Function at 0x434af2
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x53b24c
call fcn.004f8378
sub esp, 0x18
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov esi, ecx
je 0x435303
cmp dword [ebp + 0xc], ebx
jle 0x435303
push dword [ebp + 0xc]
call fcn.00513471
mov edi, eax
pop ecx
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x435303
xor eax, eax
cmp dword [ebp + 0xc], ebx
jle 0x434b44
mov ecx, dword [ebp + 8]
mov cl, byte [eax + ecx]
mov byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 0xc]
jl 0x434b35
cmp word [edi], 0xfffd
mov dword [ebp + 8], edi
mov dword [ebp - 0x14], ebx
jne 0x434bfd
cmp word [edi + 6], 0xffff
jne 0x434bfd
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp + 0xc]
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x20], ebx
call fcn.0043979d
test eax, eax
jne 0x434bb7
push edi
mov dword [esi + 0xba3], ebx
call fcn.0051349a
cmp dword [esi + 0xb8b], ebx
lea eax, [esi + 0xb8b]
pop ecx
je 0x434bac
push ebx
push 0x40
push 0x7e5
mov dword [eax], ebx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4352ca
cmp dword [esi + 0x7e1], ebx
jmp 0x4352ee
push edi
call fcn.0051349a
pop ecx
mov ecx, dword [ebp - 0x20]
push 1
pop eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ecx + 6]
mov dword [ebp + 8], ecx
mov dword [ebp - 0x1c], eax
mov ax, word [eax]
and eax, 0xfff
cmp ax, 0x24
jne 0x434c19
push dword [ebp + 0xc]
mov dword [esi + 0xba3], ebx
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00442076
jmp 0x435303
mov ax, word [edi + 6]
lea ecx, [edi + 6]
mov edx, eax
mov dword [ebp - 0x1c], ecx
and edx, 0x4000
and ax, 0xbfff
mov dword [ebp - 0x18], edx
mov word [ecx], ax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp - 0x10]
call fcn.0043974a
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x434c4a
mov eax, dword [ebp + 8]
cmp word [eax + 0x90], 0xfffe
je 0x434c4a
push ebx
push 0x40
push 0x7e5
push dword [esi + 0x1c]
call edi
mov eax, dword [ebp + 8]
cmp word [eax], 0xfffd
jne 0x435287
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.004398eb
test eax, eax
je 0x435287
mov eax, dword [ebp - 0x1c]
mov ax, word [eax]
test al, 0x90
je 0x435015
test ah, 0xf
jne 0x435015
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x404
jne 0x434ca7
mov eax, dword [ebp + 8]
push 0x50
pop edx
lea ecx, [eax + 0x92]
call fcn.004d6510
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
add eax, 0x92
push eax
mov dword [ebp - 0x24], eax
call fcn.0051379e
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov ax, word [eax + 0x90]
cmp ax, bx
jne 0x434e0d
mov ecx, dword [esi + 0xcf9]
cmp ecx, ebx
je 0x434ce8
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0xcf9], ebx
mov eax, dword [esi + 0xd01]
lea ecx, [esi + 0xd01]
cmp dword [eax - 8], ebx
jne 0x434d07
mov eax, dword [ebp + 8]
add eax, 0x132
push eax
call fcn.005138b9
mov eax, dword [ebp + 8]
cmp dword [esi + 0x1a8], ebx
mov eax, dword [eax + 2]
mov dword [esi + 0x7e1], eax
je 0x434d7c
cmp dword [esi + 0x1c1], ebx
je 0x434d7c
mov eax, dword [esi + 0x19c]
cmp eax, ebx
je 0x434d34
push eax
call dword [sym.imp.USER32.dll_SetFocus]
or byte [esi + 0xa53], 4
mov ecx, esi
call fcn.00449170
push ebx
mov ecx, esi
call fcn.004425eb
test eax, eax
jne 0x434d5d
push ebx
push ebx
push 0x10
mov dword [esi + 0xba3], ebx
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x10], ebx
je 0x434d6b
push dword [ebp - 0x10]
call fcn.0051349a
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00513730
jmp 0x435303
push dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.005138b9
push str.WTServer_DES
push dword [ebp - 0x18]
call fcn.004f8b05
pop ecx
test eax, eax
pop ecx
je 0x434dcb
cmp dword [esi + 0xbbb], 1
jne 0x434dcb
mov ax, word [esi + 0x7e5]
push 1
mov ecx, esi
mov word [ebp - 0x24], ax
mov word [esi + 0x7e5], 0x21
call fcn.00438f89
mov ax, word [ebp - 0x24]
mov word [esi + 0x7e5], ax
mov eax, dword [ebp + 8]
test byte [eax + 0xd6], 4
je 0x434dfb
or byte [esi + 0xa53], 2
push 0xab
push ebx
mov ecx, esi
mov dword [esi + 0xba3], ebx
call fcn.0043aa17
push 0xe71a
jmp 0x434ffd
push ebx
push 0x10
push 0x7e5
push dword [esi + 0x1c]
call edi
jmp 0x435004
cmp ax, 0x7001
jne 0x434e56
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 8]
add eax, 0x141
push eax
call fcn.0051379e
lea eax, [ebp + 8]
mov ecx, esi
push eax
mov byte [ebp - 4], 1
call fcn.0044023d
push ebx
push 0x40
push 0x7e5
mov dword [esi + 0xba3], ebx
push dword [esi + 0x1c]
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00513730
jmp 0x435004
cmp ax, 0x7004
jne 0x434e99
push ebx
push 0x40
push 0x7e5
mov dword [esi + 0xba3], ebx
push dword [esi + 0x1c]
call edi
push 0xe00b
lea ecx, [esi + 0xa35]
mov dword [esi + 0x77a], 1
call fcn.00518bf6
push ebx
push 0x22
push 0x7e5
push dword [esi + 0x1c]
jmp 0x434e06
cmp ax, 0x7003
jne 0x434ec8
mov eax, dword [ebp - 0x10]
lea ecx, [esi + 0xa99]
add eax, 0x141
mov dword [esi + 0xba3], ebx
push eax
mov dword [esi + 0xd41], 1
call fcn.005138b9
jmp 0x435004
cmp ax, 0xfffe
je 0x434ee3
push ebx
push 0x40
push 0x7e5
mov dword [esi + 0xba3], ebx
push dword [esi + 0x1c]
call edi
jmp 0x434ef4
or byte [esi + 0xa53], 8
mov dword [esi + 0xba3], 1
mov eax, dword [ebp - 0x24]
cmp byte [eax], bl
je 0x434fca
mov eax, dword [0x59fe84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
push 0x9c67
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00518bf6
push 0x9c68
lea ecx, [ebp - 0x1c]
call fcn.00518bf6
lea ecx, [ebp - 0x14]
call fcn.00513c64
lea eax, [ebp - 0x24]
push 3
push eax
lea ecx, [ebp - 0x14]
call fcn.0050f269
mov eax, dword [eax]
push 0x592b58
push eax
call fcn.004f8b05
pop ecx
test eax, eax
pop ecx
jne 0x434f84
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.004f8b05
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp + 0xb], al
je 0x434f84
lea eax, [esi + 0x86f]
push eax
call fcn.004f8bc0
cmp eax, 0xc
pop ecx
setb al
cmp al, bl
mov byte [ebp + 0xb], 1
jne 0x434f87
mov byte [ebp + 0xb], bl
lea ecx, [ebp - 0x24]
call fcn.00513730
cmp byte [ebp + 0xb], bl
je 0x434fa7
push 1
push ebx
push ebx
push dword [ebp - 0x14]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push ebx
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0043a3c1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00513730
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
jmp 0x434e4c
cmp dword [esi + 0xb8b], ebx
lea eax, [esi + 0xb8b]
je 0x434ff8
push ebx
push 0x40
push 0x7e5
mov dword [eax], ebx
push dword [esi + 0x1c]
call edi
push 0x80a3
mov ecx, esi
call fcn.0043a36f
jmp 0x434d5d
push 0xe727
mov ecx, esi
call fcn.0043a36f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00513730
jmp 0x43515d
and eax, 0xfff
cmp ax, 0x25
jne 0x43516b
mov eax, dword [ebp + 8]
cmp word [eax + 0x90], bx
jne 0x435145
add eax, 0x141
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], eax
add eax, 5
push eax
call fcn.0051379e
push str.__IP__
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 4
call fcn.0050f303
test eax, eax
jge 0x435079
mov eax, dword [ebp + 8]
push ebx
mov ecx, esi
push dword [eax + 0x13d]
push dword [ebp - 0x24]
call fcn.00440dff
jmp 0x435139
mov eax, dword [0x59fe84]
mov dword [ebp - 0x1c], eax
push 0x20
push 0x20
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00513b60
push eax
lea eax, [esi + 0xcb9]
push eax
push 0xf
push ebx
call fcn.004bf672
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push str.__IP__
call fcn.0050ef80
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 8]
add eax, 6
push eax
call fcn.00513471
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x43512d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 8]
add eax, 6
push eax
push ebx
push dword [ebp + 8]
call fcn.004f8540
mov eax, dword [ebp + 8]
add esp, 0xc
mov byte [eax + 2], 1
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx - 8]
mov word [eax + 3], bx
add ecx, 6
mov word [eax], cx
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
push dword [eax - 8]
push ebx
call fcn.00513b60
push eax
mov eax, dword [ebp + 8]
add eax, 5
push eax
call fcn.004f87d0
mov eax, dword [ebp + 8]
add esp, 0xc
movsx ecx, word [eax]
push ebx
push ecx
push eax
mov ecx, esi
call fcn.00440dff
push dword [ebp + 8]
call fcn.0051349a
pop ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00513730
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00513730
push ebx
push ebx
push 0x10
mov dword [esi + 0xba3], ebx
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x10], ebx
je 0x435303
push dword [ebp - 0x10]
call fcn.0051349a
pop ecx
jmp 0x435303
cmp ax, 0x20
jne 0x435180
push ebx
push 0x20
push 0x7e5
push dword [esi + 0x1c]
call edi
jmp 0x43515d
cmp ax, 0x28
jne 0x4351af
push 0x80a1
push 0x13
mov ecx, esi
call fcn.00444b9c
cmp al, 0x31
jne 0x43515d
push ebx
push 0x8003
mov dword [esi + 0xea5], 1
push 0x111
jmp 0x435179
cmp dword [esi + 0x7e1], ebx
lea eax, [esi + 0x7e1]
jne 0x4351da
mov ecx, dword [ebp + 8]
lea edi, [esi + 0xcf9]
mov ecx, dword [ecx + 2]
mov dword [eax], ecx
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4351da
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi], ebx
mov edi, dword [ebp - 0x10]
mov dword [ebp + 8], edi
mov eax, dword [edi + 0x88]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x8c]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 0xffffff70
push eax
lea eax, [edi + 0x90]
push eax
lea eax, [edi + 0x18]
push eax
call fcn.004f87d0
mov eax, dword [ebp - 0x1c]
sub dword [ebp + 0xc], 0x78
add esp, 0xc
mov ax, word [eax]
and ax, 0xfff
cmp ax, 0x401
jne 0x435264
cmp dword [ebp + 0xc], 0x177
ja 0x435264
push 0x17a
call fcn.00513471
mov dword [esp], 0x17a
push ebx
push eax
mov dword [ebp + 8], eax
call fcn.004f8540
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call fcn.004f87d0
push edi
call fcn.0051349a
mov edi, dword [ebp + 8]
add esp, 0x1c
mov dword [ebp - 0x10], edi
mov dword [ebp + 8], edi
push dword [ebp + 8]
mov ecx, esi
call fcn.004422fd
push dword [ebp - 0x18]
mov ecx, esi
mov dword [esi + 0xba3], ebx
push dword [ebp + 0xc]
push edi
call fcn.00435314
jmp 0x43515d
mov ecx, dword [esi + 0x7e1]
lea eax, [esi + 0x7e1]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 2]
mov dword [esi + 0xba3], ebx
mov dword [eax], ecx
call fcn.0051349a
cmp dword [esi + 0xb8b], ebx
lea eax, [esi + 0xb8b]
pop ecx
je 0x4352d1
push ebx
push 0x40
push 0x7e5
mov dword [eax], ebx
push dword [esi + 0x1c]
call edi
push 0x80a3
jmp 0x4352fc
mov eax, dword [ebp + 8]
cmp word [eax + 0x90], 0xfffe
je 0x4352eb
push ebx
push 0x40
push 0x7e5
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x24], ebx
jne 0x4352f7
push 0xe727
jmp 0x4352fc
push 0xe728
mov ecx, esi
call fcn.0043a36f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8