Function at 0x41a0da
Capabilities:
Create process on windows

Disassembly:
push 0x9ac
mov eax, 0x475a3c
call fcn.0043ef09
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x920], ebx
cmp eax, ebx
je 0x41a59c
push eax
lea ecx, [ebp - 0x854]
call fcn.00447b4e
mov esi, dword [ebp - 0x844]
mov dword [ebp - 4], ebx
cmp esi, 2
jb 0x41a58a
push 0x823
lea eax, [ebp - 0x837]
push ebx
push eax
mov byte [ebp - 0x838], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x854]
add esp, 0xc
push 0x10
pop edi
cmp dword [ebp - 0x840], edi
jae 0x41a15e
lea eax, [ebp - 0x854]
cmp byte [eax], 0x22
jne 0x41a1b7
mov eax, dword [ebp - 0x854]
cmp dword [ebp - 0x840], edi
jae 0x41a177
lea eax, [ebp - 0x854]
cmp byte [eax + esi - 1], 0x22
jne 0x41a1b7
add esi, 0xfffffffe
push esi
push 1
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x854]
call fcn.00447b4e
push eax
lea ecx, [ebp - 0x854]
mov byte [ebp - 4], 1
call fcn.00447b4e
push ebx
push 1
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], bl
call fcn.00447b4e
mov edx, dword [ebp - 0x854]
cmp dword [ebp - 0x840], edi
jae 0x41a1cb
lea edx, [ebp - 0x854]
push 0x824
lea ecx, [ebp - 0x838]
call fcn.00447b4e
pop ecx
test al, al
je 0x41a58a
push 2
or esi, 0xffffffff
push esi
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 2
call fcn.00408d63
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 3
call fcn.00408107
push ebx
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 4
call fcn.0041a024
lea ecx, [ebp - 0x928]
mov byte [ebp - 4], 6
call fcn.004035af
lea ecx, [ebp - 0x930]
call fcn.004035af
lea ecx, [ebp - 0x914]
call fcn.00418c4c
push eax
lea ecx, [ebp - 0x9b8]
call fcn.004114b4
lea eax, [ebp - 0x9b8]
push eax
lea ecx, [ebp - 0x988]
mov byte [ebp - 4], 7
call fcn.00403a4f
lea ecx, [ebp - 0x988]
mov byte [ebp - 4], 8
call fcn.00408107
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x988]
mov byte [ebp - 4], 9
call fcn.0040914a
push eax
lea ecx, [ebp - 0x958]
mov byte [ebp - 4], 0xa
call fcn.00403a4f
lea ecx, [ebp - 0x958]
mov byte [ebp - 4], 0xb
call fcn.00408107
lea ecx, [ebp - 0x85c]
call fcn.004035af
lea ecx, [ebp - 0x864]
call fcn.004035af
lea ecx, [ebp - 0x978]
call fcn.004035af
lea ecx, [ebp - 0x980]
call fcn.004035af
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], 0xf
call fcn.004035af
lea ecx, [ebp - 0x9b0]
call fcn.004035af
push ebx
push esi
push str.https
lea ecx, [ebp - 0x970]
call fcn.00408d63
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x920], 1
push ebx
push ebx
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0x958]
call fcn.004092a7
movzx eax, ax
cmp ax, bx
je 0x41a3bb
push ebx
push esi
push str.http
lea ecx, [ebp - 0x9a0]
call fcn.00408d63
push ebx
push ebx
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x958]
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x920], 3
call fcn.004092a7
movzx eax, ax
cmp ax, bx
je 0x41a3bb
push ebx
push esi
push str.acrobat
lea ecx, [ebp - 0x938]
call fcn.00408d63
push ebx
push ebx
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0x958]
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x920], 7
call fcn.004092a7
movzx eax, ax
mov byte [ebp - 0x919], bl
cmp ax, bx
jne 0x41a3c2
mov byte [ebp - 0x919], 1
test byte [ebp - 0x920], 4
je 0x41a3e8
and dword [ebp - 0x920], 0xfffffffb
lea ecx, [ebp - 0x928]
call fcn.004035af
lea ecx, [ebp - 0x930]
call fcn.004035af
test byte [ebp - 0x920], 2
je 0x41a40e
and dword [ebp - 0x920], 0xfffffffd
lea ecx, [ebp - 0x990]
call fcn.004035af
lea ecx, [ebp - 0x998]
call fcn.004035af
test byte [ebp - 0x920], 1
mov dword [ebp - 4], 0xf
je 0x41a434
lea ecx, [ebp - 0x960]
call fcn.004035af
lea ecx, [ebp - 0x968]
call fcn.004035af
cmp byte [ebp - 0x919], bl
je 0x41a55b
lea eax, [ebp - 0x970]
push eax
call fcn.00447b4e
pop ecx
push eax
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 0x13
call fcn.00403a4f
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 0x14
call fcn.00408107
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0x16
call fcn.004035af
lea ecx, [ebp - 0x968]
call fcn.004035af
mov esi, 0x4859dc
push esi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x854]
call fcn.00447b4e
lea eax, [ebp - 0x838]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x854]
call fcn.00447b4e
push esi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x854]
call fcn.00447b4e
lea ecx, [ebp - 0x938]
call fcn.00408107
mov ecx, dword [ebp - 0x854]
cmp dword [ebp - 0x840], edi
jae 0x41a4f2
lea ecx, [ebp - 0x854]
push dword [ebp - 0x940]
push eax
push ebx
push ecx
push ebx
push dword [ebp - 0x93c]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x928]
mov esi, eax
call fcn.004035af
lea ecx, [ebp - 0x930]
call fcn.004035af
lea ecx, [ebp - 0x948]
call fcn.004035af
lea ecx, [ebp - 0x950]
call fcn.004035af
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 2
call fcn.0040f15f
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x854]
call fcn.00447b4e
mov eax, esi
jmp 0x41a59e
lea ecx, [ebp - 0x948]
call fcn.004035af
lea ecx, [ebp - 0x950]
call fcn.004035af
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 2
call fcn.0040f15f
jmp 0x41a58a
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x854]
call fcn.00447b4e
xor eax, eax
call fcn.0043ef65
ret