Function at 0x420668
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x42094a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4263a4]
cmp byte [eax + 0x110b], 0
jne 0x4208a6
lea eax, [ebp - 0x24]
call fcn.0041e728
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407678
mov eax, dword [ebp - 0x20]
mov edx, 0x420960
call fcn.004043f0
jne 0x420842
mov eax, dword [0x4263b8]
cmp byte [eax], 0
je 0x420731
mov eax, 0x420978
call fcn.0041be00
push 0
push 0
push 0x42a6b8
mov ecx, 0x4200dc
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp 0x420719
mov eax, dword [ebp - 0x18]
sub eax, 2
je 0x420706
sub eax, 0xf
je 0x42070d
sub eax, 5
je 0x420714
jmp 0x420719
call fcn.00403ea0
jmp 0x420719
call fcn.00403ea0
jmp 0x420719
call fcn.00403ea0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4206f2
jmp 0x42092f
mov eax, 0x420994
call fcn.0041e880
push eax
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.004044a4
pop edx
call fcn.00415498
test al, al
jne 0x42092f
mov edx, dword [0x4263a4]
xor eax, eax
mov byte [edx + 0x1108], al
push 0
push 0
mov edx, dword [0x4263a4]
push eax
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x1108
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e3fc
mov eax, dword [0x4263a4]
mov byte [eax + 0x1109], 0
push 0
push 0
push 0
mov eax, dword [0x4264ec]
mov eax, dword [eax]
push eax
push 0x1109
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e3fc
push 0
push 0
push 0x42a6b8
mov ecx, 0x4200dc
xor edx, edx
xor eax, eax
call fcn.00403fc8
push 0
push 0
push 0x42a6b8
mov ecx, 0x4161c4
xor edx, edx
xor eax, eax
call fcn.00403fc8
push 0
push 0
push 0x42a6b8
mov ecx, 0x414fcc
xor edx, edx
xor eax, eax
call fcn.00403fc8
call fcn.0041c158
jmp 0x42082a
mov eax, dword [ebp - 0x18]
sub eax, 2
je 0x420817
sub eax, 0xf
je 0x42081e
sub eax, 5
je 0x420825
jmp 0x42082a
call fcn.00403ea0
jmp 0x42082a
call fcn.00403ea0
jmp 0x42082a
call fcn.00403ea0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x420803
jmp 0x42092f
mov eax, 0x420994
call fcn.0041e880
push eax
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.004044a4
pop edx
call fcn.00415498
test al, al
jne 0x42092f
push 0
push 0x4209a4
lea edx, [ebp - 0x28]
mov eax, dword [0x426430]
mov eax, dword [eax]
call fcn.00416bcc
lea eax, [ebp - 0x28]
mov edx, 0x4209b0
call fcn.004042b4
mov eax, dword [ebp - 0x28]
call fcn.004044a4
push eax
push 0x4209bc
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x42092f
lea eax, [ebp - 0x30]
call fcn.0041e728
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00407678
mov eax, dword [ebp - 0x2c]
mov edx, 0x420960
call fcn.004043f0
jne 0x42092f
mov eax, dword [0x4263b8]
cmp byte [eax], 0
je 0x42092f
mov eax, 0x4209d4
call fcn.0041be00
push 0
push 0
push 0x42a6b8
mov ecx, 0x4200dc
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp 0x42091c
mov eax, dword [ebp - 0x18]
sub eax, 2
je 0x420909
sub eax, 0xf
je 0x420910
sub eax, 5
je 0x420917
jmp 0x42091c
call fcn.00403ea0
jmp 0x42091c
call fcn.00403ea0
jmp 0x42091c
call fcn.00403ea0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4208f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420951
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00404030
ret