Function at 0x409122
Capabilities:
Create process on windows
Set current directory

Disassembly:
push 0x254
mov eax, 0x5366cd
call fcn.0050f173
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], ecx
push 0x567784
push 0x6a
mov esi, 0x464
push esi
mov dword [ebp - 4], 2
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov eax, dword [ebp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x21c], esp
mov ebx, esp
call fcn.00401f7b
mov ecx, dword [ebp - 0x214]
add eax, 0x10
mov dword [ebx], eax
mov ebx, 0x593ccc
mov eax, ebx
call fcn.00409037
test eax, eax
je 0x40942a
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x21c], esp
mov dword [ebp - 0x214], esp
call fcn.00401f7b
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 0x214], esp
add eax, 0xfffffff0
mov dword [ebp - 0x214], esp
call fcn.00401f7b
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, ebx
mov byte [ebp - 4], 2
call fcn.00408fd5
test eax, eax
je 0x40942a
push str.tempconfig
lea eax, [ebp - 0x214]
push eax
call fcn.00407822
push dword [eax]
lea eax, [ebp - 0x210]
push str.ewyoujs.dll___config__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x214]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004016bd
push 0x44
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.0050f300
add esp, 0xc
push dword [0x593ce4]
xor eax, eax
mov dword [ebp - 0x260], 0x44
mov word [ebp - 0x230], ax
mov dword [ebp - 0x234], 1
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0x5677c4
push 0x6a
push esi
push dword [ebp - 0x218]
call edi
push 0x593cd4
lea eax, [ebp - 0x260]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x4092a9
push 0x5677dc
push 0x593cd0
call fcn.00401645
mov eax, ebx
call fcn.004090e0
jmp 0x409439
mov dword [ebp - 0x214], 0x1e
cmp dword [ebp - 0x214], 0x1d
jne 0x4092cc
push 0x567810
push 0x6a
push esi
push dword [ebp - 0x218]
call edi
cmp dword [ebp - 0x214], 0x1b
jne 0x4092e5
push 0x567828
push 0x6a
push esi
push dword [ebp - 0x218]
call edi
push ebx
call fcn.00408c7d
test eax, eax
je 0x40931a
push ebx
call fcn.00409487
test eax, eax
jne 0x409324
mov eax, dword [ebp - 0x214]
dec dword [ebp - 0x214]
test eax, eax
je 0x4093ff
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4092b3
push 0x567840
jmp 0x409293
mov eax, ebx
call fcn.004090e0
push 0x567858
push 0x6a
push esi
push dword [ebp - 0x218]
call edi
push ebx
mov edi, str.0.0.0.0
call fcn.0040956f
mov esi, eax
push 8
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x409356
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x409385
push ebx
call fcn.00408c7d
test eax, eax
je 0x4093ac
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
mov edi, str.0.0.0.0
call fcn.0040956f
mov esi, eax
push 8
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40935a
push dword [0x593d70]
push 1
call fcn.0040cb98
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x69
mov edi, 0x464
push edi
push dword [ebp - 0x218]
call esi
jmp 0x4093e7
push 0x567874
push 0x593cd0
call fcn.00401645
mov eax, ebx
call fcn.004090e0
push 0
push 0x2737
push 0x464
push dword [ebp - 0x218]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x409449
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
call fcn.00409487
test eax, eax
jne 0x4093dc
push eax
push 0x66
push edi
push dword [ebp - 0x218]
call esi
jmp 0x409449
mov esi, ebx
call fcn.00409472
mov eax, ebx
call fcn.004090e0
push 0x567898
push 0x593cd0
call fcn.00401645
push 0
push 0x2737
push 0x464
jmp 0x409441
push 0x5678ac
push 0x593cd0
call fcn.00401645
push 0
push 0x2737
push esi
push dword [ebp - 0x218]
call edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004016bd
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004016bd
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.004016bd
call fcn.0050f1f6
ret 0x10