dx, cx
jne 0x42bf37
call fcn.00421270
mov ecx, eax
call fcn.00418920
test eax, eax
je 0x42be9b
push 0
lea ecx, [edi + 0xa8]
call fcn.0041e7c0
jmp 0x42bf17
cmp dword [edi + 0x74], 0
je 0x42bf17
lea eax, [ebp - 0x130]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x130], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x1a8
push 0x270
push dword [ebp - 0x12c]
push dword [ebp - 0x130]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
lea ecx, [edi + 4]
call fcn.00426a30
mov ecx, edi
call fcn.004289b0
mov eax, dword [edi + 0x74]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
push 0
lea ecx, [edi + 0xa8]
call fcn.0041e7c0
mov eax, dword [edi + 0x80]
push 1
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [edi + 0x188], 1
mov dword [ecx], 0
jmp 0x42c25d
mov edx, 0x3eb
cmp dx, cx
jne 0x42bf58
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
push edx
push eax
jmp 0x42bd09
mov edx, 0x3f2
cmp dx, cx
jne 0x42bf8d
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
mov ecx, edi
push edx
push eax
call fcn.004294c0
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
mov edx, 0x3ea
cmp dx, cx
jne 0x42bfc2
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
mov ecx, edi
push edx
push eax
call fcn.004294c0
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
mov edx, 0x3f3
cmp dx, cx
jne 0x42bff7
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
mov ecx, edi
push edx
push eax
call fcn.004294c0
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
mov edx, 0x3f4
cmp dx, cx
jne 0x42c02c
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
mov ecx, edi
push edx
push eax
call fcn.004294c0
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
mov edx, 0x3f5
cmp dx, cx
jne 0x42c061
push 0
push 0xf020
push 0x112
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
mov edx, 0x3f6
cmp dx, cx
jne 0x42c0d5
push 1
call fcn.00421270
mov ecx, eax
call fcn.00419b70
push 1
call fcn.00421270
mov ecx, eax
call fcn.00419a20
push 0
call fcn.00421270
mov ecx, eax
call fcn.0041a030
push 0
call fcn.00421270
mov ecx, eax
call fcn.0041a020
push 1
call fcn.00421270
mov ecx, eax
call fcn.0041a040
mov eax, dword [edi + 0xa0]
lea ecx, [edi + 0xa0]
call dword [eax]
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
mov edx, 0x3f7
cmp dx, cx
jne 0x42c0ef
push 1
call fcn.00421270
mov ecx, eax
call fcn.00419b90
jmp 0x42c0b1
mov edx, 0x400
cmp dx, cx
jne 0x42c11c
push 1
call fcn.00421270
mov ecx, eax
call fcn.00419a20
push 1
call fcn.00421270
mov ecx, eax
call fcn.0041a030
push 1
jmp 0x42c097
mov edx, 0x3ec
cmp dx, cx
jne 0x42c151
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
mov ecx, edi
push edx
push eax
call fcn.00429ec0
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
mov edx, 0x3ed
cmp dx, cx
jne 0x42c186
lea ecx, [ebp - 0x138]
shr eax, 0x10
push ecx
push dword [ebp - 0x140]
mov ecx, edi
push edx
push eax
call fcn.00429ec0
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov eax, 1
jmp 0x42c25d
mov eax, 0x3ee
cmp ax, cx
jne 0x42c1be
push 4
push 0
push 0
push str.http:__www.whaleprotect.cn_text_privacy_agreement.html
push 0x52346c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
mov eax, 0x3ef
cmp ax, cx
je 0x42c190
mov eax, 0x3fb
cmp ax, cx
je 0x42bae5
mov eax, 0x3f9
cmp ax, cx
jne 0x42c25b
mov ecx, edi
call fcn.00426bd0
mov ecx, dword [ebp - 0x134]
mov eax, 1
mov dword [ecx], 0
jmp 0x42c25d
cmp eax, 0x112
jne 0x42c25b
cmp dword [ebp - 0x13c], 0xf120
mov dword [edi + 0x70], 1
jne 0x42c229
mov eax, dword [edi + 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x108]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42c245
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [ebp - 0x134]
mov dword [ecx], 0
cmp dword [edi + 0x70], 0
jne 0x42baf1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004727c8
mov esp, ebp
pop ebp
ret 0x18
push 0x80004005
call fcn.00404690
int3