Function at 0x414639
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x794
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jae 0x414675
push 0x20a
lea eax, [ebp - 0x284]
push dword [ebp + 0x10]
push eax
call fcn.00593039
add esp, 0xc
and byte [ebp - 0x7b], 0
push ebx
push esi
push edi
push 0x49
call fcn.0045d7b1
pop ecx
push 1
pop ebx
cmp ax, bx
je 0x4146d4
lea eax, [ebp - 0x484]
push 0x200
push eax
push 0x17a
call fcn.0045cd86
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push 0x30f
push eax
call fcn.005932fa
lea eax, [ebp - 0x794]
push eax
call fcn.00481290
add esp, 0x14
jmp 0x4148f0
push 0x54
call fcn.0045d7b1
cmp ax, bx
pop ecx
jne 0x414721
lea eax, [ebp - 0x484]
push 0x200
push eax
push 0x17b
call fcn.0045cd86
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push 0x30f
push eax
call fcn.005932fa
lea eax, [ebp - 0x484]
jmp 0x4146c6
xor edi, edi
cmp word [0x6adfb4], di
jne 0x4148e7
push 0x3c
lea eax, [ebp - 0x3c]
pop esi
push esi
push edi
push eax
call fcn.0059ac73
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 2
mov word [ebp - 0x28], bx
mov word [ebp - 0x24], bx
call fcn.004e66ec
push 0x17e
push eax
mov dword [ebp - 0x20], eax
call fcn.0045cf4c
mov word [ebp - 0x1c], bx
call fcn.004e66ec
push 0x17f
push eax
mov dword [ebp - 0x18], eax
call fcn.0045cf4c
mov word [ebp - 0x14], di
mov word [ebp - 0xc], bx
call fcn.004e66ec
push 0x17d
push eax
mov dword [ebp - 8], eax
call fcn.0045cf4c
mov ax, word [0x6adfb4]
mov esi, 0x1ff
mov word [ebp - 4], ax
lea eax, [ebp - 0x484]
push esi
push eax
push 0x179
call fcn.0045cd86
add esp, 0x30
lea eax, [ebp - 0x284]
mov edi, 0x30f
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push edi
push eax
call fcn.005932fa
call fcn.004694e0
push eax
lea eax, [ebp - 0x794]
push eax
call fcn.004e6b82
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
test eax, eax
je 0x414852
cmp byte [eax], 0
je 0x414852
lea eax, [ebp - 0x284]
push eax
call fcn.00593008
push dword [ebp + 0x14]
mov ebx, 0x209
sub ebx, eax
call fcn.00593008
inc eax
pop ecx
cmp ebx, eax
pop ecx
jbe 0x41484f
mov ebx, 0x20a
lea eax, [ebp - 0x284]
push ebx
push 0x66d38c
push eax
call fcn.00593281
push ebx
lea eax, [ebp - 0x284]
push dword [ebp + 0x14]
push eax
call fcn.00593281
add esp, 0x18
push 1
pop ebx
lea eax, [ebp - 0x484]
push esi
push eax
push 0x17c
call fcn.0045cd86
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push edi
push eax
call fcn.005932fa
call fcn.004694e0
push eax
lea eax, [ebp - 0x794]
push eax
call fcn.004e6b82
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004817e6
push dword [ebp - 0x34]
mov esi, eax
call fcn.004e66f8
push dword [ebp - 0x2c]
call fcn.004e66f8
push dword [ebp - 0x20]
call fcn.004e66f8
push dword [ebp - 0x18]
call fcn.004e66f8
push dword [ebp - 8]
call fcn.004e66f8
mov ax, word [ebp - 4]
add esp, 0x30
mov word [0x6adfb4], ax
xor eax, eax
cmp si, bx
sete al
mov word [0x6adfb6], ax
xor edi, edi
cmp word [0x6adfb6], di
jne 0x4148f5
mov ax, bx
jmp 0x414937
push 0x3c
lea eax, [ebp - 0x78]
pop esi
push esi
push edi
push eax
call fcn.0044c9b0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
pop ebx
leave
ret