Function at 0x42d9b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f34a4
mov eax, dword fs:[0]
push eax
sub esp, 0x3d8
mov eax, dword [0x54b0c4]
xor eax, esp
mov dword [esp + 0x3d0], eax
push ebx
push esi
push edi
mov eax, dword [0x54b0c4]
xor eax, esp
push eax
lea eax, [esp + 0x3e8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], 0
je 0x42da10
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edi, eax
jmp 0x42da12
xor edi, edi
test edi, edi
je 0x42dfe5
lea eax, [esp + 0x6c]
mov esi, 0xfde9
push esi
mov dword [esp + 0x6c], eax
push edi
lea eax, [esp + 0x70]
push eax
call fcn.00432567
and dword [esp + 0x3f0], 0
push dword [esp + 0x68]
lea ecx, [esp + 0x2f8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x6c]
mov byte [esp + 0x3f0], 2
cmp dword [esp + 0x68], eax
je 0x42da69
push dword [esp + 0x68]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea ecx, [esp + 0x364]
call fcn.004cd8a0
push 0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3f4], 3
call fcn.004cb610
mov byte [esp + 0x3f0], 4
cmp dword [esp + 0x30c], 0x10
mov eax, dword [esp + 0x2f8]
jae 0x42daa8
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 1
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x370]
mov byte [esp + 0x3fc], 5
call fcn.004cf460
mov bl, al
neg bl
sbb bl, bl
lea ecx, [esp + 0x4c]
inc bl
mov byte [esp + 0x3f0], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
test bl, bl
je 0x42db42
cmp dword [0x550bdc], 0
je 0x42dfab
push edi
push str.parse_error:
push 0x509228
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5091f4
lea eax, [esp + 0x28]
push eax
push 0x5091f0
push ecx
mov dword [esp + 0x34], 0x396
call fcn.004022f5
add esp, 4
call fcn.0040233d
call fcn.00423894
call fcn.0040233d
jmp 0x42df90
lea ecx, [esp + 0x2c]
call fcn.004ca440
test al, al
jne 0x42df52
lea ecx, [esp + 0x2c]
call fcn.004ca490
test al, al
je 0x42df52
lea eax, [esp + 0x348]
push eax
push 0x503f6c
lea ecx, [esp + 0x34]
call fcn.004cc850
mov ecx, eax
call fcn.004ca2b0
lea eax, [esp + 0x310]
push eax
push str.eventid
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 6
call fcn.004cc850
mov ecx, eax
call fcn.004ca2b0
lea eax, [esp + 0x32c]
push eax
push str.content
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 7
call fcn.004cc850
mov ecx, eax
call fcn.004ca2b0
mov byte [esp + 0x3f0], 8
cmp dword [esp + 0x328], 0x10
mov eax, dword [esp + 0x314]
jae 0x42dbeb
lea eax, [esp + 0x314]
push esi
push eax
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x1fc]
push eax
mov dword [esp + 0x1fc], ecx
call fcn.00405fd8
mov byte [esp + 0x3f0], 9
push dword [esp + 0x1f0]
lea eax, [esp + 0x28]
push eax
call fcn.00402d09
lea eax, [esp + 0x1f4]
mov byte [esp + 0x3f0], 0xb
cmp dword [esp + 0x1f0], eax
je 0x42dc47
push dword [esp + 0x1f0]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ecx, dword [esp + 0x14]
add ecx, 0x3d4
mov eax, dword [ecx]
lea edx, [esp + 0x24]
push edx
call dword [eax + 0x10]
cmp dword [esp + 0x344], 0x10
mov eax, dword [esp + 0x330]
jae 0x42dc73
lea eax, [esp + 0x330]
push esi
push eax
lea eax, [esp + 0xf4]
lea ecx, [esp + 0xf8]
push eax
mov dword [esp + 0xf8], ecx
call fcn.00405fd8
mov byte [esp + 0x3f0], 0xc
push dword [esp + 0xec]
lea eax, [esp + 0x1c]
push eax
call fcn.00402d09
lea eax, [esp + 0xf0]
mov byte [esp + 0x3f0], 0xe
cmp dword [esp + 0xec], eax
je 0x42dccf
push dword [esp + 0xec]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jne 0x42dd92
cmp dword [0x550bdc], 0
je 0x42dd36
push str.commandline_is_empty
push 0x509228
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5091f4
lea eax, [esp + 0x24]
push eax
push 0x5091f0
mov dword [esp + 0x2c], 0x3aa
call fcn.004022f5
call fcn.0040233d
call fcn.00423894
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
mov esi, eax
call fcn.00402366
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.004012f9
lea ecx, [esp + 0x32c]
mov byte [esp + 0x3f0], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x310]
mov byte [esp + 0x3f0], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x348]
mov byte [esp + 0x3f0], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x42dfab
xor ebx, ebx
lea ecx, [esp + 0x1c]
call fcn.0048afb1
mov byte [esp + 0x3f0], 0xf
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], ebx
jne 0x42de17
cmp dword [0x550bdc], ebx
je 0x42de06
push str.modulepath_is_empty
push 0x509228
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5091f4
lea eax, [esp + 0x24]
push eax
push 0x5091f0
mov dword [esp + 0x2c], 0x3b1
call fcn.004022f5
call fcn.0040233d
call fcn.00423894
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
mov esi, eax
call fcn.00402366
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x42dd36
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004c0441
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x400], 0x10
call fcn.004c04a4
add esp, 0x10
mov byte [esp + 0x3f0], 0x11
mov eax, dword [esp + 0x20]
push dword [eax - 0xc]
push eax
lea eax, [esp + 0x24]
call fcn.00402a3f
push 1
push ebx
push dword [esp + 0x30]
push dword [esp + 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x550bdc], ebx
cdq
mov dword [esp + 0x44], eax
mov edi, edx
je 0x42df1d
cmp edi, ebx
jl 0x42de95
jg 0x42de8e
cmp eax, 0x20
jbe 0x42de95
mov byte [esp + 0x13], 1
jmp 0x42de99
mov byte [esp + 0x13], bl
lea eax, [esp + 0x13]
push eax
push str.___result:
push dword [esp + 0x30]
lea eax, [esp + 0x20]
push 0x5040d0
push dword [esp + 0x2c]
mov dword [esp + 0x28], 0x3bb
push str.ShellExecute_
push 0x509228
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5091f4
push eax
push 0x5091f0
push ecx
call fcn.004022f5
add esp, 4
call fcn.0040233d
call fcn.00423894
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.00432440
mov esi, eax
call fcn.00402366
cmp edi, ebx
jl 0x42df31
jg 0x42df2a
cmp dword [esp + 0x44], 0x20
jbe 0x42df31
mov byte [esp + 0x13], 1
jmp 0x42df35
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x42de06
cmp dword [0x550bdc], 0
je 0x42dfab
push str.root_is_null
push 0x509228
push str.KCommonAlienPopBase::OnJsEventExecCmd
push 0x5091f4
lea eax, [esp + 0x24]
push eax
push 0x5091f0
mov dword [esp + 0x2c], 0x39c
call fcn.004022f5
call fcn.0040233d
call fcn.00423894
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
call fcn.0040233d
mov esi, eax
call fcn.00402366
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3f0], 3
call fcn.004cb760
lea ecx, [esp + 0x364]
mov byte [esp + 0x3f0], 2
call fcn.00422b34
or dword [esp + 0x3f0], 0xffffffff
lea ecx, [esp + 0x2f4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [0x550310]
mov ecx, 0x550310
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x3f0], 0x12
cmp byte [esp + 0x13], al
setne al
push eax
push 0x509958
lea eax, [esp + 0x28]
call fcn.00401a57
mov eax, dword [esp + 0x48]
test eax, eax
mov esi, dword [esp + 0x28]
pop ecx
pop ecx
je 0x42e031
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
lea eax, [esi - 0x10]
call fcn.004012f9
mov ecx, dword [esp + 0x3e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3d0]
xor ecx, esp
call fcn.004d0736
mov esp, ebp
pop ebp
ret 0xc