Function at 0x42f670
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x51e73a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, ecx
mov eax, dword [ebx + 0x1504]
mov ecx, dword [ebx + 0x1508]
cmp eax, ecx
push esi
push edi
je 0x42f6b4
mov edx, dword [ebp + 4]
cmp dword [eax], edx
je 0x42f6b0
add eax, 0x4c
cmp eax, ecx
jne 0x42f6a5
cmp eax, ecx
jne 0x42f6c2
lea ecx, [ebp + 4]
lea eax, [ebx + 0x1500]
call fcn.00450de0
mov edx, dword [ebp + 4]
cmp edx, 0x14
jl 0x42f7e3
mov eax, dword [ebx + 0x1524]
mov ecx, dword [ebx + 0x1528]
cmp eax, ecx
je 0x42f6f0
mov edi, edi
cmp dword [eax], edx
je 0x42f6ed
add eax, 8
cmp eax, ecx
jne 0x42f6e0
jmp 0x42f6f0
inc dword [eax + 4]
cmp eax, dword [ebx + 0x1528]
jne 0x42f7ca
mov eax, dword [ebx + 0x1524]
test eax, eax
mov edi, dword [ebp + 4]
lea esi, [ebx + 0x1520]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 1
jne 0x42f71f
xor edx, edx
jmp 0x42f727
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 3
test eax, eax
je 0x42f75e
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 3
cmp edx, ecx
jae 0x42f75e
mov eax, dword [esp + 0x2c]
mov edi, dword [esi + 8]
push eax
lea edx, [esp + 0x18]
mov ecx, 1
mov eax, edi
call fcn.00469c20
add esp, 4
add edi, 8
mov dword [esi + 8], edi
mov edi, dword [esp + 0x14]
jmp 0x42f773
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, 1
mov edx, esi
call fcn.00412930
mov esi, dword [0x56bbe8]
test esi, esi
mov edx, dword [0x56bbec]
je 0x42f7a7
mov ecx, dword [0x56bbf0]
mov eax, edx
sub eax, esi
sub ecx, esi
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x42f7a7
mov eax, edx
add eax, 4
mov dword [edx], edi
mov dword [0x56bbec], eax
jmp 0x42f7bb
push edx
push 0x56bbe4
lea eax, [esp + 0x1c]
mov ecx, 1
call fcn.0049d510
mov edx, dword [ebx + 0x1af4]
push 0
push edi
push edx
call fcn.00477db0
mov eax, dword [ebx + 0x1af4]
mov eax, dword [eax + 0x1c]
push 0x105
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x1d8
call fcn.004fa746
add esp, 4
mov dword [esp + 0x2c], eax
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x24], ecx
je 0x42f80b
push ecx
push eax
call fcn.00475a00
mov dword [esp + 0x2c], eax
jmp 0x42f80f
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], 0xffffffff
mov esi, dword [ebx + 0x1af4]
mov edi, dword [ebp + 4]
lea ecx, [esi + 0x50]
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edi
call fcn.00478810
push 1
push edi
push esi
call fcn.00477db0
test eax, eax
jne 0x42f846
mov eax, dword [0x56bc6c]
mov ebx, dword [esp + 0x2c]
mov edx, dword [ebx]
push 0
push 0xec
mov ecx, ebx
mov dword [ebx + 0x1d0], eax
call dword [edx + 0x130]
mov eax, dword [ebp + 4]
mov dword [ebx + 0x78], eax
cmp dword [ebp + 0x20], 0x10
jb 0x42f872
mov esi, dword [ebp + 0xc]
jmp 0x42f875
lea esi, [ebp + 0xc]
test esi, esi
lea ecx, [ebx + 0x7c]
jne 0x42f880
xor eax, eax
jmp 0x42f88e
mov eax, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f885
sub eax, edi
push eax
push esi
call fcn.00401f00
mov eax, dword [ebp + 0x80]
test eax, eax
je 0x42f918
cmp dword [ebp + 0x48], 0x10
jb 0x42f8aa
mov esi, dword [ebp + 0x34]
jmp 0x42f8ad
lea esi, [ebp + 0x34]
test esi, esi
lea ecx, [ebx + 0x80]
jne 0x42f8bb
xor eax, eax
jmp 0x42f8c9
mov eax, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f8c0
sub eax, edi
push eax
push esi
call fcn.00401f00
cmp dword [ebp + 0x84], 0x10
jb 0x42f8de
mov esi, dword [ebp + 0x70]
jmp 0x42f8e1
lea esi, [ebp + 0x70]
test esi, esi
lea ecx, [ebx + 0x74]
jne 0x42f8ec
xor eax, eax
jmp 0x42f8fa
mov eax, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f8f1
sub eax, edi
push eax
push esi
call fcn.00401f00
push 0
push 0x53a3bc
lea ecx, [ebx + 0x84]
call fcn.00401f00
jmp 0x42f9b2
push 0x1e
push 0x542474
lea ecx, [ebx + 0x74]
call fcn.00401f00
cmp dword [ebp + 0x48], 0x10
jb 0x42f932
mov esi, dword [ebp + 0x34]
jmp 0x42f935
lea esi, [ebp + 0x34]
test esi, esi
lea ecx, [ebx + 0x84]
jne 0x42f943
xor eax, eax
jmp 0x42f951
mov eax, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f948
sub eax, edi
push eax
push esi
call fcn.00401f00
cmp dword [ebp + 0x48], 0x10
jb 0x42f963
mov esi, dword [ebp + 0x34]
jmp 0x42f966
lea esi, [ebp + 0x34]
test esi, esi
lea ecx, [ebx + 0x104]
jne 0x42f974
xor eax, eax
jmp 0x42f989
mov eax, esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f980
sub eax, edi
push eax
push esi
call fcn.00401f00
cmp dword [ebp + 0x48], 0x10
jb 0x42f99b
mov ebp, dword [ebp + 0x34]
jmp 0x42f99e
add ebp, 0x34
push 5
push 0
push 0
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
mov ecx, ebx
call fcn.004f7bca
push 0
mov ecx, ebx
call fcn.004f7c68
push 5
mov ecx, ebx
call fcn.004fb130
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4