Function at 0x421686
Capabilities:
Create process on windows

Disassembly:
push 0x74
mov eax, 0x43b099
call fcn.00438b46
mov dword [ebp - 0x44], edx
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00405d09
test al, al
jne 0x421933
call fcn.00401891
mov esi, eax
cmp esi, 0x10000
jae 0x421933
push 0x3c
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00424db0
add esp, 0xc
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x1c0
cmp byte [ebp + 0x20], bl
je 0x4216e8
mov dword [ebp - 0x7c], 0x5c0
push ebx
lea ecx, [ebp + 8]
call fcn.00402374
push 0x22
pop ecx
cmp word [eax], cx
jne 0x421703
push 1
lea ecx, [ebp + 8]
call fcn.00402374
mov dword [ebp - 0x70], eax
mov edx, ebx
test esi, esi
je 0x421775
push edx
lea ecx, [ebp + 8]
call fcn.00402374
push 0x22
pop ecx
cmp word [eax], cx
jne 0x421748
lea ecx, [ebp + 8]
inc edx
call fcn.00401891
mov esi, eax
jmp 0x42173c
push edx
lea ecx, [ebp + 8]
call fcn.00402374
push 0x22
pop ecx
cmp word [eax], cx
je 0x421742
inc edx
cmp edx, esi
jb 0x42172a
jmp 0x421748
push 0x20
pop ecx
mov word [eax], cx
push edx
lea ecx, [ebp + 8]
call fcn.00402374
push 0x20
pop ecx
inc edx
cmp word [eax], cx
je 0x4217a0
push edx
lea ecx, [ebp + 8]
call fcn.00402374
cmp word [eax], 0x2f
je 0x4217a5
lea ecx, [ebp + 8]
call fcn.00401891
cmp edx, eax
jb 0x42170c
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x421781
cmp word [eax], bx
jne 0x4217b3
mov bh, byte [ebp + 0x20]
test bh, bh
jne 0x4217b6
mov ecx, 0x44a9d8
call fcn.00405d09
test al, al
jne 0x4217b6
call fcn.0040126f
mov dword [ebp - 0x6c], eax
jmp 0x4217b6
xor ecx, ecx
mov word [eax], cx
push edx
lea ecx, [ebp + 8]
call fcn.00402374
mov dword [ebp - 0x6c], eax
jmp 0x421778
mov bh, byte [ebp + 0x20]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
call fcn.00410e87
mov esi, eax
test esi, esi
je 0x4217e1
mov edx, str..inf
mov ecx, esi
call fcn.00418a10
test eax, eax
jne 0x4217e1
mov dword [ebp - 0x74], str.Install
push dword [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00401d16
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040f2f4
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00401e5c
lea ecx, [ebp - 0x40]
call fcn.004021e6
mov byte [ebp - 4], 2
test bl, bl
je 0x42183f
push dword [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00401d16
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00411480
lea ecx, [ebp - 0x28]
call fcn.00401e5c
lea ecx, [ebp - 0x40]
call fcn.0040126f
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42192b
cmp byte [0x44a998], 0
jne 0x421866
test bh, bh
jne 0x421866
cmp byte [0x44a972], bh
je 0x4218d4
test edi, edi
je 0x421883
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
xor ebx, ebx
test eax, eax
je 0x421885
push ebx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov bl, 1
jmp 0x421885
xor ebx, ebx
push 0x7d0
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0x48]
call fcn.00421943
cmp byte [0x44a972], 0
je 0x4218d6
cmp byte [ebp + 0x20], 0
jne 0x4218d6
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4218d6
mov eax, dword [ebp - 0x44]
cmp eax, dword [0x44aeac]
jbe 0x4218cb
mov dword [0x44aeac], eax
mov byte [0x44a973], 1
jmp 0x4218d6
xor ebx, ebx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4218f3
mov edx, str..exe
mov ecx, esi
call fcn.00418a10
test eax, eax
je 0x421917
cmp byte [0x44a998], 0
mov al, byte [ebp + 0x20]
je 0x42191a
test al, al
jne 0x42191a
cmp byte [0x44a972], al
jne 0x42191a
mov dword [0x44aec8], 0x1b58
jmp 0x42191a
mov al, byte [ebp + 0x20]
test bl, bl
je 0x42192b
test al, al
je 0x42192b
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x40]
call fcn.00401e5c
lea ecx, [ebp + 8]
call fcn.00401e5c
call fcn.00438af5
ret 0x1c