Function at 0x418154
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1cc
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0xf
mov ebx, dword [esi + 0x14]
ja 0x418171
add esi, 4
jmp 0x418174
mov esi, dword [esi + 4]
lea edi, [esi + ebx]
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x8c], 0x53474c
mov dword [ebp - 0x88], 0x53bf48
mov dword [ebp - 0x84], ebp
mov dword [ebp - 0x7c], esp
mov dword [ebp - 0x84], 0x4188cf
lea eax, [ebp - 0xa8]
call fcn.005353b5
cmp ebx, 7
je 0x418201
mov dword [ebp - 0xa0], 0xffffffff
mov dword [esp + 4], ebx
lea eax, [ebp - 0x40]
mov dword [esp], eax
mov dword [esp + 8], 1
call fcn.00403e04
test al, al
je 0x418201
cmp dword [ebp - 0x28], 7
ja 0x4181f2
lea eax, [ebp - 0x3c]
jmp 0x4181f5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0
mov word [eax], 0
mov dword [ebp - 0xa0], 0xffffffff
mov al, byte [ebp - 0x1ac]
mov byte [esp + 0xc], al
mov dword [esp + 8], edi
mov dword [esp + 4], esi
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0041cb00
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x1ac], 0x44
mov dword [ebp - 0xd8], 7
mov dword [ebp - 0xdc], 0
mov word [ebp - 0xec], 0
mov dword [ebp - 0xa0], 1
lea eax, [ebp - 0xf0]
mov dword [esp], eax
mov dword [esp + 8], 4
mov dword [esp + 4], str..exe
call fcn.0041cd04
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xdc]
mov ecx, esi
sub ecx, eax
jb 0x4183bf
cmp dword [ebp - 0xd8], 7
ja 0x41837a
lea edx, [ebp - 0xec]
cmp esi, ecx
jae 0x418384
mov dword [ebp - 0xa0], 2
mov dword [esp], 0x53be8f
call fcn.0051ffa8
sub esp, 4
mov edx, dword [ebp - 0xec]
cmp esi, ecx
jb 0x418361
test eax, eax
je 0x41851a
cmp dword [ebp - 0x28], 7
ja 0x418397
lea esi, [ebp - 0x3c]
jmp 0x41839a
mov esi, dword [ebp - 0x3c]
lea ecx, [esi + ecx*2]
mov dword [ebp - 0xa0], 3
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00524450
test eax, eax
je 0x41851a
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov dword [ebp - 0xa0], 7
lea eax, [ebp - 0x130]
mov dword [esp], eax
mov dword [esp + 4], 0x53be4e
call fcn.00403830
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xa0], 8
mov dword [esp], 0x11
call fcn.0051c414
mov dword [ebp - 0x18], eax
mov ecx, eax
add ecx, 0x11
mov dword [ebp - 0x10], ecx
mov byte [eax + 0x10], 0x20
mov dword [eax + 0xc], 0x74726174
mov dword [eax + 8], 0x7320632f
mov dword [eax + 4], 0x20657865
mov dword [eax], 0x2e646d63
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xa0], 9
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x130]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call fcn.00441330
cmp dword [ebp - 0xfc], 0xf
mov ecx, dword [ebp - 0x100]
ja 0x418492
lea edx, [ebp - 0x110]
jmp 0x418498
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0xbc], 7
mov dword [ebp - 0xc0], 0
mov word [ebp - 0xd0], 0
cmp ecx, 7
je 0x4185e4
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xa0], 0xa
mov dword [ebp - 0xf8], ecx
mov dword [esp + 4], ecx
lea eax, [ebp - 0xd4]
mov dword [esp], eax
mov dword [esp + 8], 1
call fcn.00403e04
test al, al
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xf4]
je 0x4185e4
cmp dword [ebp - 0xbc], 7
ja 0x4185cf
lea eax, [ebp - 0xd0]
jmp 0x4185d5
cmp dword [ebp - 0x28], 7
ja 0x418525
lea ecx, [ebp - 0x3c]
jmp 0x418528
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xa0], 4
lea eax, [ebp - 0xb8]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x1ac]
mov dword [esp + 0x20], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateProcessW
sub esp, 0x28
cmp eax, 1
jne 0x418868
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xa0], 5
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], 6
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov bl, 1
jmp 0x41886a
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xc0], 0
mov word [eax], 0
add ecx, edx
mov dword [ebp - 0xa0], 0xb
mov al, byte [ebp - 0x24]
mov byte [esp + 0xc], al
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [ebp - 0xd4]
mov dword [esp], eax
call fcn.0041ce58
mov dword [ebp - 0xa0], 0xc
lea eax, [ebp - 0x40]
mov dword [esp + 8], eax
lea eax, [ebp - 0xd4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x168]
mov dword [esp], eax
call fcn.00418c20
mov ecx, dword [ebp - 0xbc]
cmp ecx, 8
jb 0x41865e
mov eax, dword [ebp - 0xd0]
lea ecx, [ecx + ecx + 2]
cmp ecx, 0x1000
jb 0x418656
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
cmp dword [ebp - 0x150], 7
ja 0x41866f
lea eax, [ebp - 0x164]
jmp 0x418675
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xa0], 0xd
lea ecx, [ebp - 0xb8]
mov dword [esp + 0x24], ecx
lea ecx, [ebp - 0x1ac]
mov dword [esp + 0x20], ecx
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateProcessW
sub esp, 0x28
cmp eax, 1
jne 0x4187c2
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xa0], 0xe
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], 0xf
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov ecx, dword [ebp - 0x150]
cmp ecx, 8
jb 0x41873d
mov eax, dword [ebp - 0x164]
lea ecx, [ecx + ecx + 2]
cmp ecx, 0x1000
jb 0x418735
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov ecx, dword [ebp - 0xfc]
cmp ecx, 0x10
jb 0x418762
mov eax, dword [ebp - 0x110]
inc ecx
cmp ecx, 0x1000
jb 0x41875a
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418796
mov ecx, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, 0x1000
jb 0x418779
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x4187bb
mov eax, dword [ebp - 0x12c]
inc ecx
cmp ecx, 0x1000
jb 0x4187b3
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov bl, 1
jmp 0x41886a
mov ecx, dword [ebp - 0x150]
cmp ecx, 8
jb 0x4187ea
mov eax, dword [ebp - 0x164]
lea ecx, [ecx + ecx + 2]
cmp ecx, 0x1000
jb 0x4187e2
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov ecx, dword [ebp - 0xfc]
cmp ecx, 0x10
jb 0x41880f
mov eax, dword [ebp - 0x110]
inc ecx
cmp ecx, 0x1000
jb 0x418807
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418843
mov ecx, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, 0x1000
jb 0x418826
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x418868
mov eax, dword [ebp - 0x12c]
inc ecx
cmp ecx, 0x1000
jb 0x418860
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
xor ebx, ebx
mov ecx, dword [ebp - 0xd8]
cmp ecx, 8
jb 0x418892
mov eax, dword [ebp - 0xec]
lea ecx, [ecx + ecx + 2]
cmp ecx, 0x1000
jb 0x41888a
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
mov ecx, dword [ebp - 0x28]
cmp ecx, 8
jb 0x4188b4
mov eax, dword [ebp - 0x3c]
lea ecx, [ecx + ecx + 2]
cmp ecx, 0x1000
jb 0x4188ac
mov eax, dword [eax - 4]
mov dword [esp], eax
call fcn.0051a4c8
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call fcn.005353d6
mov eax, ebx
add esp, 0x1cc
pop esi
pop edi
pop ebx
pop ebp
ret