Function at 0x420410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x45a080]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x1c], ecx
push edi
mov ecx, 0x4690e3
mov dword [esp + 0x14], ebx
call fcn.00447953
cmp dword [0x45ab18], ebx
jne 0x420484
cmp byte [0x462104], 0
je 0x420484
push 0
push 0x1b
push 0x100
push dword [0x46206c]
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x45ab18], 0xffffffff
mov byte [0x462104], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0042195a
mov esp, ebp
pop ebp
ret
mov esi, dword [0x462020]
mov eax, 0x2aaaaaab
mov byte [0x462104], 0
mov ecx, dword [esi + 0x1ef0]
sub ecx, dword [esi + 0x1eec]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
test eax, eax
jle 0x42069b
lea ecx, [esi + 0x1ce4]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x462020]
mov eax, 0x2aaaaaab
mov edx, dword [ecx + 0x1ef0]
sub edx, dword [ecx + 0x1eec]
mov ecx, 0x465a90
imul edx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
push ebx
mov dword [esp + 0x14], ebx
call fcn.00407960
test ebx, ebx
jle 0x420546
xor edi, edi
xor esi, esi
mov eax, dword [0x462020]
mov edx, dword [eax + 0x1eec]
add edx, 0x18
add edx, esi
cmp dword [edx + 0x14], 0xf
jbe 0x420519
mov edx, dword [edx]
mov eax, edx
lea ebx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420520
mov ecx, dword [0x465a90]
sub eax, ebx
push eax
push edx
lea ecx, [edi + ecx]
call fcn.00407c90
add esi, 0x30
add edi, 0x18
sub dword [esp + 0x10], 1
jne 0x420501
mov eax, dword [0x462020]
add eax, 0x1ce4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
mov byte [0x461df6], 1
mov dword [0x45ab18], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x30
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00423a10
add esp, 0xc
mov dword [esp + 0x24], 0x30
xor edx, edx
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x14]
lea ebx, [edx + 1]
mov dword [esp + 0x44], eax
mov eax, dword [0x465a90]
add eax, edi
mov dword [esp + 0x28], 0x33
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x34], ebx
cmp dword [eax + 0x14], 0xf
jbe 0x4205be
mov eax, dword [eax]
mov dword [esp + 0x48], eax
mov eax, dword [0x462020]
mov ecx, dword [eax + 0x1eec]
add ecx, esi
cmp dword [ecx + 0x14], 0xf
jbe 0x4205d7
mov ecx, dword [ecx]
cmp byte [ecx], 0
mov eax, 3
mov dword [esp + 0x1c], 0
cmovne eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x24]
push eax
push 1
push edx
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_InsertMenuItemA]
mov edx, ebx
add edi, 0x18
add esi, 0x30
cmp edx, dword [esp + 0x18]
jl 0x420590
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x10]
dec eax
push 0
push dword [0x46206c]
push 0
push eax
push dword [esp + 0x64]
push 0x180
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
lea ecx, [eax - 1]
test eax, eax
je 0x42068d
cmp ecx, dword [esp + 0x18]
jge 0x42068d
mov eax, dword [0x462020]
lea ecx, [ecx + ecx*2]
shl ecx, 4
add ecx, dword [eax + 0x1eec]
cmp dword [ecx + 0x14], 0xf
jbe 0x420669
mov ecx, dword [ecx]
cmp byte [ecx], 0
je 0x42068d
push 5
push 0x4522a0
push 0x4522a0
push ecx
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [0x461df6], 0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042195a
mov esp, ebp
pop ebp
ret