Function at 0x10042a45
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070891
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10043095
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
movzx eax, byte [eax]
test eax, eax
je 0x10042d62
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], 0x1ec7
cmp dword [ebp - 0x70], 0xb28
jge 0x10042d18
push 0x12db9c60
push 0x12580170
push 0x1257de78
mov ecx, 0x10660718
call fcn.10023043
mov ecx, eax
call fcn.10023043
mov ecx, eax
call fcn.10023043
mov eax, dword [0x12db9c64]
cmp eax, dword [0x1257de7c]
jg 0x10042b42
jl 0x10042af2
mov eax, dword [0x12db9c60]
cmp eax, dword [0x1257de78]
jae 0x10042b42
mov eax, dword [0x12db9c60]
add eax, 1
mov ecx, dword [0x12db9c64]
adc ecx, 0
mov dword [0x12db9c60], eax
mov dword [0x12db9c64], ecx
push fcn.10013ebe
push 1
push dword [0x12db9c64]
push dword [0x12db9c60]
mov ecx, 0x106605f8
call fcn.1000be98
mov dl, 0x20
mov ecx, eax
call fcn.10013ef0
mov ecx, eax
call fcn.10011129
mov ecx, eax
call fcn.1001111d
mov eax, dword [0x12db9c60]
cmp eax, dword [0x1257de78]
jne 0x10042b90
mov eax, dword [0x12db9c64]
cmp eax, dword [0x1257de7c]
jne 0x10042b90
push fcn.10013ebe
push 2
push dword [0x1257de7c]
push dword [0x1257de78]
mov ecx, 0x106605f8
call fcn.1000be98
mov dl, 0x20
mov ecx, eax
call fcn.10013ef0
mov ecx, eax
call fcn.10011129
mov ecx, eax
call fcn.1001111d
mov eax, dword [0x12db9c60]
sub eax, dword [0x1257de78]
mov ecx, dword [0x12db9c64]
sbb ecx, dword [0x1257de7c]
mov dword [0x12db9c60], eax
mov dword [0x12db9c64], ecx
mov eax, dword [0x12580170]
mov dword [ebp - 0x98], eax
mov eax, dword [0x12580174]
mov dword [ebp - 0x94], eax
mov eax, dword [0x12580170]
sub eax, 2
mov ecx, dword [0x12580174]
sbb ecx, 0
mov dword [0x12580170], eax
mov dword [0x12580174], ecx
mov eax, dword [0x12580170]
add eax, 1
mov ecx, dword [0x12580174]
adc ecx, 0
push ecx
push eax
push dword [0x12db9c64]
push dword [0x12db9c60]
call fcn.1006f2a0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
mov eax, dword [0x1257de78]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x1257de7c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x18], 0
push 0
push 2
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call fcn.1006f350
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x8c]
or eax, dword [ebp - 0x88]
jne 0x10042c66
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jmp 0x10042c8a
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x18], eax
mov eax, dword [0x12580170]
add eax, 1
mov ecx, dword [0x12580174]
adc ecx, 0
push ecx
push eax
push dword [0x12db9c64]
push dword [0x12db9c60]
call fcn.1006f350
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
cmp dword [ebp - 0x1c], 2
jne 0x10042cd4
cmp dword [ebp - 0x18], 0
jne 0x10042cd4
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x18]
adc ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x10042ce6
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x18]
sbb ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
push fcn.10013ebe
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0x106605f8
call fcn.1000be98
mov dl, 0x20
mov ecx, eax
call fcn.10013ef0
mov ecx, eax
call fcn.1000be98
mov ecx, eax
call fcn.1001111d
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
jmp 0x10042d40
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 4
jge 0x10042d5d
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 0x6c]
call fcn.100114b6
mov dword [eax], 0x25cbd945
jmp 0x10042d35
jmp 0x10043093
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x10043093
mov dword [ebp - 0x84], 0x2157
cmp dword [ebp - 0x84], 0x757
jge 0x10043079
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x10660718
call fcn.10010f2e
call fcn.1000b0a9
push eax
push 0
push 1
mov ecx, 0x10660718
call fcn.1004d826
lea ecx, [ebp - 0x44]
call fcn.1000be39
and dword [ebp - 4], 0
mov dword [ebp - 0x48], 1
jmp 0x10042dca
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x74], 0
je 0x1004306d
lea edx, [ebp - 0x44]
mov ecx, 0x10660718
call fcn.1004eb4c
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
jmp 0x10042dff
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x44]
call fcn.1000c275
cmp dword [ebp - 0x10], eax
jae 0x1004302d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x61
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x64
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x67
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x6a
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x6d
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x70
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x74
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x77
je 0x10042ec3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x10042ecf
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x10043028
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x62
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x65
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x68
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x6b
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x6e
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x71
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x75
je 0x10042f6b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x78
jne 0x10042f78
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
jmp 0x10043028
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x63
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x66
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x69
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x6c
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x6f
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x72
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x76
je 0x10043014
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000cbad
movsx eax, byte [eax]
cmp eax, 0x79
jne 0x1004301f
mov eax, dword [ebp - 0x14]
add eax, 3
mov dword [ebp - 0x14], eax
jmp 0x10043028
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
jmp 0x10042df8
push fcn.10013ebe
push dword [ebp - 0x14]
push dword [ebp - 0x48]
mov edx, 0x1000a1a4
mov ecx, 0x106605f8
call fcn.1000d867
mov ecx, eax
call fcn.10011129
mov edx, 0x10009908
mov ecx, eax
call fcn.1000d867
mov ecx, eax
call fcn.10011129
mov ecx, eax
call fcn.1001111d
jmp 0x10042dc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.1000be79
push 0x856
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100430ea
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
movzx eax, byte [eax]
test eax, eax
je 0x100430cd
push 0x856
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100430ea
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret