Function at 0x427830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x427b14
mov eax, dword [ebp + 0xc]
cmp eax, 0x111
jne 0x427a2b
mov ecx, dword [ebp + 0x10]
mov edx, 8
movzx esi, cx
cmp dx, si
jne 0x427884
lea eax, [ebp + 0x10]
shr ecx, 0x10
push eax
push dword [ebp + 0x14]
push edx
push ecx
mov ecx, ebx
call fcn.00426cb0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov edx, 4
cmp dx, si
je 0x427a32
mov edx, 7
cmp dx, si
jne 0x427900
mov edx, dword [ebp + 0x14]
push ecx
mov eax, esp
mov dword [ebx + 0x50], 1
push 7
mov dword [eax], edx
mov eax, ecx
shr eax, 0x10
mov ecx, ebx
push eax
call fcn.00427000
mov edi, dword [ebp + 0x18]
mov dword [edi], 0
cmp dword [ebx + 0x50], 0
jne 0x427878
mov eax, dword [ebp + 0xc]
mov ecx, 0xf
cmp cx, si
jne 0x427905
push 1
push 0
push 0
push str.https:__wan.ludashi.com_account_protocol_typeregister
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov edi, dword [ebp + 0x18]
jmp 0x4278cc
mov ecx, 0xe
cmp cx, si
jne 0x427970
mov ecx, dword [ebx + 0x78]
call fcn.00429330
mov edx, dword [ebx + 0x90]
mov ecx, dword [edx]
mov ecx, dword [ecx + 0x2c]
test eax, eax
je 0x42794b
push 1
push edx
call ecx
mov eax, dword [ebx + 0x84]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
push 0
push edx
call ecx
mov eax, dword [ebx + 0x84]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, 0x11
cmp cx, si
jne 0x427993
mov ecx, ebx
call fcn.00427c50
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, 0x13
cmp cx, si
je 0x427a32
mov ecx, 0x12
cmp cx, si
jne 0x4279c4
mov ecx, ebx
call fcn.00427b20
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, 0x14
cmp cx, si
jne 0x427a01
mov ecx, dword [ebx + 0x94]
call fcn.00429330
mov esi, eax
call fcn.0040ed70
xor ecx, ecx
test esi, esi
setne cl
push ecx
mov ecx, eax
call fcn.0040df60
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, 3
cmp cx, si
jne 0x427a4e
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x427a19
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp eax, 0x15eb
jne 0x427a4e
mov ecx, ebx
call fcn.00427440
mov ecx, dword [ebp + 0x18]
mov eax, 1
mov dword [ecx], 0
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebx + 0x40]
mov esi, dword [ebx + 0x2c]
push 0
push dword [ebp + 0x18]
mov dword [ebp + 0x1c], ecx
lea ecx, [ebx + 0x28]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00405050
mov dword [ebx + 0x2c], esi
test eax, eax
je 0x427a7f
mov eax, 1
jmp 0x427b06
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x427aa6
push dword [ebp + 0x14]
mov ecx, ebx
mov dword [ebx + 0x40], eax
call fcn.00404800
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [ebx + 0x40], 0
je 0x427b04
mov eax, 1
jmp 0x427b06
cmp eax, 0xf
jne 0x427ad7
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebx + 0x40], 1
mov dword [eax], ecx
mov ecx, ebx
call fcn.00404ac0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebx + 0x40], 0
je 0x427b04
mov eax, 1
jmp 0x427b06
cmp eax, 0x14
jne 0x427b04
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebx + 0x40], 1
mov dword [eax], ecx
mov ecx, ebx
call fcn.00404850
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [ebx + 0x40], 0
je 0x427b04
mov eax, 1
jmp 0x427b06
xor eax, eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebx + 0x40], ecx
test eax, eax
jne 0x427878
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18