Function at 0x420694
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x42069c
push ecx
xor eax, eax
push ebp
push 0x420a76
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4263a4]
cmp byte [eax + 0x110b], 0
jne 0x420973
lea eax, [ebp - 0x24]
call fcn.0041e754
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407678
mov eax, dword [ebp - 0x20]
mov edx, 0x420a8c
call fcn.004043f0
jne 0x4208c0
mov eax, dword [0x4263b8]
cmp byte [eax], 0
je 0x420756
mov eax, 0x420aa4
call fcn.0041bf04
push 0
push 0
push 0x42a6c0
mov ecx, 0x420108
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp 0x42073e
mov eax, dword [ebp - 0x18]
sub eax, 2
je 0x42072b
sub eax, 0xf
je 0x420732
sub eax, 5
je 0x420739
jmp 0x42073e
call fcn.00403ea0
jmp 0x42073e
call fcn.00403ea0
jmp 0x42073e
call fcn.00403ea0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x420717
jmp 0x420a5b
mov eax, 0x420ac8
call fcn.0041bf04
lea edx, [ebp - 0x28]
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.00416c68
mov eax, dword [ebp - 0x28]
call fcn.0041c984
test al, al
je 0x4207af
mov edx, dword [0x4263a4]
mov al, 1
mov byte [edx + 0x110b], al
push 0
push 0
mov edx, dword [0x4263a4]
push eax
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x110b
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e428
mov eax, 0x420af0
call fcn.0041e8ac
push eax
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.004044a4
pop edx
call fcn.004154a0
test al, al
jne 0x420a5b
mov edx, dword [0x4263a4]
xor eax, eax
mov byte [edx + 0x1108], al
push 0
push 0
mov edx, dword [0x4263a4]
push eax
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x1108
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e428
mov eax, dword [0x4263a4]
mov byte [eax + 0x1109], 0
push 0
push 0
push 0
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x1109
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e428
push 0
push 0
push 0x42a6c0
mov ecx, 0x420108
xor edx, edx
xor eax, eax
call fcn.00403fc8
push 0
push 0
push 0x42a6c0
mov ecx, 0x4161cc
xor edx, edx
xor eax, eax
call fcn.00403fc8
push 0
push 0
push 0x42a6c0
mov ecx, 0x414fd4
xor edx, edx
xor eax, eax
call fcn.00403fc8
call fcn.0041c184
jmp 0x4208a8
mov eax, dword [ebp - 0x18]
sub eax, 2
je 0x420895
sub eax, 0xf
je 0x42089c
sub eax, 5
je 0x4208a3
jmp 0x4208a8
call fcn.00403ea0
jmp 0x4208a8
call fcn.00403ea0
jmp 0x4208a8
call fcn.00403ea0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x420881
jmp 0x420a5b
lea edx, [ebp - 0x2c]
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.00416c68
mov eax, dword [ebp - 0x2c]
call fcn.0041c984
test al, al
je 0x42090f
mov edx, dword [0x4263a4]
mov al, 1
mov byte [edx + 0x110b], al
push 0
push 0
mov edx, dword [0x4263a4]
push eax
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x110b
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e428
mov eax, 0x420af0
call fcn.0041e8ac
push eax
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.004044a4
pop edx
call fcn.004154a0
test al, al
jne 0x420a5b
push 0
push 0x420b00
lea edx, [ebp - 0x30]
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.00416c68
lea eax, [ebp - 0x30]
mov edx, 0x420b0c
call fcn.004042b4
mov eax, dword [ebp - 0x30]
call fcn.004044a4
push eax
push 0x420b18
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x420a5b
lea eax, [ebp - 0x38]
call fcn.0041e754
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00407678
mov eax, dword [ebp - 0x34]
mov edx, 0x420a8c
call fcn.004043f0
jne 0x420a5b
mov eax, dword [0x4263b8]
cmp byte [eax], 0
je 0x420a02
mov eax, 0x420b30
call fcn.0041bf04
push 0
push 0
push 0x42a6c0
mov ecx, 0x420108
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp 0x4209ed
mov eax, dword [ebp - 0x18]
sub eax, 2
je 0x4209da
sub eax, 0xf
je 0x4209e1
sub eax, 5
je 0x4209e8
jmp 0x4209ed
call fcn.00403ea0
jmp 0x4209ed
call fcn.00403ea0
jmp 0x4209ed
call fcn.00403ea0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4209c6
jmp 0x420a5b
mov eax, 0x420ac8
call fcn.0041bf04
lea edx, [ebp - 0x3c]
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.00416c68
mov eax, dword [ebp - 0x3c]
call fcn.0041c984
test al, al
je 0x420a5b
mov edx, dword [0x4263a4]
mov al, 1
mov byte [edx + 0x110b], al
push 0
push 0
mov edx, dword [0x4263a4]
push eax
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x110b
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420a7d
lea eax, [ebp - 0x3c]
mov edx, 8
call fcn.00404030
ret