Function at 0x41d870
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5629b3
mov eax, dword fs:[0]
push eax
mov eax, 0x1498
call fcn.00528110
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1470], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x203
jne 0x41dc1f
push 0x42c
mov ecx, dword [ebp - 0x1470]
call fcn.004e7012
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp edx, dword [eax + 0x20]
jne 0x41dc1f
xor eax, eax
mov word [ebp - 0x224], ax
push 0x208
push 0
lea ecx, [ebp - 0x222]
push ecx
call fcn.005281f0
add esp, 0xc
lea edx, [ebp - 0x1450]
push edx
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x1474], eax
mov eax, dword [ebp - 0x1474]
mov ecx, dword [eax]
push ecx
push str._sMACAddress.txt
lea edx, [ebp - 0x224]
push edx
call fcn.00527b98
add esp, 0xc
lea ecx, [ebp - 0x1450]
call fcn.00415e20
push 0x574c60
lea eax, [ebp - 0x224]
push eax
call fcn.0052a29d
add esp, 8
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x41dc1f
mov dword [ebp - 0x440], 0
jmp 0x41d971
mov ecx, dword [ebp - 0x440]
add ecx, 1
mov dword [ebp - 0x440], ecx
mov ecx, dword [ebp - 0x1470]
add ecx, 0x1bc
call fcn.0042d5d0
cmp dword [ebp - 0x440], eax
jge 0x41db95
mov byte [ebp - 0x144c], 0
push 0x1000
push 0
lea edx, [ebp - 0x144b]
push edx
call fcn.005281f0
add esp, 0xc
push 2
mov eax, dword [ebp - 0x440]
push eax
lea ecx, [ebp - 0x1454]
push ecx
mov ecx, dword [ebp - 0x1470]
add ecx, 0x1bc
call fcn.004eea6e
mov dword [ebp - 0x1478], eax
mov edx, dword [ebp - 0x1478]
mov dword [ebp - 0x147c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x147c]
call fcn.00415f60
push eax
lea eax, [ebp - 0x1458]
push eax
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x1480], eax
mov ecx, dword [ebp - 0x1480]
mov dword [ebp - 0x1484], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1484]
mov eax, dword [edx]
push eax
push 1
mov ecx, dword [ebp - 0x440]
push ecx
lea edx, [ebp - 0x145c]
push edx
mov ecx, dword [ebp - 0x1470]
add ecx, 0x1bc
call fcn.004eea6e
mov dword [ebp - 0x1488], eax
mov eax, dword [ebp - 0x1488]
mov dword [ebp - 0x148c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x148c]
call fcn.00415f60
push eax
lea ecx, [ebp - 0x1460]
push ecx
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x1490], eax
mov edx, dword [ebp - 0x1490]
mov dword [ebp - 0x1494], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1494]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [ebp - 0x440]
push edx
lea eax, [ebp - 0x1464]
push eax
mov ecx, dword [ebp - 0x1470]
add ecx, 0x1bc
call fcn.004eea6e
mov dword [ebp - 0x1498], eax
mov ecx, dword [ebp - 0x1498]
mov dword [ebp - 0x149c], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x149c]
call fcn.00415f60
push eax
lea edx, [ebp - 0x1468]
push edx
call fcn.00499e90
add esp, 8
mov dword [ebp - 0x14a0], eax
mov eax, dword [ebp - 0x14a0]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x440]
add edx, 1
push edx
push str._d_t_s_t_s_t_s_r_n
lea eax, [ebp - 0x144c]
push eax
call fcn.0052a9d1
add esp, 0x18
lea ecx, [ebp - 0x1468]
call fcn.00412130
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1464]
call fcn.00415e20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1460]
call fcn.00412130
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x145c]
call fcn.00415e20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1458]
call fcn.00412130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1454]
call fcn.00415e20
mov ecx, dword [ebp - 0x228]
push ecx
push 1
lea edx, [ebp - 0x144c]
push edx
call fcn.00529140
add esp, 4
push eax
lea eax, [ebp - 0x144c]
push eax
call fcn.00529a6e
add esp, 0x10
jmp 0x41d962
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.00529b67
add esp, 4
xor edx, edx
mov word [ebp - 0x43c], dx
push 0x208
push 0
lea eax, [ebp - 0x43a]
push eax
call fcn.005281f0
add esp, 0xc
lea ecx, [ebp - 0x146c]
push ecx
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x14a4], eax
mov edx, dword [ebp - 0x14a4]
mov eax, dword [edx]
push eax
push 0x574c78
lea ecx, [ebp - 0x43c]
push ecx
call fcn.00527b98
add esp, 0xc
lea ecx, [ebp - 0x146c]
call fcn.00415e20
push 5
lea edx, [ebp - 0x43c]
push edx
push 0
lea eax, [ebp - 0x43c]
push eax
push 0x574c80
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1470]
call fcn.00496260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 4