Function at 0x4203ea
Capabilities:
Create process on windows
Set current directory

Disassembly:
push 0x68
mov eax, 0x428359
call fcn.004275fb
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [ebp - 4], 2
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.K9PCUhelper.dll_wchar_t_const____cdecl_GetAppPath_struct_HINSTANCE_____class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____]
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
call dword [0x42e8d8]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.K9PCUhelper.dll_enum_PCO_ERROR_CODES___cdecl_STPathAppend_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Trim]
mov esi, str.open
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
mov esi, 0x437ce0
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 0x3c
movsw word es:[edi], word [esi]
pop esi
push esi
lea eax, [ebp - 0x74]
push ebx
push eax
call sub.MSVCR90.dll_memset
lea eax, [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x74], esi
inc ebx
cmp dword [eax - 0xc], 0
je 0x4204a4
lea eax, [ebp + 0xc]
jmp 0x4204b4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
call dword [0x42e8c8]
mov dword [ebp - 0x34], ebx
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
test byte [ebp - 0x34], bl
je 0x4204c7
lea ecx, [ebp - 0x38]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [ebp - 0x70], 0x800040
mov dword [ebp - 0x58], ebx
call fcn.0040a7cd
test eax, eax
je 0x4204ee
call fcn.0040a7cd
test eax, eax
jne 0x4204e8
and dword [ebp - 0x6c], eax
jmp 0x4204ee
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x6c], eax
push str.K9PCUSystemProtector.exe
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CompareNoCase]
test eax, eax
jne 0x42050b
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
call fcn.00427645
ret 8