Function at 0x430810
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49ff8a
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x4d6720]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x838]
mov dword fs:[0], eax
mov eax, dword [esp + 0x848]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0xffffffff
cmp dword [0x4d89a4], edi
je 0x4308ae
push 0x30
call fcn.0041bd20
push 0xfc
push str.Close_all_schedules_ignored_because_one_warning_is_already_displayed
push 2
call fcn.0042fc90
add esp, 0x10
call fcn.00467ffb
cmp eax, edi
je 0x4308a7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
cmp eax, edi
je 0x4308a7
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x430c73
call fcn.0043b8c0
mov ebp, eax
call fcn.00468b49
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4308cf
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x840], edi
cmp dword [esp + 0x84c], edi
je 0x430a23
cmp ebp, edi
jle 0x430919
push ebp
lea ecx, [esp + 0x1c]
push 0x4a8868
push ecx
call fcn.00411be0
add esp, 0xc
mov byte [esp + 0x840], 1
mov ebx, 1
jmp 0x430939
push 1
lea edx, [esp + 0x24]
push 0x172
push edx
call fcn.00401dd0
add esp, 0xc
mov ebx, 2
mov dword [esp + 0x840], ebx
mov esi, dword [eax]
push 1
lea eax, [esp + 0x20]
push 0x171
push eax
mov dword [esp + 0x20], ebx
call fcn.00401dd0
mov eax, dword [eax]
push esi
push str.NUMBER
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x85c], 3
call fcn.00417870
add esp, 0x1c
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x844], 4
call fcn.00401a50
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x840], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4309ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x840], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4309d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x840], 1
test bl, 2
je 0x430a0a
mov eax, dword [esp + 0x20]
and ebx, 0xfffffffd
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430a0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x840], edi
test bl, 1
je 0x430b6a
mov eax, dword [esp + 0x18]
jmp 0x430b4e
cmp ebp, edi
jle 0x430a49
push ebp
lea ecx, [esp + 0x30]
push 0x4a8868
push ecx
call fcn.00411be0
add esp, 0xc
mov byte [esp + 0x840], 5
mov ebx, 4
jmp 0x430a6d
push 1
lea edx, [esp + 0x20]
push 0x172
push edx
call fcn.00401dd0
add esp, 0xc
mov dword [esp + 0x840], 6
mov ebx, 8
mov esi, dword [eax]
push 1
lea eax, [esp + 0x24]
push 0x173
push eax
mov dword [esp + 0x20], ebx
call fcn.00401dd0
mov eax, dword [eax]
push esi
push str.NUMBER
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x85c], 7
call fcn.00417870
add esp, 0x1c
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x844], 8
call fcn.00401a50
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x840], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x430adf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x840], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430b07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x840], 5
test bl, 8
je 0x430b3e
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430b3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x840], edi
test bl, 4
je 0x430b6a
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430b6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x28]
push 2
push 0x133
push edi
mov dword [0x4d89a4], 1
call fcn.0041d870
mov esi, eax
xor ebx, ebx
push esi
mov dword [0x4d89a4], ebx
call fcn.0041bf20
push eax
push ebp
lea ecx, [esp + 0x30]
push str.Displayed_user_warning_about_exiting_ALL___d__schedule_s_.__User_chose:__s_
push ecx
call fcn.00411be0
mov eax, dword [eax]
push ebx
push eax
push ebx
mov byte [esp + 0x86c], 9
call fcn.0042fc90
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x2c
mov byte [esp + 0x840], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x430be2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 6
jne 0x430c3a
push 0x400
lea edx, [esp + 0x38]
push edx
xor ecx, ecx
push ebx
mov word [esp + 0x40], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x430c48
mov edx, dword [esp + 0x30]
push 5
push ebx
push str._closeall
lea ecx, [esp + 0x40]
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x430c48
mov dword [esp + 0x24], 1
jmp 0x430c48
cmp esi, 7
je 0x430c44
cmp esi, 2
jne 0x430c48
mov dword [esp + 0x24], ebx
lea eax, [edi - 0x10]
mov dword [esp + 0x840], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430c6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x838]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.00482b5f
add esp, 0x830
ret