Function at 0x425ed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x449908
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x45c020]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, ecx
mov esi, edx
cmp ebx, 0x113
mov byte [esp + 0x13], 0
ja 0x426296
je 0x4261ff
add ebx, 0xffffffe0
cmp ebx, 0xf2
ja case.0x425f30.33
movzx ecx, byte [ebx + 0x426614]
jmp dword [ecx*4 + 0x4265f8]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x50]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], edx
call fcn.00423660
test eax, eax
je case.0x425f30.33
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call edx
mov byte [esp + 0x13], al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x50]
xor edi, edi
call fcn.00422d70
cmp dword [ebx + 0x50], edi
je case.0x425f30.33
mov eax, ebx
call fcn.004259a0
test eax, eax
je case.0x425f30.33
mov eax, ebx
call fcn.004259a0
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
push ecx
mov ecx, eax
call edx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x50]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], edx
call fcn.00423660
cmp byte [eax + 5], 0
je case.0x425f30.33
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call edx
test eax, eax
je case.0x425f30.33
mov ecx, dword [ebp + 0x14]
mov byte [esp + 0x13], 1
mov dword [ecx], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
lea edi, [esi + 0x3c]
mov eax, edi
call fcn.00426b90
test al, al
jne 0x42610f
lea esi, [esp + 0x24]
mov byte [esp + 0x12], al
call fcn.00426b50
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x44]
add eax, 0x3c
cmp dword [eax + 4], ebx
jbe 0x4260b4
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
test edi, edi
je 0x4260c2
mov eax, dword [ebp + 8]
add eax, 0x3c
cmp edi, eax
je 0x4260c8
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, ebx
je 0x426101
test edi, edi
jne 0x4260d6
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, dword [edi + 8]
jb 0x4260e1
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
push eax
call edx
or byte [esp + 0x12], al
cmp esi, dword [edi + 8]
jb 0x4260fc
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add esi, 4
jmp 0x4260a0
cmp byte [esp + 0x12], 0
jne 0x4265e1
mov esi, dword [ebp + 8]
cmp dword [ebp + 0xc], 0xf060
jne case.0x425f30.33
cmp byte [esi + 5], 0
je 0x4265e1
call fcn.004258e0
jmp 0x4265e1
mov edi, dword [ebp + 8]
add edi, 0x3c
mov eax, edi
mov dword [esp + 0x14], edi
call fcn.00426b90
test al, al
jne case.0x425f30.33
lea esi, [esp + 0x24]
call fcn.00426b50
mov ebx, dword [esp + 0x24]
mov edi, dword [ebp + 0x10]
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 8]
cmp dword [eax + 4], esi
jbe 0x426172
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
test ebx, ebx
je 0x42617c
cmp ebx, dword [esp + 0x14]
je 0x426182
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp dword [esp + 0x28], esi
je case.0x425f30.33
test byte [edi + 0x18], 2
jne 0x4261b4
lea esi, [esp + 0x24]
call fcn.00426cf0
mov edx, dword [edi + 0x14]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edx
mov edx, dword [edi + 0x10]
push edx
mov edx, dword [edi + 0xc]
push edx
mov edx, dword [edi + 8]
push edx
call eax
test ebx, ebx
jne 0x4261be
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [ebx + 8]
jb 0x4261cd
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add dword [esp + 0x28], 4
jmp 0x426160
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x50]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
push eax
mov eax, dword [ebp + 0xc]
push eax
call edx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
sub esi, dword [eax + 0x10]
lea ebx, [eax + 0x2c]
lea edi, [esp + 0x24]
call fcn.004268c0
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov edi, dword [esp + 0x28]
test edi, edi
mov ecx, dword [esp + 0x2c]
jne 0x426233
xor eax, eax
jmp 0x42623a
mov eax, ecx
sub eax, edi
sar eax, 2
cmp ebx, eax
jge 0x426262
test edi, edi
je 0x42624d
mov eax, ecx
sub eax, edi
sar eax, 2
cmp ebx, eax
jb 0x426253
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [edi + ebx*4]
mov eax, dword [ecx]
mov edx, dword [eax]
push esi
call edx
add ebx, 1
jmp 0x426227
test edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
je case.0x425f30.33
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov al, byte [esp + 0x17]
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x401
ja 0x426507
je 0x4264e6
cmp ebx, 0x200
jb case.0x425f30.33
cmp ebx, 0x202
jbe 0x4262f9
cmp ebx, 0x2a3
jne case.0x425f30.33
mov edi, dword [ebp + 8]
cmp byte [edi + 5], 0
je case.0x425f30.33
xor esi, esi
mov byte [edi + 0x14], 0
call fcn.00425d20
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x45f980], 0
je 0x42639f
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0xa0
mov dword [esp + 0x34], 0x35
mov dword [esp + 0x38], 0xeb
mov dword [esp + 0x3c], 0x49
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x42639f
cmp ebx, 0x200
jne 0x42635e
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x42639f
cmp ebx, 0x201
jne 0x42639f
lea eax, [esp + 0x14]
push eax
call fcn.00426710
mov ecx, dword [esp + 0x18]
add esp, 4
push 1
push 0
push ecx
push str.EXPLORER.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea eax, [esp + 0x14]
call fcn.0040c560
mov edi, dword [ebp + 8]
cmp byte [edi + 5], 0
je case.0x425f30.33
cmp ebx, 0x200
jne 0x4263ef
cmp byte [edi + 0x14], 0
jne 0x4263ef
mov edx, dword [edi]
mov byte [edi + 0x14], 1
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], 2
mov eax, dword [edx + 4]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov ebx, 0x2a1
mov eax, dword [ebp + 0x10]
movsx edx, ax
shr eax, 0x10
movsx eax, ax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [edi + 0x50]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
call fcn.00423660
mov esi, eax
call fcn.00425d20
test al, al
je 0x426420
mov ebx, 0x2a1
cmp byte [esi + 5], 0
je case.0x425f30.33
cmp ebx, 0x2a1
jne 0x426459
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call edx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x200
jne 0x426488
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call edx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x201
jne 0x4264b7
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call edx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x202
jne case.0x425f30.33
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call edx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
call fcn.00425bc0
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x402
je 0x426554
cmp ebx, 0x2b11
jne case.0x425f30.33
mov esi, dword [ebp + 8]
cmp dword [esi + 0x50], 0
je case.0x425f30.33
mov eax, esi
call fcn.004259a0
test eax, eax
je case.0x425f30.33
mov eax, esi
call fcn.004259a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x44]
call eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x426574
push 0x27c
push 0x450b38
push str.host____NULL
call dword [sym.imp.MSVCR80.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x30]
test eax, eax
lea edi, [esi + 0x2c]
je 0x42659d
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
je 0x42659d
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, edi
call fcn.00426ad0
mov ecx, dword [esi]
mov dword [ecx + 0x24], 0
mov edx, dword [esi]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
mov dword [esi], 0
call fcn.00425380
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [0x45f978], 0
jne 0x4265d9
cmp dword [0x45f97c], 0
je 0x4265e1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10