Function at 0x413194
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x41319c
push ecx
push ebx
mov eax, 0x4130f4
call fcn.004055f0
xor eax, eax
push ebp
push 0x413684
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402754
cmp eax, 2
jne 0x413325
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.004027b4
mov eax, dword [ebp - 0x10]
mov edx, 0x41369c
call fcn.004036f4
jne 0x413325
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.004027b4
mov eax, dword [ebp - 0x14]
mov edx, 0x4136ac
call fcn.004036f4
jne 0x4132b7
xor eax, eax
mov dword [0x415cc8], eax
mov ecx, 0x415cc8
xor edx, edx
mov eax, 0x4136bc
call fcn.00411a44
push 0x64
call sub.kernel32.dll_Sleep
cmp dword [0x415cc8], 0
jbe 0x413212
call fcn.00412468
dec eax
jne 0x41324c
mov edx, 0x4136d4
mov eax, 0x4136e8
call fcn.004124a8
jmp 0x4132b7
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004027b4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00406988
lea eax, [ebp - 0x18]
mov edx, 0x4136f8
call fcn.004035ec
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, 0x4136bc
call fcn.00411fb8
call fcn.00412da0
test al, al
je 0x4132b7
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.004027b4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00406988
lea eax, [ebp - 0x20]
mov edx, 0x41370c
call fcn.004035ec
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, 0x413720
call fcn.004120d0
lea edx, [ebp - 0x28]
mov eax, 2
call fcn.004027b4
mov eax, dword [ebp - 0x28]
mov edx, 0x413738
call fcn.004036f4
jne 0x413669
call fcn.00412468
dec eax
jne 0x4132f3
mov edx, 0x4136d4
mov eax, 0x413748
call fcn.004124a8
jmp 0x413669
mov edx, 0x4136d4
mov eax, 0x413758
call fcn.004124a8
call fcn.00412da0
test al, al
je 0x413669
xor ecx, ecx
mov edx, 0x41370c
mov eax, 0x413720
call fcn.0041220c
jmp 0x413669
call fcn.00402754
cmp eax, 3
jne 0x413499
lea edx, [ebp - 0x2c]
mov eax, 1
call fcn.004027b4
mov eax, dword [ebp - 0x2c]
mov edx, 0x41376c
call fcn.004036f4
jne 0x413499
lea edx, [ebp - 0x30]
mov eax, 2
call fcn.004027b4
mov eax, dword [ebp - 0x30]
mov edx, 0x413780
call fcn.004036f4
je 0x41338f
lea edx, [ebp - 0x34]
mov eax, 2
call fcn.004027b4
mov eax, dword [ebp - 0x34]
mov edx, 0x41378c
call fcn.004036f4
jne 0x413669
lea edx, [ebp - 0x38]
mov eax, 2
call fcn.004027b4
mov eax, dword [ebp - 0x38]
mov edx, 0x41378c
call fcn.004036f4
sete bl
lea edx, [ebp - 0x40]
mov eax, 3
call fcn.004027b4
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00406748
mov edx, dword [ebp - 0x3c]
mov eax, 0x415cd0
call fcn.004033dc
call fcn.0040c644
test al, al
je 0x413669
mov eax, dword [0x415cd0]
mov edx, 0x413798
call fcn.004036f4
jne 0x413400
mov edx, 0x4137a8
mov eax, ebx
call fcn.00411758
jmp 0x413669
mov eax, dword [0x415cd0]
mov edx, 0x4137b8
call fcn.004036f4
jne 0x413422
mov edx, 0x4137c8
mov eax, ebx
call fcn.00411758
jmp 0x413669
mov eax, dword [0x415cd0]
mov edx, 0x4137d8
call fcn.004036f4
jne 0x41343d
call fcn.004116cc
jmp 0x413669
mov eax, dword [0x415cd0]
mov edx, 0x4137e8
call fcn.004036f4
jne 0x413473
mov edx, 0x4137f8
mov eax, ebx
call fcn.00411758
test bl, bl
je 0x413669
mov edx, 0x4137f8
mov eax, ebx
call fcn.00411758
jmp 0x413669
mov eax, dword [0x415cd0]
mov edx, 0x413804
call fcn.004036f4
jne 0x413669
mov edx, 0x413814
mov eax, ebx
call fcn.00411758
jmp 0x413669
lea eax, [ebp - 0x44]
call fcn.00411934
mov edx, dword [ebp - 0x44]
mov eax, 0x415cd8
call fcn.004033dc
lea eax, [ebp - 0x48]
call fcn.004119bc
mov edx, dword [ebp - 0x48]
mov eax, 0x415cdc
call fcn.004033dc
call fcn.00412468
dec eax
jne 0x4134e2
mov eax, 0x415cd4
mov ecx, 0x413824
mov edx, dword [0x415cdc]
call fcn.00403630
jmp 0x4134f7
mov eax, 0x415cd4
mov ecx, 0x413834
mov edx, dword [0x415cdc]
call fcn.00403630
mov eax, 0x415ce0
mov ecx, 0x413848
mov edx, dword [0x415cdc]
call fcn.00403630
mov eax, 0x415ce4
mov ecx, 0x41385c
mov edx, dword [0x415cdc]
call fcn.00403630
mov eax, dword [0x415ce0]
call fcn.004068e8
test al, al
jne 0x413552
lea eax, [ebp - 0x4c]
mov ecx, 0x413870
mov edx, dword [0x415cd8]
call fcn.00403630
mov eax, dword [ebp - 0x4c]
mov cl, 0xd9
mov edx, dword [0x415ce0]
call fcn.00412f58
mov eax, dword [0x415ce4]
call fcn.004068e8
test al, al
jne 0x413583
lea eax, [ebp - 0x50]
mov ecx, 0x413880
mov edx, dword [0x415cd8]
call fcn.00403630
mov eax, dword [ebp - 0x50]
mov cl, 0xd9
mov edx, dword [0x415ce4]
call fcn.00412f58
call fcn.00412dac
call sub.user32.dll_GetDesktopWindow
mov ebx, eax
mov eax, dword [0x415cd4]
call fcn.004068e8
test al, al
je 0x4135af
mov eax, dword [0x415cd4]
call fcn.004129dc
test al, al
jne 0x413640
lea eax, [ebp - 0x54]
mov ecx, 0x413890
mov edx, dword [0x415cd8]
call fcn.00403630
mov eax, dword [ebp - 0x54]
call fcn.004068e8
test al, al
je 0x413634
lea eax, [ebp - 0x58]
mov ecx, 0x413890
mov edx, dword [0x415cd8]
call fcn.00403630
mov eax, dword [ebp - 0x58]
call fcn.004129dc
test al, al
je 0x413634
lea eax, [ebp - 0x5c]
mov ecx, 0x413890
mov edx, dword [0x415cd8]
call fcn.00403630
mov eax, dword [ebp - 0x5c]
mov cl, 0xd9
mov edx, dword [0x415cd4]
call fcn.00412dc0
push 1
push 0x41389c
push 0x41389c
mov eax, dword [0x415cd4]
call fcn.004037a8
push eax
push 0x4138a0
push ebx
call sub.shell32.dll_ShellExecuteA
jmp 0x413669
mov eax, 0xd
call fcn.004127d0
jmp 0x413669
xor eax, eax
call fcn.00412ad4
push 1
push 0x41389c
push 0x41389c
mov eax, dword [0x415cd4]
call fcn.004037a8
push eax
push 0x4138a0
push ebx
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41368b
lea eax, [ebp - 0x5c]
mov edx, 0x14
call fcn.004033ac
ret