Function at 0x423d93
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a1dce
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4d04c0]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
push esi
push edi
mov eax, dword [0x4d04c0]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x108]
mov ebx, ecx
cmp eax, dword [ebx + 0x77c]
jne 0x42404e
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_1
call fcn.00414401
mov eax, dword [ebx + 0x8c4]
xor edi, edi
inc edi
pop ecx
pop ecx
cmp eax, edi
jne 0x423f01
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_1.1
call fcn.00414401
mov eax, dword [ebx + 0x8cc]
pop ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.00402162
add eax, 0x10
mov dword [edi], eax
push dword [ebx + 0x8c8]
call fcn.00422002
pop ecx
pop ecx
test eax, eax
jne 0x423edf
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_1.2
call fcn.00414401
pop ecx
pop ecx
push 0x40
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push str.Information
push eax
call fcn.004025df
and dword [esp + 0xe8], 0
push ecx
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.tipmsg_close
push eax
call fcn.004025df
push edi
push dword [ebx + 0x890]
call fcn.0040d934
or dword [esp + 0xec], 0xffffffff
xor eax, eax
inc eax
mov ecx, ebx
call fcn.00427fc1
cmp eax, 1
je 0x423edf
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_1.3
call fcn.00414401
pop ecx
pop ecx
jmp 0x4246fd
push 3
pop esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.closetype
call fcn.004029c1
mov ecx, esi
call fcn.00416bf1
jmp 0x42402f
cmp eax, 3
jne 0x42402f
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_2
call fcn.00414401
mov eax, dword [0x4d001c]
pop ecx
pop ecx
mov ecx, 0x4d001c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0xe0], edi
push dword [ebx + 0x8d0]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push str.tipmsg_close2
push eax
call fcn.004025df
lea eax, [esp + 0x24]
push eax
push dword [ebx + 0x890]
call fcn.0040d934
mov byte [esp + 0xe4], 2
push dword [eax]
lea eax, [esp + 0x20]
call fcn.00404705
mov byte [esp + 0xe8], 1
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00402a23
push 0x40
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push str.Information
push eax
call fcn.004025df
mov byte [esp + 0xe8], 3
mov edi, dword [esp + 0x20]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x28], esp
mov eax, edi
mov dword [esp + 0x28], esp
call fcn.00402162
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
xor eax, eax
inc eax
mov ecx, ebx
mov byte [esp + 0xec], 1
call fcn.00427fc1
cmp eax, 1
je 0x423ff8
call esi
push eax
push str._INFO___d___OnClick_2.1
mov ecx, dword [0x4d4770]
call fcn.00414401
pop ecx
pop ecx
mov eax, edi
jmp 0x4246f8
mov ecx, dword [ebx + 0x88c]
call fcn.0041f2de
push 4
pop esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.closetype
call fcn.004029c1
mov ecx, esi
call fcn.00416bf1
or dword [esp + 0xe0], 0xffffffff
mov eax, edi
call fcn.00402a23
push 1
xor esi, esi
push esi
mov ecx, ebx
call fcn.00431085
push esi
push esi
push 0x81bc
mov ecx, ebx
call fcn.004313fd
jmp 0x4246fd
cmp eax, dword [ebx + 0x78c]
je 0x42439b
cmp eax, dword [ebx + 0x794]
jne 0x424078
mov ecx, dword [ebx + 0x78c]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
jne 0x42439b
mov eax, dword [esi + 0x108]
cmp eax, dword [ebx + 0x7b4]
je 0x42434f
cmp eax, dword [ebx + 0x7b8]
je 0x42434f
cmp eax, dword [ebx + 0x7bc]
je 0x42434f
cmp eax, dword [ebx + 0x7b0]
jne 0x4240ed
cmp dword [ebx + 0x87c], 0x240
jne 0x4240d0
cmp dword [ebx + 0x880], 2
jne 0x4240d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___OnClick_5.1
jmp 0x424387
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_5.2
call fcn.00414401
pop ecx
pop ecx
push 2
jmp 0x424136
cmp eax, dword [ebx + 0x7ac]
jne 0x424142
cmp dword [ebx + 0x87c], 0x240
jne 0x42411b
cmp dword [ebx + 0x880], 3
jne 0x42411b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___OnClick_6.1
jmp 0x424387
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_6.2
call fcn.00414401
pop ecx
pop ecx
push 3
mov esi, ebx
call fcn.00426518
jmp 0x4246fd
cmp eax, dword [ebx + 0x7c8]
jne 0x42416f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_7
call fcn.00414401
pop ecx
pop ecx
mov esi, ebx
call fcn.00423ca2
jmp 0x4246fd
cmp eax, dword [ebx + 0x7e0]
je 0x42432a
cmp eax, dword [ebx + 0x780]
je 0x42432a
cmp eax, dword [ebx + 0x790]
je 0x4241b1
cmp eax, dword [ebx + 0x798]
jne 0x4246fd
mov ecx, dword [ebx + 0x790]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x4246fd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_9
call fcn.00414401
pop ecx
pop ecx
mov ecx, dword [ebx + 0x790]
mov eax, dword [ecx]
push 0
call dword [eax + 0x110]
push 1
push 0
mov ecx, ebx
call fcn.00431085
mov eax, ebx
call fcn.00428155
mov esi, dword [ebx + 0x88c]
lea eax, [esi + 0x2dc]
cmp dword [eax + 0x14], 8
jb 0x424200
mov eax, dword [eax]
push eax
call fcn.0047a8f4
mov esi, dword [esi + 0x68c]
mov edi, dword [esi]
pop ecx
jmp 0x424218
cmp dword [edi + 8], eax
je 0x424267
mov edi, dword [edi]
cmp esi, edi
jne 0x424211
xor al, al
xor esi, esi
test al, al
je 0x424248
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_9.1
call fcn.00414401
pop ecx
pop ecx
mov ecx, dword [ebx + 0x88c]
call fcn.0041f2de
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.closetype
call fcn.004029c1
mov ecx, esi
call fcn.00416bf1
jmp 0x42403b
lea eax, [edi + 0x14c]
push eax
lea esi, [esp + 0x2c]
call fcn.00402109
xor esi, esi
mov dword [esp + 0xe0], 0xd
cmp dword [esp + 0x38], esi
jbe 0x42429d
cmp dword [esp + 0x3c], 8
jb 0x424297
mov ecx, dword [esp + 0x28]
jmp 0x42429f
lea ecx, [esp + 0x28]
jmp 0x42429f
xor ecx, ecx
lea eax, [edi + 0x1d8]
cmp dword [eax + 0x14], 8
jb 0x4242ad
mov eax, dword [eax]
add edi, 0x210
cmp dword [edi + 0x14], 8
jb 0x4242bb
mov edi, dword [edi]
push 1
push eax
push ecx
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
mov edi, eax
call fcn.0047a88d
pop ecx
push edx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.prodstarttime
call fcn.004029c1
call fcn.00416cd3
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.prodstartcode
call fcn.004029c1
mov ecx, edi
call fcn.00416bf1
cmp edi, 0x20
push esi
setg byte [esp + 0x27]
or dword [esp + 0xe4], 0xffffffff
push 1
lea ecx, [esp + 0x30]
call fcn.00402a5a
mov al, byte [esp + 0x23]
jmp 0x424220
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_8
call fcn.00414401
pop ecx
pop ecx
mov esi, ebx
call fcn.00424723
jmp 0x4246fd
cmp dword [ebx + 0x87c], 0x218
je 0x42437b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_4.1
call fcn.00414401
pop ecx
pop ecx
push 1
jmp 0x424136
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___OnClick_4.2
mov ecx, dword [0x4d4770]
call fcn.00414401
pop ecx
pop ecx
push 0
jmp 0x424136
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_3
call fcn.00414401
mov eax, dword [ebx + 0x8cc]
pop ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.00402162
add eax, 0x10
mov dword [edi], eax
push dword [ebx + 0x8c8]
call fcn.00422002
pop ecx
pop ecx
test eax, eax
je 0x4244cb
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_3.1
call fcn.00414401
mov eax, dword [0x4d001c]
pop ecx
pop ecx
mov ecx, 0x4d001c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0xe4], 4
mov eax, esp
mov dword [esp + 0x18], esp
push str.tipmsg_installed
push eax
call fcn.004025df
lea eax, [esp + 0x18]
push eax
push dword [ebx + 0x890]
call fcn.0040d934
lea edi, [esp + 0x1c]
mov byte [esp + 0xe0], 5
call fcn.00401dea
mov byte [esp + 0xe0], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00402a23
push 0x40
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.Information
push eax
call fcn.004025df
mov byte [esp + 0xe8], 6
mov edi, dword [esp + 0x24]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x20], esp
mov eax, edi
mov dword [esp + 0x20], esp
call fcn.00402162
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
xor eax, eax
inc eax
mov ecx, ebx
mov byte [esp + 0xec], 4
call fcn.00427fc1
cmp eax, 1
je 0x4244bc
call esi
push eax
push str._INFO___d___OnClick_3.2
jmp 0x423fe4
or dword [esp + 0xe0], 0xffffffff
mov eax, edi
call fcn.00402a23
mov ecx, dword [ebx + 0x7a4]
call fcn.00436b89
test al, al
jne 0x4244ef
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_3.3
call fcn.00414401
pop ecx
pop ecx
mov ecx, dword [ebx + 0x7a4]
push 1
call fcn.00436b75
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
mov edi, 0x4bca30
push edi
mov byte [0x4d4858], 1
call fcn.004029c1
sub esp, 0x1c
mov dword [esp + 0x118], 7
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.isjoinexp
call fcn.004029c1
or dword [esp + 0x118], 0xffffffff
call fcn.00416b8a
mov ecx, dword [ebx + 0x88c]
add ecx, 0x538
push edi
call fcn.0040299a
mov ecx, dword [ebx + 0x7c4]
mov eax, dword [ecx]
lea edx, [esp + 0x44]
push edx
call dword [eax + 0x28]
mov ecx, eax
mov dword [esp + 0xe0], 8
call fcn.00428e17
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004025df
lea ecx, [esp + 0x44]
mov byte [esp + 0xe0], 0xa
call fcn.00428e6d
lea eax, [esp + 0x18]
call fcn.00401f04
call fcn.00401f55
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x4246e1
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
call fcn.00402162
add eax, 0x10
mov dword [edi], eax
call fcn.00422fb7
pop ecx
test al, al
jne 0x42463a
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_3.4
call fcn.00414401
pop ecx
pop ecx
push 0x10
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.Error
push eax
xor esi, esi
call fcn.004025df
push ecx
mov edi, esp
mov byte [esp + 0xec], 0xb
mov dword [esp + 0x20], esp
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push str.errmsg_pathnoexist
push eax
call fcn.004025df
push edi
push dword [ebx + 0x890]
call fcn.0040d934
mov eax, esi
mov ecx, ebx
mov byte [esp + 0xec], 0xa
call fcn.00427fc1
jmp 0x4246f1
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x4246e1
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_3.5
call fcn.00414401
push 0x5c
push dword [esp + 0x24]
call fcn.0047b140
mov ecx, dword [esp + 0x28]
add esp, 0x10
test eax, eax
jne 0x424676
or eax, 0xffffffff
jmp 0x42467a
sub eax, ecx
sar eax, 1
mov ecx, dword [ecx - 0xc]
dec ecx
cmp eax, ecx
je 0x4246cc
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___OnClick_3.6
call fcn.00414401
lea eax, [esp + 0x1c]
push 0x4bae2c
push eax
lea edi, [esp + 0x28]
call fcn.00404174
add esp, 0x10
mov byte [esp + 0xe0], 0xc
call fcn.00401dea
mov byte [esp + 0xe0], 0xa
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00402a23
mov ecx, dword [ebx + 0x88c]
push dword [esp + 0x18]
add ecx, 0x570
call fcn.0040299a
push 0
push 0
push 0x8065
mov ecx, ebx
call fcn.004313fd
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00402a23
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0047a0fb
mov esp, ebp
pop ebp
ret 4