Function at 0x4027c0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434d35
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x44301c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push 0x43db6c
push 0x43dd24
call esi
test eax, eax
jne 0x402aac
push 0x43db6c
push str.dockhook32
call esi
test eax, eax
jne 0x402828
push 0x43db6c
push str.MyFinderApp
call esi
test eax, eax
je 0x402aac
push 0
push str.MYDOCKFINDER
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x402aac
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x10]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push edi
push 0
push 0
push 0x32
push 0x32
push 0
push 0x80000000
push 0x80000000
push 0x43dd4c
push str.dockmod32
push 0x80
mov ebx, eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x444ec8], eax
test eax, eax
je 0x402aac
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process2]
mov eax, dword [ebp - 0x14]
mov ecx, 0xaa64
cmp ax, cx
sete byte [0x444ecc]
je 0x4028e5
mov ecx, 0x8664
cmp ax, cx
je 0x4028e5
mov ecx, 0x200
cmp ax, cx
jne 0x402923
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
push 0
push str.dockmod64.exe
push 0x43dd74
push 0
mov byte [0x444ecd], 1
call edi
cmp byte [0x444ecc], 0
je 0x402923
push 1
push 0
push 0
push str.dockmod64arm.exe
push 0x43dd74
push 0
call edi
push 0x43db6c
push str.dockhook32
call esi
mov dword [0x445510], eax
test eax, eax
jne 0x402949
push 0x43db6c
push str.MyFinderApp
call esi
mov dword [0x445510], eax
push 0x445514
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.MyDockFinderShare
call esi
push str.MyDockFinderShareHwnd
mov dword [0x444ec4], eax
call esi
push str.MyDockFinderShareTemp
mov dword [0x44551c], eax
call esi
push str.MyDockFinderShareMemoryTask
mov dword [0x444ec0], eax
call esi
push str.MyDockFinderShareKey
mov dword [0x445520], eax
call esi
push str.MyDockFinderStageManager
mov dword [0x445524], eax
call esi
push str.MyDockFinderHwndMenu
mov dword [0x44552c], eax
call esi
mov esi, dword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
push 1
push 0x4a
mov dword [0x445518], eax
call esi
push 1
push dword [0x445518]
call esi
push 1
push dword [0x44552c]
call esi
push 1
push dword [0x444ec4]
call esi
push 1
push dword [0x44551c]
call esi
push 1
push dword [0x444ec0]
call esi
push 1
push dword [0x445524]
call esi
push 1
push dword [0x445520]
call esi
test ebx, ebx
je 0x402a5c
push 4
call fcn.00417856
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [eax], ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x404070
push 0
push 0
call fcn.0041c9ac
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x402ac5
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.004011e0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x402ac0
jmp 0x402a74
push 0x402310
push 0x3e8
push 1
push dword [0x444ec8]
call dword [sym.imp.USER32.dll_SetTimer]
push str.MyDockFinderWindowsHook
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x402a95
call fcn.00401c60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0041cf10
push 6
mov dword [ebp - 0x14], 0
call fcn.00416b32
int3