Function at 0x4273e5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov dword [ebp - 0x10], 4
xor ebx, ebx
mov dword [ebp - 8], 0x979cd329
mov esi, edx
push edi
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffc
push 3
pop edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x3a1a91f1
mov dword [ebp - 0x20], 0xbc8977b4
mov dword [ebp - 0x14], ebx
jmp 0x427435
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x28], 0x262954f6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x427427
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
cmp eax, 0xebf495e3
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xd8b9
setne cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xe52d
setne al
sub eax, dword [ebp - 0x10]
cmp eax, 0x2a43
jle 0x42748a
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jne 0x4274bc
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x4275cf
push 0xf2b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4275cf
push edi
lea ecx, [ebp - 0x40]
call fcn.0040194d
mov dword [ebp - 8], ebx
jmp 0x4274da
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x40]
mov dword [eax + ecx*4], 0x79cc099a
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4274ca
push 2
mov dword [ebp - 8], ebx
pop edi
jmp 0x4274f5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x34], 0x15e1b460
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4274e7
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], edi
jg 0x4275b7
mov eax, 0x49f0dc4b
mov dword [ebp - 0x18], 0x7eb23672
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0x22cbd4da
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + edx*4]
mov edx, dword [ebp - 8]
sub ecx, eax
mov eax, dword [ebp - 0x40]
add edx, ecx
mov eax, dword [eax]
neg eax
sub edx, eax
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x18]
je 0x427554
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
xor edx, edx
inc edx
xor ecx, ecx
mov dword [ebp - 0x44], edx
cmp dword [eax], edx
setg cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], ebx
jl 0x4275a6
mov dword [ebp - 0x14], ebx
jmp 0x427582
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x427574
mov dword [ebp - 0x14], ebx
jmp 0x427599
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x42758d
dec dword [ebp - 0x1c]
dec dword [ebp - 0xc]
jns 0x42756f
inc dword [ebp - 8]
mov eax, 0x49f0dc4b
cmp dword [ebp - 8], edi
jle 0x42750b
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x4275c7
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x40]
call fcn.00401a1f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
sub eax, ecx
jne 0x4275e5
cmp dword [ebp - 0x20], ebx
je 0x4275e8
xor ebx, ebx
inc ebx
lea eax, [ebx + 6]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4275f5
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x10]
sub eax, 9
mov dword [ebp - 8], eax
mov eax, dword [esi]
test eax, eax
jns 0x427621
add eax, 0x100
js 0x427618
mov dword [esi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret