Function at 0x421644
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
cmp dword [ebp + 8], 0
je 0x421723
push 0x468af8
push str.Der_Programmpfad_enth
lea eax, [ebp - 0x1d4]
push eax
call fcn.00447d04
add esp, 0xc
push 0x45cfe6
lea edx, [ebp - 0x1d4]
push edx
call fcn.00444280
add esp, 8
push 0x45cfe8
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.00444280
add esp, 8
lea eax, [ebp - 0x1d4]
push eax
push 0x24
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
cmp eax, 6
jne 0x421723
push 0x468af8
lea edx, [ebp - 0x1d4]
push edx
call fcn.0044435c
add esp, 8
cmp byte [ebp - 0x1d4], 0
je 0x421700
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.0044438c
pop ecx
movsx eax, byte [ebp + eax - 0x1d5]
cmp eax, 0x5c
jne 0x421700
lea edx, [ebp - 0x1d4]
push edx
call fcn.0044438c
pop ecx
mov byte [ebp + eax - 0x1d5], 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1d4]
push ecx
push 0x45cffc
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov eax, 1
jmp 0x421989
push str.c:_temppcddump.txt
lea edx, [ebp - 0x3a0]
push edx
call fcn.0044435c
add esp, 8
push 0x5c
lea ecx, [ebp - 0x3a0]
push ecx
call fcn.00444491
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421757
mov eax, dword [ebp - 4]
mov byte [eax], 0
cmp dword [0x454ad0], 0
je 0x4217d4
call fcn.00404308
push str.Es_wird_bereits_eine_Dump_Datei_angelegt._Soll_keine_Dump_Datei_mehr_angelegt_werden_
push 0x44
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
cmp eax, 6
jne 0x4218c9
push 0x468d05
push 0x45d05f
push 0x45d057
push 0x4547d8
call sub.KERNEL32.DLL_WritePrivateProfileStringA
test eax, eax
jne 0x4217bf
push 0x468d05
push str.Die_Datei__s_kann_nicht_geschrieben_werden._nWahrscheinlich_wird_die_Datei_von_einer_anderen_Anwendung_verwendet_oder_sie_ist_schreibgesch
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x4218c9
xor edx, edx
mov dword [0x4528ec], edx
xor ecx, ecx
mov dword [0x454ad0], ecx
jmp 0x4218c9
push str.Es_wird_keine_Dump_Datei_angelegt._Soll_eine_Dump_Datei_angelegt_werden_
push 0x44
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
cmp eax, 6
jne 0x4218c9
lea eax, [ebp - 0x3a0]
push eax
call fcn.00404464
pop ecx
test eax, eax
jne 0x421824
lea edx, [ebp - 0x3a0]
push edx
push str.Die_Datei__s_kann_nicht_erstellt_werden.
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x4218c9
push 0x45d0aa
push str.c:_temppcddump.txt
call fcn.004463c0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4218af
push dword [ebp - 8]
call fcn.00445c04
pop ecx
push 0x468d05
push 0x45d0b5
push str.PCDDUMP
push 0x4547d8
call sub.KERNEL32.DLL_WritePrivateProfileStringA
test eax, eax
jne 0x421881
push 0x468d05
push str.Die_Datei__s_kann_nicht_geschrieben_werden._nWahrscheinlich_wird_die_Datei_von_einer_anderen_Anwendung_verwendet_oder_sie_ist_schreibgesch
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x4218c9
xor ecx, ecx
mov dword [0x4528ec], ecx
mov dword [0x454ad0], 1
push 0
call fcn.00403934
pop ecx
push 0x468d05
push str.PathNameProfile_INI____s__r_n
call fcn.00403934
add esp, 8
jmp 0x4218c9
push str.c:_temppcddump.txt
push str.Die_Datei__s_kann_nicht_erstellt_werden.
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
cmp dword [0x454ad0], 0
je 0x421987
push str.c:_temppcddump.txt
push str.Der_Dump_Pfad_enth
lea eax, [ebp - 0x1d4]
push eax
call fcn.00447d04
add esp, 0xc
push 0x45d0f0
lea edx, [ebp - 0x1d4]
push edx
call fcn.00444280
add esp, 8
push str.Verzeichnis
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.00444280
add esp, 8
lea eax, [ebp - 0x1d4]
push eax
push 0x24
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
cmp eax, 6
jne 0x421987
push str.c:_temppcddump.txt
lea edx, [ebp - 0x1d4]
push edx
call fcn.0044435c
add esp, 8
push 0x5c
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.00444491
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421967
mov eax, dword [ebp - 4]
mov byte [eax], 0
push 1
push 0
push 0
lea edx, [ebp - 0x1d4]
push edx
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov eax, 1
jmp 0x421989
xor eax, eax
mov esp, ebp
pop ebp
ret