Function at 0x420d20
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458978
push 0x4423d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2884
call fcn.00441bd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x828], ebx
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x421052
cmp word [esi], bx
je 0x421052
mov edx, 0x400
mov dword [ebp - 0x20], edx
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x820]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1874], edx
lea eax, [ebp - 0x820]
test eax, eax
jne 0x420da1
mov dword [ebp - 0x1878], ebx
jmp 0x420e3a
mov word [ebp - 0x820], bx
mov dword [ebp - 0x870], 0x800
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x1870]
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x420e16
push 0x800
lea ecx, [ebp - 0x1870]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1870]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea ecx, [ebp - 0x1870]
push ecx
lea edx, [ebp - 0x1870]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x400
lea eax, [ebp - 0x1870]
push eax
lea ecx, [ebp - 0x820]
push ecx
jmp 0x420e23
push 0x400
push esi
lea edx, [ebp - 0x820]
push edx
call fcn.00441b85
add esp, 0xc
mov dword [ebp - 0x1878], 1
mov edx, 0x400
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x864]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x864], 0x3c
lea eax, [ebp - 0x820]
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x850], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x860], edx
lea ecx, [ebp - 0x864]
test ecx, ecx
jne 0x420e88
xor esi, esi
jmp 0x42101b
lea edx, [ebp - 0x820]
mov dword [ebp - 0x2898], edx
mov dword [ebp - 0x187c], ebx
lea eax, [ebp - 0x187c]
push eax
push 1
push 1
lea ecx, [ebp - 0x820]
push ecx
call fcn.004111c0
test eax, eax
je 0x420ebf
mov eax, 1
jmp 0x420ffe
cmp dword [ebp - 0x187c], ebx
jne 0x420ffc
mov dword [ebp - 0x1884], ebx
mov dword [ebp - 0x2890], 0x800
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x288c]
rep stosd dword es:[edi], eax
push 0x800
push 0x4612e4
lea edx, [ebp - 0x288c]
push edx
call fcn.00441b85
push 0x800
push 0x461334
lea eax, [ebp - 0x288c]
push eax
call fcn.00442185
push 0x800
push 0x4612b8
lea ecx, [ebp - 0x288c]
push ecx
call fcn.00442185
push 0x800
push 0x461334
lea edx, [ebp - 0x288c]
push edx
call fcn.00442185
push 0x800
push str.vL
lea eax, [ebp - 0x288c]
push eax
call fcn.00442185
push 0x800
lea ecx, [ebp - 0x820]
push ecx
lea edx, [ebp - 0x288c]
push edx
call fcn.00442185
add esp, 0x48
push 0x800
push 0x461278
lea eax, [ebp - 0x288c]
push eax
call fcn.00442185
add esp, 0xc
push 0x14
push 0x461334
lea ecx, [ebp - 0x288c]
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x2894], eax
cmp eax, 6
jne 0x420ff6
push 0xc8
push 0x461234
push 0x4614cc
call fcn.004536d2
add esp, 0xc
test eax, eax
jne 0x420fe1
call fcn.0041ff80
test eax, eax
je 0x420fe1
push 5
push ebx
push ebx
push 0x461664
jmp 0x420fea
push 5
push ebx
push ebx
push 0x4614cc
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.00442074
xor eax, eax
mov dword [ebp - 0x289c], eax
cmp eax, ebx
jne 0x42100c
xor esi, esi
jmp 0x42101b
lea edx, [ebp - 0x864]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x42102f
mov eax, dword [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret