Function at 0x42cd0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a3bef
mov eax, dword fs:[0]
push eax
sub esp, 0x3d8
mov eax, dword [0x4dc0a8]
xor eax, esp
mov dword [esp + 0x3d0], eax
push ebx
push esi
push edi
mov eax, dword [0x4dc0a8]
xor eax, esp
push eax
lea eax, [esp + 0x3e8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], 0
je 0x42cd6e
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edi, eax
jmp 0x42cd70
xor edi, edi
test edi, edi
je 0x42d337
push edi
lea esi, [esp + 0x6c]
call fcn.0043179a
and dword [esp + 0x3f0], 0
push dword [eax]
lea ecx, [esp + 0x2f8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x6c]
mov byte [esp + 0x3f0], 2
cmp dword [esp + 0x68], eax
je 0x42cdb6
push dword [esp + 0x68]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea ecx, [esp + 0x364]
call fcn.00483680
push 0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3f4], 3
call fcn.00481480
mov byte [esp + 0x3f0], 4
cmp dword [esp + 0x30c], 0x10
mov eax, dword [esp + 0x2f8]
jae 0x42cdf5
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 1
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x370]
mov byte [esp + 0x3fc], 5
call fcn.00485240
mov bl, al
neg bl
sbb bl, bl
lea ecx, [esp + 0x4c]
inc bl
mov byte [esp + 0x3f0], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
test bl, bl
je 0x42ce8f
cmp dword [0x4e0da8], 0
je 0x42d2fd
push edi
push str.parse_error:
push 0x4b3fb8
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x4b3f84
lea eax, [esp + 0x28]
push eax
push 0x4b3f80
push ecx
mov dword [esp + 0x34], 0x3de
call fcn.00422cfe
add esp, 4
call fcn.00422d46
call fcn.00422d6f
call fcn.00422d46
jmp 0x42d2e2
lea ecx, [esp + 0x2c]
call fcn.00480210
test al, al
jne 0x42d2a4
lea ecx, [esp + 0x2c]
call fcn.00480260
test al, al
je 0x42d2a4
lea eax, [esp + 0x348]
push eax
push 0x4aec7c
lea ecx, [esp + 0x34]
call fcn.00482630
mov ecx, eax
call fcn.00480080
lea eax, [esp + 0x310]
push eax
push str.eventid
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 6
call fcn.00482630
mov ecx, eax
call fcn.00480080
lea eax, [esp + 0x32c]
push eax
push str.content
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 7
call fcn.00482630
mov ecx, eax
call fcn.00480080
mov byte [esp + 0x3f0], 8
cmp dword [esp + 0x328], 0x10
mov eax, dword [esp + 0x314]
jae 0x42cf38
lea eax, [esp + 0x314]
mov esi, 0xfde9
push esi
push eax
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x1fc]
push eax
mov dword [esp + 0x1fc], ecx
call fcn.00405167
mov byte [esp + 0x3f0], 9
push dword [esp + 0x1f0]
lea eax, [esp + 0x28]
push eax
call fcn.00405f0e
lea eax, [esp + 0x1f4]
mov byte [esp + 0x3f0], 0xb
cmp dword [esp + 0x1f0], eax
je 0x42cf99
push dword [esp + 0x1f0]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ecx, dword [esp + 0x14]
add ecx, 0x3d4
mov eax, dword [ecx]
lea edx, [esp + 0x24]
push edx
call dword [eax + 0x10]
cmp dword [esp + 0x344], 0x10
mov eax, dword [esp + 0x330]
jae 0x42cfc5
lea eax, [esp + 0x330]
push esi
push eax
lea eax, [esp + 0xf4]
lea ecx, [esp + 0xf8]
push eax
mov dword [esp + 0xf8], ecx
call fcn.00405167
mov byte [esp + 0x3f0], 0xc
push dword [esp + 0xec]
lea eax, [esp + 0x1c]
push eax
call fcn.00405f0e
lea eax, [esp + 0xf0]
mov byte [esp + 0x3f0], 0xe
cmp dword [esp + 0xec], eax
je 0x42d021
push dword [esp + 0xec]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jne 0x42d0e4
cmp dword [0x4e0da8], 0
je 0x42d088
push str.commandline_is_empty
push 0x4b3fb8
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x4b3f84
lea eax, [esp + 0x24]
push eax
push 0x4b3f80
mov dword [esp + 0x2c], 0x3f2
call fcn.00422cfe
call fcn.00422d46
call fcn.00422d6f
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.004012f9
lea ecx, [esp + 0x32c]
mov byte [esp + 0x3f0], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x310]
mov byte [esp + 0x3f0], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x348]
mov byte [esp + 0x3f0], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x42d2fd
xor ebx, ebx
lea ecx, [esp + 0x1c]
call fcn.00467016
mov byte [esp + 0x3f0], 0xf
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], ebx
jne 0x42d169
cmp dword [0x4e0da8], ebx
je 0x42d158
push str.modulepath_is_empty
push 0x4b3fb8
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x4b3f84
lea eax, [esp + 0x24]
push eax
push 0x4b3f80
mov dword [esp + 0x2c], 0x3f9
call fcn.00422cfe
call fcn.00422d46
call fcn.00422d6f
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x42d088
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00478676
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x400], 0x10
call fcn.004786d9
add esp, 0x10
mov byte [esp + 0x3f0], 0x11
mov eax, dword [esp + 0x20]
push dword [eax - 0xc]
push eax
lea eax, [esp + 0x24]
call fcn.0040600b
push 1
push ebx
push dword [esp + 0x30]
push dword [esp + 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x4e0da8], ebx
cdq
mov dword [esp + 0x44], eax
mov edi, edx
je 0x42d26f
cmp edi, ebx
jl 0x42d1e7
jg 0x42d1e0
cmp eax, 0x20
jbe 0x42d1e7
mov byte [esp + 0x13], 1
jmp 0x42d1eb
mov byte [esp + 0x13], bl
lea eax, [esp + 0x13]
push eax
push str.___result:
push dword [esp + 0x30]
lea eax, [esp + 0x20]
push 0x4aede0
push dword [esp + 0x2c]
mov dword [esp + 0x28], 0x403
push str.ShellExecute_
push 0x4b3fb8
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x4b3f84
push eax
push 0x4b3f80
push ecx
call fcn.00422cfe
add esp, 4
call fcn.00422d46
call fcn.00422d6f
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00431707
mov esi, eax
call fcn.00422d9a
cmp edi, ebx
jl 0x42d283
jg 0x42d27c
cmp dword [esp + 0x44], 0x20
jbe 0x42d283
mov byte [esp + 0x13], 1
jmp 0x42d287
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x42d158
cmp dword [0x4e0da8], 0
je 0x42d2fd
push str.root_is_null
push 0x4b3fb8
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x4b3f84
lea eax, [esp + 0x24]
push eax
push 0x4b3f80
mov dword [esp + 0x2c], 0x3e4
call fcn.00422cfe
call fcn.00422d46
call fcn.00422d6f
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3f0], 3
call fcn.00481660
lea ecx, [esp + 0x364]
mov byte [esp + 0x3f0], 2
call fcn.00421ee6
or dword [esp + 0x3f0], 0xffffffff
lea ecx, [esp + 0x2f4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x3f0], 0x12
cmp byte [esp + 0x13], al
setne al
push eax
push 0x4b44d0
lea eax, [esp + 0x28]
call fcn.00401a22
mov eax, dword [esp + 0x48]
test eax, eax
mov esi, dword [esp + 0x28]
pop ecx
pop ecx
je 0x42d383
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
lea eax, [esi - 0x10]
call fcn.004012f9
mov ecx, dword [esp + 0x3e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3d0]
xor ecx, esp
call fcn.00486d86
mov esp, ebp
pop ebp
ret 0xc