Function at 0x429c10
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x50b39c]
sub esp, 0xb34
cmp byte [eax + 0x42b1], 0
push esi
mov esi, ecx
jne 0x429c39
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0xa6c], 0
jne 0x429c42
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x64]
xor edx, edx
push eax
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
mov word [ebp - 0x2f0], dx
mov dword [ebp - 0x68], 0x44
call fcn.004b03e0
add esp, 0xc
cmp dword [esi + 0x10], 0
je 0x429f01
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x429f00
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x429eff
mov eax, dword [esi]
cmp ebx, eax
je 0x42a050
cmp ebx, dword [esi + 4]
je 0x42a04e
mov al, byte [ebp + 0x10]
test al, al
je 0x429cbf
cmp ebx, dword [esi + 8]
je 0x429eff
mov dword [esi + 8], ebx
test al, al
je 0x429d3e
mov ecx, dword [0x50b39c]
call fcn.004068a0
test al, al
je 0x429cde
push 0
mov ecx, esi
call fcn.00429920
xor eax, eax
push 0xc
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], eax
call fcn.004412a0
add esp, 4
test eax, eax
je 0x429eff
lea ecx, [ebp + 0xc]
push ecx
push 0
push eax
push 0x4298e0
push 0
push 0
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x429d2e
lea edx, [ebp + 0x10]
push edx
lea ecx, [esi + 0x34]
call fcn.004295b0
mov eax, dword [ebp + 0x10]
test eax, eax
pop edi
setne byte [ebp - 1]
mov al, byte [ebp - 1]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esi + 0x48]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
mov ecx, esi
call fcn.004299c0
push 0x104
lea eax, [ebp - 0x2f0]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x429dc9
push str.VirtualConsoleClass
lea ecx, [ebp - 0x2f0]
push ecx
call edi
test eax, eax
je 0x429e8a
push str.32770
lea edx, [ebp - 0x2f0]
push edx
call edi
test eax, eax
je 0x429e8a
push str.ConsoleWindowClass
lea eax, [ebp - 0x2f0]
push eax
call edi
test eax, eax
je 0x429e8a
push str.WineConsoleClass
lea ecx, [ebp - 0x2f0]
push ecx
call edi
test eax, eax
je 0x429e8a
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x51c]
push edx
push eax
call fcn.004ad200
add esp, 8
test al, al
je 0x429e8a
lea ecx, [ebp - 0x4f8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [ebp - 0x4f8]
push edx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push str.csrss.exe
lea eax, [ebp - 0x4f8]
push eax
call edi
test eax, eax
je 0x429e8a
mov ecx, dword [0x50b3a0]
call fcn.00443630
test eax, eax
je 0x429e8a
cmp word [eax], 0
mov edi, eax
je 0x429e8a
jmp 0x429e30
lea ecx, [ebp - 0x4f8]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x429e5e
test dx, dx
je 0x429e5a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x429e5e
add eax, 4
add ecx, 4
test dx, dx
jne 0x429e38
xor eax, eax
jmp 0x429e63
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x429e8f
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429e70
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x429e30
mov dword [esi + 4], ebx
jmp 0x429ef5
mov eax, dword [esi + 0x18]
test eax, eax
je 0x429eb0
mov edx, dword [esi + 0x24]
lea ecx, [eax + eax*2]
lea ecx, [edx + ecx*4 + 4]
mov edx, dword [ecx - 0xc]
sub ecx, 0xc
dec eax
cmp edx, dword [ebp + 0xc]
je 0x429eef
test eax, eax
jne 0x429ea0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x429e8a
mov ecx, dword [ebp + 0xc]
push edi
push ecx
call fcn.004ad170
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
cmp eax, 0x20
je 0x429f0b
cmp eax, 0x40
jne 0x429f30
mov edx, dword [ebp + 0xc]
push edx
push str.ConEmuC64.exe
jmp 0x429f14
mov dword [esi], ebx
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov al, byte [ebp - 1]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
push edx
push str.ConEmuC.exe
mov eax, dword [0x50b39c]
add eax, 0x5c8
push eax
lea ecx, [ebp - 0xb34]
push str.__s_s___DEFTRM_u
push ecx
call ebx
add esp, 0x14
cmp word [ebp - 0xb34], 0
jne 0x429f49
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
mov dword [esi + 4], edx
jmp 0x429ef5
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xe8]
push str.ConEmuDefaultTerm._u
push ecx
call ebx
mov eax, dword [esi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
test eax, eax
je 0x429f7a
mov dword [esi + 0xc], 0
cmp eax, 0xffffffff
je 0x429f7a
push eax
call ebx
lea edx, [ebp - 0xe8]
push edx
push 0
push 0
call fcn.00441aa0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x429f9f
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xb34]
push edx
push 0
mov dword [ebp - 0x3c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x429fec
push eax
push eax
push eax
push eax
push str.Failed_to_start_hooking_application__nDefault_terminal_feature_will_not_be_available_
call fcn.004200b0
add esp, 0x14
push edi
call ebx
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
jmp 0x429ef5
mov ecx, dword [ebp - 0x20]
push ecx
call ebx
mov edx, dword [ebp - 0x24]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x24]
push edx
call ebx
cmp dword [ebp - 8], 0x81
jne 0x429fde
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp - 0x14]
push edx
lea ecx, [esi + 0x14]
mov dword [ebp - 0xc], eax
call fcn.00429ab0
jmp 0x429ef1
cmp ebx, eax
pop edi
sete byte [ebp - 1]
mov al, byte [ebp - 1]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc