Function at 0x401cd9
Capabilities:
Create process on windows

Disassembly:
push 0x124
mov eax, 0x417b92
call fcn.0040b965
mov eax, dword [ebp + 8]
push 0x44
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0xc]
pop esi
xor ebx, ebx
push esi
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x130]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0xa4], ebx
call fcn.0040b9c0
add esp, 0xc
push 0xf
mov dword [ebp - 0x130], esi
pop esi
push ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x64], esi
call fcn.0040158f
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x80], esi
call fcn.0040158f
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x14]
push 4
add eax, 0xfffffffc
push eax
push edi
lea esi, [ebp - 0xe4]
call fcn.00406f9e
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.004013b7
push ebx
push 1
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401469
lea eax, [ebp - 0x7c]
call fcn.00401c60
mov eax, dword [edi + 0x14]
cmp eax, 3
jb 0x4020e6
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov esi, dword [ebp - 0xa0]
imul eax, eax, 0x88
add eax, esi
cmp byte [eax + 0x83], bl
jne 0x401dc1
mov dword [ebp - 0x104], 1
mov word [ebp - 0x100], bx
jmp 0x401dd1
xor ecx, ecx
inc ecx
mov dword [ebp - 0x104], ecx
mov word [ebp - 0x100], cx
cmp byte [eax + 0x82], bl
je 0x4020e6
push str..exe
lea eax, [ebp - 0x7c]
call fcn.0040789c
test al, al
pop ecx
je 0x402037
push ebx
push 0x419c34
push edi
call fcn.00406f79
cmp eax, 0xffffffff
jne 0x401e51
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x41edb0
call fcn.00406ec3
lea edi, [ebp - 0xc8]
call fcn.00401b16
mov edi, dword [ebp - 0x9c]
push 0xffffffffffffffff
push ebx
push eax
xor esi, esi
mov byte [ebp - 4], 3
call fcn.00406fcc
push ebx
push 1
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 1
call fcn.00401469
mov esi, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
imul eax, eax, 0x88
add eax, esi
cmp dword [eax + 0x14], ebx
jne 0x401e9c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x41edb0
call fcn.00406ec3
lea edi, [ebp - 0xc8]
call fcn.00401b16
mov edi, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], 1
cmp dword [eax + 0x18], 0x10
jb 0x401ea7
mov eax, dword [eax + 4]
jmp 0x401eaa
add eax, 4
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx]
imul ecx, ecx, 0x88
lea ecx, [ecx + esi + 0x54]
cmp dword [ecx + 0x18], 0x10
jb 0x401ec7
mov ecx, dword [ecx + 4]
jmp 0x401eca
add ecx, 4
cmp dword [edi + 0x18], 0x10
lea edx, [edi + 4]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa0], edx
jb 0x401ee1
mov edx, dword [edx]
lea ecx, [ebp - 0xd8]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push eax
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test byte [ebp - 0xa4], 1
mov dword [ebp - 0x9c], eax
je 0x401f20
push ebx
push 1
lea ecx, [ebp - 0xc8]
call fcn.00401469
cmp dword [ebp - 0x9c], ebx
je 0x401fcc
test byte [0x41e158], 1
je 0x401f57
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
lea ecx, [eax + 1]
cmp dword [0x41e160], ecx
ja 0x401f80
imul eax, eax, 0x88
cmp byte [eax + esi + 0x85], bl
jne 0x401f80
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
imul eax, eax, 0x88
add esi, eax
cmp byte [esi + 0x81], bl
je 0x401f77
cmp dword [esi + 0xfc], ebx
je 0x401f80
cmp byte [esi - 7], bl
je 0x4020e6
mov esi, dword [ebp - 0xd8]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x41e168], ebx
je 0x4020e6
lea eax, [ebp - 0xa4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4020e6
mov eax, dword [ebp - 0xa4]
cmp eax, 0x103
je 0x4020e6
mov dword [0x41e154], eax
jmp 0x4020e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xa4]
push ecx
push 0x400
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [edi + 0x18], 0x10
mov eax, dword [ebp - 0xa0]
jb 0x401ffb
mov eax, dword [eax]
push dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0x60]
push str.Failed_to_open_file__s._Error:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push str.Error
lea eax, [ebp - 0x60]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4020e6
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
imul eax, eax, 0x88
add eax, esi
cmp dword [eax + 0x14], ebx
jne 0x40207c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x41edb0
call fcn.00406ec3
lea edi, [ebp - 0xc8]
call fcn.00401b16
mov edi, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], 2
cmp dword [eax + 0x18], 0x10
jb 0x402087
mov eax, dword [eax + 4]
jmp 0x40208a
add eax, 4
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx]
imul ecx, ecx, 0x88
lea esi, [ecx + esi + 0x54]
cmp dword [esi + 0x18], 0x10
jb 0x4020a7
mov esi, dword [esi + 4]
jmp 0x4020aa
add esi, 4
cmp dword [edi + 0x18], 0x10
jb 0x4020b5
mov edi, dword [edi + 4]
jmp 0x4020b8
add edi, 4
movzx ecx, word [ebp - 0x100]
push ecx
push eax
push esi
push edi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test byte [ebp - 0xa4], 2
je 0x4020e6
push ebx
push 1
lea ecx, [ebp - 0xc8]
call fcn.00401469
push ebx
push 1
lea ecx, [ebp - 0x98]
call fcn.00401469
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.00401469
call fcn.0040b9af
ret 8