Function at 0x414b1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452428
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x27c
mov dword [ebp - 0x280], ecx
lea ecx, [ebp - 0x21c]
call fcn.0043d7b0
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x280]
call fcn.0041555f
push 0
mov ecx, dword [ebp - 0x280]
call fcn.00415615
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x1320]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov edx, dword [ebp - 0x280]
mov eax, dword [edx + 0x1328]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x280]
add ecx, 0x114c
call fcn.004051b0
test eax, eax
je 0x414be6
push 0
mov ecx, dword [ebp - 0x280]
add ecx, 0x114c
call fcn.004051f0
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
push ecx
call sub.MFC42u.DLL_operatordelete
add esp, 4
push 1
push 0
mov ecx, dword [ebp - 0x280]
add ecx, 0x114c
call sub.MFC42u.DLL_CPtrArray::RemoveAt
jmp 0x414b92
mov ecx, dword [ebp - 0x280]
add ecx, 0x1160
call fcn.004051b0
test eax, eax
je 0x414c3a
push 0
mov ecx, dword [ebp - 0x280]
add ecx, 0x1160
call fcn.004051f0
mov dword [ebp - 0x278], eax
mov edx, dword [ebp - 0x278]
push edx
call sub.MFC42u.DLL_operatordelete
add esp, 4
push 1
push 0
mov ecx, dword [ebp - 0x280]
add ecx, 0x1160
call sub.MFC42u.DLL_CPtrArray::RemoveAt
jmp 0x414be6
mov dword [ebp - 0x10], 0x64
push 0
lea eax, [ebp - 0x10]
push eax
push 4
push 0x461da0
push 1
push 0x80000001
lea ecx, [ebp - 0x21c]
call fcn.0043dc91
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x280]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x1c4]
mov dword [ebp - 0x10], 1
push 0
lea edx, [ebp - 0x10]
push edx
push 4
push 0x461dc4
push 1
push 0x80000001
lea ecx, [ebp - 0x21c]
call fcn.0043dc91
push 0
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x1c4]
mov ecx, dword [ebp - 0x280]
cmp dword [ecx + 0x1314], 0
je 0x414cf2
mov ecx, dword [ebp - 0x280]
call fcn.00416c7f
call fcn.00417670
mov ecx, eax
call fcn.00421ecc
mov edx, dword [ebp - 0x280]
cmp dword [edx + 0x6c8], 0
je 0x414d75
mov eax, dword [ebp - 0x280]
cmp dword [eax + 0x11a4], 0
je 0x414d57
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x6c8]
mov edx, dword [ebp - 0x280]
mov eax, dword [edx + 0x6c8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x94]
mov eax, dword [ebp - 0x280]
mov dword [eax + 0x11a4], 0
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x6c8]
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x6c8]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x280]
cmp dword [ecx + 0x6a8], 0
je 0x414db2
mov edx, dword [ebp - 0x280]
mov eax, dword [edx + 0x6a8]
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x6a8]
mov ecx, dword [edx]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x280]
mov dword [edx + 0x6a8], 0
mov eax, dword [ebp - 0x280]
cmp dword [eax + 0x6ac], 0
je 0x414def
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x6ac]
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x6ac]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x280]
mov dword [ecx + 0x6ac], 0
mov edx, dword [ebp - 0x280]
cmp dword [edx + 0x6a4], 0
je 0x414e2c
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x6a4]
mov edx, dword [ebp - 0x280]
mov eax, dword [edx + 0x6a4]
mov edx, dword [eax]
push ecx
call dword [edx + 8]
mov eax, dword [ebp - 0x280]
mov dword [eax + 0x6a4], 0
call dword [sym.imp.CTIntrfu.dll_void___stdcall_CTFreeUnusedLibraries_void_]
push 0
push 0x461df0
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0043fe33
mov dword [ebp - 0x284], eax
mov edx, dword [ebp - 0x284]
mov dword [ebp - 0x288], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x288]
call fcn.00402b00
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x27c]
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0043fde3
test eax, eax
je 0x414f0a
push 0x44
push 0
lea edx, [ebp - 0x270]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x270], 0x44
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x270]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push str.__uc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x414f0a
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x280]
mov eax, dword [edx + 0x6fc]
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx + 0x700]
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea ecx, [ebp - 0x21c]
call fcn.0043ff04
cmp eax, 1
jne 0x414f59
mov eax, dword [ebp - 0x280]
mov cx, word [eax + 0x684]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0043f006
call fcn.00417670
mov ecx, eax
add ecx, 0xc4
call fcn.004346b4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0043d7be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret