Function at 0x420770
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4686fe
mov eax, dword fs:[0]
push eax
mov eax, 0x2724
call fcn.00454790
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x2720], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48807c]
xor eax, esp
push eax
lea eax, [esp + 0x2738]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2748]
push edi
push str.RemoveCmd____s__n
mov ebp, ecx
call fcn.004454c0
push 0x1c2d0
call fcn.004534f0
add esp, 0xc
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x2740], ebx
cmp eax, ebx
je 0x4207ec
mov ecx, eax
call fcn.00444be0
mov esi, eax
jmp 0x4207ee
xor esi, esi
push 0x1058
lea eax, [esp + 0x70]
push ebx
push eax
mov dword [esp + 0x274c], 0xffffffff
call fcn.00453450
add esp, 0xc
push 0x474298
push edi
mov ecx, esi
call fcn.00444e30
mov edi, eax
cmp byte [esi + 0x1c2cc], bl
je 0x420837
cmp dword [esi + 0x1c2c8], ebx
jg 0x42082f
xor eax, eax
jmp 0x420845
lea eax, [esi + 0x32c8]
jmp 0x420845
xor eax, eax
cmp dword [esi + 0x1c2c8], ebx
setle al
dec eax
and eax, esi
push str.UNINST_STRING_ARP
push eax
call fcn.00453ad3
add esp, 8
test eax, eax
jne 0x420baf
cmp byte [esi + 0x1c2cc], bl
je 0x420874
cmp dword [esi + 0x1c2c8], 1
jle 0x420887
lea eax, [esi + 0x3ac8]
jmp 0x420887
cmp dword [esi + 0x1c2c8], 1
jg 0x420881
xor eax, eax
jmp 0x420887
lea eax, [esi + 0x104]
lea ecx, [esp + 0x6c]
push ecx
push eax
mov ecx, ebp
call fcn.0041e6a0
cmp byte [esp + 0x10ac], bl
je 0x420b77
cmp edi, 2
jle 0x4208dd
push 2
mov ecx, esi
call fcn.00401b00
test eax, eax
je 0x4208dd
push 2
mov ecx, esi
call fcn.00401b00
push eax
lea edx, [esp + 0x278]
push edx
lea eax, [esp + 0x2124]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x4208f8
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x274]
mov word [esp + eax + 0x211c], cx
add eax, 2
cmp cx, bx
jne 0x4208e0
cmp edi, 3
jle 0x420953
push 3
mov ecx, esi
call fcn.00401b00
test eax, eax
je 0x420953
lea ecx, [esp + 0x211c]
push ecx
push str.before_replace___s__n
call fcn.004454c0
add esp, 8
push 0x46b804
push 3
mov ecx, esi
call fcn.00401b00
mov ecx, dword [ebp + 0xc]
push eax
lea edx, [esp + 0x2124]
push edx
call fcn.00449bc0
lea eax, [esp + 0x211c]
push eax
push str.after_replace___s__n
call fcn.004454c0
add esp, 8
lea ecx, [esp + 0x211c]
push ecx
push str.wszFullCommand____s__n
call fcn.004454c0
add esp, 8
cmp byte [esi + 0x1c2cc], bl
je 0x420985
cmp dword [esi + 0x1c2c8], 1
jg 0x42097d
xor eax, eax
jmp 0x420998
lea eax, [esi + 0x3ac8]
jmp 0x420998
cmp dword [esi + 0x1c2c8], 1
jg 0x420992
xor eax, eax
jmp 0x420998
lea eax, [esi + 0x104]
push eax
push str.args__GetArgString_1_____s__n
call fcn.004454c0
add esp, 8
cmp byte [esp + 0x274c], bl
jne 0x420baf
lea edx, [esp + 0x211c]
push edx
push 0xffffffffffffffff
push 9
mov ecx, ebp
call fcn.00418e80
xor eax, eax
push 0x44
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00453450
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, 1
push ebx
mov word [esp + 0x74], cx
mov dword [esp + 0x70], ecx
push ebx
lea ecx, [esp + 0x213c]
push ecx
push ebx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x420b50
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x1f4
call edi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
call ebx
cmp dword [esp + 0x14], 0x103
je 0x420a35
push 0x1058
xor ebx, ebx
lea ecx, [esp + 0x10c8]
push ebx
push ecx
call fcn.00453450
add esp, 0xc
lea edx, [esp + 0x10c4]
push edx
mov edi, 1
push edi
mov ecx, esi
call fcn.00401b00
push eax
mov ecx, ebp
call fcn.0041e6a0
cmp dword [esp + 0x14], 0x11010001
jne 0x420aa0
push edi
push ebx
push ebx
push 0x8901
mov ecx, ebp
call fcn.00418f60
mov ecx, dword [ebp + 0xc]
push str.KmInst32.exe
lea eax, [esp + 0x2120]
push eax
call fcn.004495e0
test eax, eax
jne 0x420ad2
push str.KmInst64.exe
lea ecx, [esp + 0x2120]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004495e0
test eax, eax
je 0x420ae1
push edi
push ebx
push ebx
push 0x8901
mov ecx, ebp
call fcn.00418f60
mov ecx, ebp
cmp byte [esp + 0x2104], bl
je 0x420afd
lea edx, [esp + 0x211c]
push edx
mov dword [ebp + 0x2ac0], edi
push edi
jmp 0x420b0c
lea eax, [esp + 0x211c]
push eax
mov dword [ebp + 0x2ac0], ebx
push ebx
push 9
call fcn.00418e80
cmp dword [esp + 0x14], 0x11010111
jne 0x420b35
lea ecx, [esp + 0x211c]
push ecx
push edi
push 9
mov ecx, ebp
mov dword [ebp + 0x2ac0], edi
call fcn.00418e80
cmp dword [esp + 0x14], 0x11010011
jne 0x420baf
lea edx, [esp + 0x211c]
push edx
mov dword [ebp + 0x2ac0], ebx
push ebx
jmp 0x420ba6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.CreateProcess_failure____ld_n
call fcn.004454c0
add esp, 8
call edi
lea ecx, [esp + 0x211c]
push ecx
mov dword [esp + 0x18], eax
push eax
jmp 0x420ba6
cmp byte [esi + 0x1c2cc], bl
je 0x420b90
cmp dword [esi + 0x1c2c8], 1
jle 0x420b99
lea eax, [esi + 0x3ac8]
jmp 0x420ba3
cmp dword [esi + 0x1c2c8], 1
jg 0x420b9d
xor eax, eax
jmp 0x420ba3
lea eax, [esi + 0x104]
push eax
push 1
push 9
mov ecx, ebp
call fcn.00418e80
mov ecx, esi
call fcn.0043df40
push esi
call fcn.004534ca
mov eax, 1
add esp, 4
mov dword [ebp + 0x2ac4], eax
mov ecx, dword [esp + 0x2738]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2720]
xor ecx, esp
call fcn.00453432
add esp, 0x2730
ret 8