Function at 0x422c70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0
mov edx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edi
jne 0x42318b
mov eax, dword [ebp + 0xc]
cmp eax, 0x200
jne 0x422d90
mov eax, dword [ebx + 0x28]
movsx esi, cx
shr ecx, 0x10
movsx edx, cx
push edx
push esi
push dword [ebp - 0x68]
mov dword [ebx + 0x24], 1
mov ecx, dword [eax]
push eax
mov dword [ebp - 0x64], edx
call dword [ecx + 0xbc]
cmp dword [ebx + 0x3c], 0
je 0x422d02
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], 3
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov dword [ebx + 0x3c], 0
push dword [ebp - 0x64]
lea eax, [ebx + 0x54]
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x422d77
push dword [ebp - 0x64]
lea eax, [ebx + 0x44]
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x422d77
push dword [ebp - 0x64]
lea eax, [ebx + 0x84]
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x422d77
push dword [ebp - 0x64]
lea eax, [ebx + 0x74]
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x422d77
push dword [ebp - 0x64]
lea eax, [ebx + 0x64]
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x422d77
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x42317b
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x42317b
cmp eax, 0x2a3
jne 0x422dc0
cmp dword [ebx + 0x3c], 0
mov dword [ebx + 0x24], 1
jne 0x42317b
mov eax, dword [ebx + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc4]
mov dword [ebx + 0x3c], 1
jmp 0x42317b
cmp eax, 0x2a1
jne 0x422ded
movsx esi, cx
shr ecx, 0x10
movsx eax, cx
mov ecx, dword [ebx + 0x28]
push eax
push esi
push dword [ebp - 0x68]
mov dword [ebx + 0x24], 1
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc0]
jmp 0x42317b
cmp eax, 0x201
jne 0x422e37
push dword [ebx + 4]
movsx edi, cx
shr ecx, 0x10
mov dword [ebx + 0x24], 1
movsx esi, cx
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebx + 0x28]
lea edx, [ebp - 0x6c]
push edx
push esi
push edi
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc8]
mov eax, dword [ebp - 0x64]
mov dword [eax], 0
jmp 0x423181
cmp eax, 0x202
jne 0x422e78
movsx esi, cx
lea edi, [ebp - 0x6c]
shr ecx, 0x10
push edi
movsx eax, cx
mov ecx, dword [ebx + 0x28]
push eax
push esi
push dword [ebp - 0x68]
mov dword [ebx + 0x24], 1
mov dword [ebp - 0x6c], 1
mov edx, dword [ecx]
push ecx
call dword [edx + 0xcc]
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov edi, dword [ebp - 0x64]
jmp 0x42317b
cmp eax, 0x84
jne 0x422e91
mov dword [ebx + 0x24], 1
mov dword [edi], 1
jmp 0x423181
cmp eax, 0x18
jne 0x422ee4
mov eax, dword [ebx + 0x2c]
lea edx, [ebp - 0x14]
mov dword [ebx + 0x24], 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ecx, eax
mov eax, dword [ecx + 0xc]
add eax, dword [ecx + 4]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ecx + 8]
add eax, dword [ecx]
cdq
sub eax, edx
sar esi, 1
sar eax, 1
movzx ecx, ax
movzx eax, si
shl eax, 0x10
or ecx, eax
push ecx
push 0
push 0x200
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x42317b
cmp eax, 0x21
jne 0x422efe
push dword [ebx + 4]
mov dword [ebx + 0x24], 1
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x42317b
cmp eax, 0xf
jne 0x422f7b
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov dword [ebx + 0x24], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], eax
call dword [sym.imp.USER32.dll_BeginPaint]
cmp dword [ebx + 0x38], 0
mov dword [ebp - 0x5c], eax
je 0x422f69
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [ebx + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebx + 0x38]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push 0xcc0020
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push 0
push 0
push ecx
push edx
push eax
push 0
push 0
push dword [ebp - 0x5c]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x42317b
cmp eax, 0x110
jne 0x422f9d
push ecx
push ecx
mov eax, esp
mov dword [ebx + 0x24], 1
mov ecx, ebx
mov dword [eax], edx
call fcn.004224d0
mov dword [edi], eax
jmp 0x423181
cmp eax, 0x111
jne 0x423164
movzx eax, dx
mov ecx, 0x3e8
cmp cx, ax
jne 0x422fde
push 8
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 2
cmp cx, ax
jne 0x423010
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x18
mov esi, 1
cmp si, ax
jne 0x42303f
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x3e9
cmp cx, ax
jne 0x4230c3
call fcn.004214e0
mov ecx, eax
call fcn.0041d800
test al, al
je 0x423082
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x5d]
call fcn.00420a20
push 1
push 0
push 0
push dword [eax]
push 0x60f11c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x6c]
jmp 0x423131
call fcn.004214e0
mov ecx, eax
call fcn.0041de00
lea ecx, [ebp - 0x5d]
test al, al
je 0x4230b8
lea eax, [ebp - 0x68]
push eax
call fcn.00420ef0
push 1
push 0
push 0
push dword [eax]
push 0x60f11c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x68]
jmp 0x423131
lea eax, [ebp - 0x64]
push eax
call fcn.00420c60
jmp 0x423119
mov ecx, 0x3ea
cmp cx, ax
jne 0x42318b
call fcn.004214e0
mov ecx, eax
call fcn.0041d800
test al, al
je 0x4230f2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x5d]
call fcn.00420900
jmp 0x423065
call fcn.004214e0
mov ecx, eax
call fcn.0041de00
lea ecx, [ebp - 0x5d]
test al, al
je 0x423110
lea eax, [ebp - 0x68]
push eax
call fcn.00420d90
jmp 0x42309e
lea eax, [ebp - 0x64]
push eax
call fcn.00420b20
push 1
push 0
push 0
push dword [eax]
push 0x60f11c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x64]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x423149
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x10
jne 0x42318b
push 8
push dword [ebx + 4]
mov dword [ebx + 0x24], 1
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [edi], 0
cmp dword [ebx + 0x24], 0
jne 0x422fc6
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x18