Function at 0x67c850
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a528
mov eax, dword [ebp - 8]
call fcn.0040a528
xor eax, eax
push ebp
push 0x67ca7b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0067cb74
test al, al
je 0x67c8ba
push 0x67ca8c
call sub.kernel32.dll_GetModuleHandleW
mov dword [ebp - 0x10], eax
push 0x67caa8
mov eax, dword [ebp - 0x10]
push eax
call fcn.00416978
mov dword [ebp - 0x14], eax
push 0x67cae4
mov eax, dword [ebp - 0x10]
push eax
call fcn.00416978
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0x67cb24
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x67c92e
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407d4c
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov eax, 0x67cb34
mov dword [ebp - 0x48], eax
mov eax, 0x67cb3c
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x54]
push eax
call sub.shell32.dll_ShellExecuteExA
push 0xc8
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_WaitForInputIdle
push 0
push 0x67cb24
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_ShowWindow
push 0
push 0x67cb48
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push esi
call sub.user32.dll_SetForegroundWindow
mov ebx, 0x1e
push 0
push 0x25
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
dec ebx
test ebx, ebx
jne 0x67c958
push 0x19
call sub.kernel32.dll_Sleep
push 0
push 0x27
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
push 0x19
call sub.kernel32.dll_Sleep
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x67c998
mov eax, dword [eax - 4]
lea edi, [eax + 1]
mov eax, dword [ebp - 4]
movzx eax, word [eax + ebx*2 - 2]
cmp ax, 0x5c
jne 0x67c9c1
push 0
push 0x27
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
push 0x19
call sub.kernel32.dll_Sleep
jmp 0x67c9d2
push 0
movzx eax, ax
push eax
push 0x102
push esi
call sub.user32.dll_SendMessageA
inc ebx
cmp edi, ebx
jne 0x67c99b
push 0
push 0x67cb58
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FindWindowExW
mov esi, eax
push esi
call sub.user32.dll_SetForegroundWindow
mov edi, dword [ebp - 8]
mov eax, edi
test eax, eax
je 0x67c9fd
mov eax, dword [eax - 4]
test eax, eax
je 0x67ca45
push 0
push 0x28
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageW
push 0x1f4
call sub.kernel32.dll_Sleep
mov ebx, 1
mov eax, edi
test eax, eax
je 0x67ca28
mov eax, dword [eax - 4]
mov edi, eax
push 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + ebx*2 - 2]
push eax
push 0x102
push esi
call sub.user32.dll_SendMessageW
inc ebx
cmp edi, ebx
jne 0x67ca2a
call fcn.0067cb74
test al, al
je 0x67ca5e
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67ca82
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a494
pop eax
jmp eax