Function at 0x428a31
Capabilities:
Create process on windows

Disassembly:
push 0x7c
mov eax, 0x4bf4f1
call fcn.00494508
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x5c], ebx
je 0x428a50
xor eax, eax
call fcn.004945e0
ret 4
lea edi, [esi + 0x42c]
mov ecx, edi
call fcn.0040d513
test al, al
jne 0x428a46
push edi
lea ecx, [ebp - 0x14]
call fcn.004726a0
cmp byte [ebp - 0xd], 0xff
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
jne 0x428a79
mov eax, dword [ebp - 0x14]
push 0x4cf410
push eax
call fcn.00493860
pop ecx
test eax, eax
lea eax, [esi + 0x15c]
pop ecx
push eax
lea eax, [ebp - 0x34]
jne 0x428aa8
push str._distcode
push eax
call fcn.00473090
add esp, 0xc
mov byte [ebp - 4], 1
jmp 0x428aba
push 0x4d0220
push eax
call fcn.00473090
add esp, 0xc
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.00472ca0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00472740
lea eax, [esi + 0x194]
push eax
lea eax, [ebp - 0x34]
push 0x4d0218
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00472ca0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00472740
lea eax, [esi + 0x17c]
push eax
lea eax, [ebp - 0x34]
push str.li
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00472ca0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00472740
lea ecx, [ebp - 0x2c]
call fcn.004724b0
mov eax, dword [esi + 0x9d0]
mov byte [ebp - 4], 5
cmp eax, 1
jb 0x428b70
push eax
push 0x2c
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x4b8]
call fcn.004730e0
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004727f0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.00472740
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push str.cancelled
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.00472ca0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.00472740
lea ecx, [ebp - 0x24]
call fcn.004724b0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.004724b0
mov edi, dword [esi + 0x5d0]
mov byte [ebp - 4], 9
jmp 0x428c99
cmp dword [edi + 8], ebx
je 0x428c2a
lea ecx, [ebp - 0x24]
call fcn.0040d513
test al, al
jne 0x428c00
push 0x4cf9a4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00473040
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call fcn.004727f0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
call fcn.00472740
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00472ff0
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xb
call fcn.004727f0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.00472740
cmp dword [edi + 0xc], ebx
je 0x428c93
lea ecx, [ebp - 0x1c]
call fcn.0040d513
test al, al
jne 0x428c69
push 0x4cf9a4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00473040
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.004727f0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.00472740
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00472ff0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call fcn.004727f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00472740
add edi, 0xd0
cmp edi, dword [esi + 0x5d4]
jne 0x428bc1
lea ecx, [ebp - 0x24]
call fcn.0040d513
mov esi, str.none
test al, al
je 0x428cbf
push esi
lea ecx, [ebp - 0x24]
call fcn.00472890
lea ecx, [ebp - 0x1c]
call fcn.0040d513
test al, al
je 0x428cd4
push esi
lea ecx, [ebp - 0x1c]
call fcn.00472890
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push str.displayedoffer
push eax
call fcn.00473090
push str.acceptedoffer
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 0xe
call fcn.00473040
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0xf
call fcn.00472ff0
add esp, 0x24
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
call fcn.00472ca0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xf
call fcn.00472740
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xe
call fcn.00472740
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.00472740
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push str.action
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x11
call fcn.00472ca0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00472740
push 0x38
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.00493f80
add esp, 0xc
cmp byte [ebp - 0xd], 0xff
mov dword [ebp - 0x88], 0x3c
mov dword [ebp - 0x84], 0x440
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], str.open
lea eax, [ebp - 0x14]
jne 0x428da8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x78], eax
xor esi, esi
lea eax, [ebp - 0x88]
inc esi
push eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x428e07
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.00472740
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.00472740
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00472740
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00472740
mov eax, esi
jmp 0x428a48
xor esi, esi
jmp 0x428dd1