Function at 0x42b210
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x45b03b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x76c
push ebx
push ebp
push esi
lea eax, [esp + 0x178]
push edi
push eax
push 0x200
push 0
mov esi, ecx
push 0
push 0xff
push 0xf6
mov ecx, dword [esi + 0x18]
push 0x51
push 0xf8
push ecx
call fcn.0044bd90
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x24
push 0x3e8
call ebp
lea edx, [esp + 0x17c]
mov eax, dword [esi + 0x18]
push edx
push 0x200
push 0
push 0
push 0
push 0xf6
push 0x51
push 0xf8
push eax
call fcn.0044bd90
mov ebx, dword [esp + 0x7b4]
lea ecx, [esp + 0x1a0]
mov eax, dword [esi + 0x18]
push ecx
mov edx, ebx
push 0x200
push 0
and edx, 0xff
push 0
push edx
push 0
push 0x80
push 0xfa
push eax
call fcn.0044bd90
add esp, 0x48
push 0x3e8
call ebp
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x37d]
mov byte [esp + 0x37c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3e8
stosb byte es:[edi], al
call ebp
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0x30]
push 0
push ecx
lea edx, [esp + 0x384]
push 0x400
push edx
push 0
push 0
push 0x7400c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebp, eax
test ebp, ebp
jne 0x42b340
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x24]
push 0x48d780
push ecx
mov dword [esp + 0x2c], 0x91f00
call sub.MSVCRT.dll__CxxThrowException
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x34]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
mov ecx, 0x41
lea edi, [esp + 0x78]
mov dword [esp + 0x18], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], edx
push 0x4970cc
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
mov word [esp + 0x68], ax
mov dword [esp + 0x24], edx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 8]
cmp bl, 0x20
mov dword [esp + 0x784], 0
jne 0x42b3a8
mov ecx, dword [eax + 0xe8]
jmp 0x42b3ae
mov ecx, dword [eax + 0xec]
push ecx
lea edx, [esp + 0x14]
push str.__s_
push edx
call sub.MFC42.DLL_CString::Format
mov edi, dword [esp + 0x1c]
add esp, 0xc
mov esi, 0x4970cc
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42b3f4
test cl, cl
je 0x42b3f0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42b3f4
add eax, 2
add esi, 2
test cl, cl
jne 0x42b3cc
xor eax, eax
jmp 0x42b3f9
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
test eax, eax
je 0x42b432
movsx edx, byte [esp + 0x78c]
push edi
push str._FS:NTFS__Q__V:
push edx
push str.FC_fmt
lea eax, [esp + 0x88]
push str._s__c:__s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
jmp 0x42b45b
movsx ecx, byte [esp + 0x78c]
push str._FS:NTFS__Q
push ecx
push str.FC_fmt
lea edx, [esp + 0x84]
push str._s__c:__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
lea edx, [esp + 0x94]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42b492
call esi
xor ebp, ebp
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x42b4a8
call esi
xor ebp, ebp
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42b4c0
call esi
xor ebp, ebp
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
test ebp, ebp
jne 0x42b4ef
lea edx, [esp + 0x28]
push 0x48d780
push edx
mov dword [esp + 0x30], 0x91f00
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [esp + 0x10]
mov dword [esp + 0x784], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x77c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x778
ret 8