Function at 0x42ac10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520006
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x57146c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 0x1c], 0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x22c], eax
jne 0x42b367
mov esi, dword [edi + 0x28]
push 0
push eax
push ecx
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0042a470
mov dword [edi + 0x28], esi
test eax, eax
jne 0x42acca
mov eax, dword [ebp + 0xc]
cmp eax, 0x47
jne 0x42acd4
lea eax, [ebp - 0x228]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x228], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x224]
lea ecx, [edi + 0xa8]
add eax, 0xfb
push eax
mov eax, dword [ebp - 0x228]
add eax, 0x48
push eax
call fcn.0041ede0
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], 0
mov eax, 1
jmp 0x42b369
cmp eax, 0x8c8d
jne 0x42ad0b
cmp dword [edi + 0x78], 0
je 0x42acf5
push ebx
push str.Progress:__d
call fcn.004264e0
add esp, 8
mov dword [edi + 0x198], ebx
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
cmp eax, 0x464
jne 0x42ad3e
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
push dword [ebp - 0x234]
push ebx
push 0x464
call fcn.00428d60
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
cmp eax, 0x1400
jne 0x42ada6
call fcn.00421ca0
mov ecx, eax
call fcn.00418f60
test eax, eax
jne 0x42acbe
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x42ad73
push 9
push dword [edi + 4]
call esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42ad87
push 5
push dword [edi + 4]
call esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
cmp eax, 0xbc3
jne 0x42add3
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
mov ecx, edi
call fcn.00428640
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
cmp eax, 0x21
jne 0x42ae08
push dword [edi + 4]
mov dword [edi + 0x70], 1
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], 0
cmp dword [edi + 0x70], 0
je 0x42b367
mov eax, 1
jmp 0x42b369
cmp eax, 0x111
jne 0x42b30a
movzx ecx, bx
mov eax, 0x3f1
cmp ax, cx
jne 0x42aef5
lea eax, [ebp - 0x230]
push eax
lea ecx, [edi + 0xa8]
call fcn.0041de40
mov eax, dword [ebp - 0x230]
mov dword [ebp - 4], 0
cmp dword [eax - 4], 1
jle 0x42ae5d
push dword [eax - 0xc]
lea ecx, [ebp - 0x230]
call fcn.00405730
mov eax, dword [ebp - 0x230]
push eax
push dword [edi + 4]
lea eax, [ebp - 0x234]
push eax
lea ecx, [edi + 0x84]
call fcn.004260c0
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 0
je 0x42ae9b
lea eax, [ebp - 0x234]
push eax
lea ecx, [edi + 0xa8]
call fcn.0041edb0
mov eax, dword [ebp - 0x234]
or esi, 0xffffffff
mov byte [ebp - 4], 0
lea edx, [eax - 0x10]
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42aeb9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x42acbe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
mov eax, 0x3e8
cmp ax, cx
jne 0x42af1a
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
push 0x3e8
push ebx
jmp 0x42adba
mov eax, 0x3eb
cmp ax, cx
jne 0x42af3f
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
push 0x3eb
push ebx
jmp 0x42adba
mov eax, 0x3f2
cmp ax, cx
jne 0x42af78
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
mov ecx, edi
push 0x3f2
push ebx
call fcn.004284a0
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
mov eax, 0x3ea
cmp ax, cx
jne 0x42afb1
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
mov ecx, edi
push 0x3ea
push ebx
call fcn.004284a0
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
mov eax, 0x3f3
cmp ax, cx
jne 0x42afea
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
mov ecx, edi
push 0x3f3
push ebx
call fcn.004284a0
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
mov eax, 0x3f4
cmp ax, cx
jne 0x42b023
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
mov ecx, edi
push 0x3f4
push ebx
call fcn.004284a0
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
mov eax, 0x3f5
cmp ax, cx
jne 0x42b058
push 0
push 0xf020
push 0x112
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
mov eax, 0x3f6
cmp ax, cx
jne 0x42b0cc
push 1
call fcn.00421ca0
mov ecx, eax
call fcn.0041a290
push 1
call fcn.00421ca0
mov ecx, eax
call fcn.0041a140
push 0
call fcn.00421ca0
mov ecx, eax
call fcn.0041a690
push 0
call fcn.00421ca0
mov ecx, eax
call fcn.0041a680
push 1
call fcn.00421ca0
mov ecx, eax
call fcn.0041a6a0
mov eax, dword [edi + 0xa0]
lea ecx, [edi + 0xa0]
call dword [eax]
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
mov eax, 0x3f7
cmp ax, cx
jne 0x42b0e6
push 1
call fcn.00421ca0
mov ecx, eax
call fcn.0041a2b0
jmp 0x42b0a8
mov eax, 0x400
cmp ax, cx
jne 0x42b191
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a7120
add esp, 0xc
lea eax, [ebp - 0x238]
lea ecx, [edi + 0x84]
push eax
call fcn.00425ec0
push 0x52ee4c
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x238]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42b14e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xffffffffffffffff
push 0
push 0
push 1
push 1
push 0x52ec54
lea eax, [ebp - 0x218]
push eax
call fcn.00433290
push 0
push 2
push 0x464
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
mov eax, 0x3ec
cmp ax, cx
jne 0x42b1ca
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
mov ecx, edi
push 0x3ec
push ebx
call fcn.00428c20
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
mov eax, 0x3ed
cmp ax, cx
jne 0x42b203
lea eax, [ebp - 0x230]
shr ebx, 0x10
push eax
push dword [ebp - 0x234]
mov ecx, edi
push 0x3ed
push ebx
call fcn.00428c20
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov eax, 1
jmp 0x42b369
mov eax, 0x3ee
cmp ax, cx
jne 0x42b23b
push 4
push 0
push 0
push str.http:__www.halopet.cn_pets_agreement.html
push 0x52f464
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
mov eax, 0x3ef
cmp ax, cx
je 0x42b20d
mov eax, 0x3fb
cmp ax, cx
je 0x42acbe
mov eax, 0x3f9
cmp ax, cx
jne 0x42b27a
mov ecx, edi
call fcn.00427050
mov ecx, dword [ebp - 0x22c]
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
lea eax, [ecx - 0x401]
cmp ax, 1
ja 0x42b367
mov esi, ecx
mov ecx, dword [edi + 0x74]
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0xf0]
test eax, eax
je 0x42b0b6
mov ecx, 0x401
cmp si, cx
jne 0x42b2d5
mov ecx, eax
call fcn.004753d0
test eax, eax
setne bl
call fcn.00421ca0
mov ecx, dword [ebp - 0x22c]
mov byte [eax + 0x44], bl
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
mov ecx, 0x402
cmp si, cx
jne 0x42b0b6
mov ecx, eax
call fcn.004753d0
test eax, eax
setne bl
call fcn.00421ca0
mov ecx, dword [ebp - 0x22c]
mov byte [eax + 0x45], bl
mov eax, 1
mov dword [ecx], 0
jmp 0x42b369
cmp eax, 0x112
jne 0x42b367
mov dword [edi + 0x70], 1
cmp ebx, 0xf120
jne 0x42b335
mov eax, dword [edi + 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x108]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42b351
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], 0
cmp dword [edi + 0x70], 0
jne 0x42acca
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477d68
mov esp, ebp
pop ebp
ret 0x18