Function at 0x416831
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x618
lea ebp, [esp - 4]
mov eax, dword [0x474ea0]
xor eax, ebp
mov dword [ebp + 0x618], eax
push 0x68
mov eax, 0x453c89
call fcn.0043874e
mov ecx, dword [ebp + 0x628]
mov eax, dword [ebp + 0x624]
mov dword [ebp - 0x20], ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00409ff6
and dword [ebp - 4], 0
mov ebx, 0x45a14c
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041658a
push ebx
lea ecx, [ebp - 0x14]
call fcn.00416718
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x4168be
lea ecx, [eax - 0x10]
call fcn.00409012
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.004377fb
add ebp, 0x61c
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, 0x208
push edi
lea ecx, [ebp + 0x410]
push ecx
push eax
call esi
test eax, eax
jne 0x416987
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004092f4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00416562
push 0
push str..exe
lea ecx, [ebp - 0x10]
call fcn.0040fa43
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
jle 0x416978
mov ecx, dword [ebp - 0x10]
add eax, ecx
push ebx
push eax
call fcn.0043bae0
test eax, eax
pop ecx
pop ecx
jle 0x416978
mov ecx, dword [ebp - 0x18]
add eax, ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.004165fc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040955a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00409012
lea ecx, [ebp - 0x10]
call fcn.004096db
push edi
lea eax, [ebp + 0x410]
push eax
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x416978
push edi
push dword [ebp - 0x14]
lea eax, [ebp + 0x410]
push edi
push eax
call fcn.0043ba24
add esp, 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00409012
lea eax, [ebp + 0x410]
push eax
mov edi, 0x410
lea eax, [ebp]
push edi
push eax
call fcn.00438c30
xor ebx, ebx
add esp, 0xc
cmp dword [ebp - 0x20], ebx
je 0x4169c6
push 0x45a140
lea eax, [ebp]
push edi
push eax
call fcn.0043b539
push dword [ebp - 0x20]
lea eax, [ebp]
push edi
push eax
call fcn.0043b539
add esp, 0x18
push 0x44
pop edi
push edi
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.004376f0
mov eax, dword [0x479570]
mov dword [ebp - 0x74], edi
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.00419a90
add esp, 0x14
mov byte [ebp - 4], 3
call fcn.00423024
push eax
lea ecx, [ebp - 0x10]
call fcn.00421c70
mov edi, 0x104
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00409312
push edi
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
lea ecx, [ebp - 0x10]
jne 0x416a27
lea eax, [ebp - 0x1c]
push eax
call fcn.0040955a
jmp 0x416a2e
push 0xffffffffffffffff
call fcn.004091a3
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push 0x28
push ebx
push ebx
push ebx
lea eax, [ebp]
push eax
lea eax, [ebp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x416a7a
lea ecx, [esi - 0x10]
call fcn.00409012
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00409012
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00409012
mov eax, ebx
jmp 0x41689b
xor ebx, ebx
inc ebx
jmp 0x416a55