Function at 0x41cc20
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0xe54
lea eax, [esp + 0x254]
push ebx
push ebp
mov ebp, dword [esp + 0xe64]
push esi
push edi
push ebp
push 0x4959f8
push str._sUsers_s.___
push eax
call fcn.004361ae
lea ecx, [esp + 0x74]
lea edx, [esp + 0x174]
push ecx
lea eax, [esp + 0x278]
push edx
push eax
call fcn.0041c9e0
add esp, 0x1c
xor ebx, ebx
test ax, ax
je 0x41ccdf
mov eax, dword [esp + 0xe68]
lea esi, [esp + 0x164]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41cc9f
cmp cl, bl
je 0x41cc9b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41cc9f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x41cc7b
xor eax, eax
jmp 0x41cca4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41ccdf
lea esi, [esp + 0x64]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41ccd2
cmp cl, bl
je 0x41ccce
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41ccd2
add eax, 2
add esi, 2
cmp cl, bl
jne 0x41ccae
xor eax, eax
jmp 0x41ccd7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x41cf7f
mov eax, dword [esp + 0xe70]
push eax
call fcn.0041cb20
lea ecx, [esp + 0x268]
push 0x4826d0
push ecx
mov edi, eax
call fcn.00436380
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x41cd16
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe54
ret
mov edx, dword [0x47bb1c]
push edx
push 0x483150
push esi
call fcn.0043688d
mov eax, dword [0x47b454]
push eax
push 0x483150
push esi
call fcn.0043688d
mov ecx, dword [0x47bbe8]
push ecx
push 0x483150
push esi
call fcn.0043688d
mov edx, dword [0x47bbec]
push edx
push 0x483150
push esi
call fcn.0043688d
push 0x110
push 0x483150
push esi
call fcn.0043688d
push 0x6c
push 0x483150
push esi
call fcn.0043688d
add esp, 0x48
and edi, 0xffff
push edi
push 0x483150
push esi
call fcn.0043688d
mov eax, dword [esp + 0xe74]
push eax
push 0x4823f4
push esi
call fcn.0043688d
push ebp
push 0x4823f4
push esi
call fcn.0043688d
push 2
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
add esp, 0x48
push ebx
push 0x483150
push esi
call fcn.0043688d
mov ecx, dword [0x476168]
push ecx
push 0x483150
push esi
call fcn.0043688d
mov edx, dword [0x476168]
push edx
push 0x483150
push esi
call fcn.0043688d
mov eax, dword [0x476168]
push eax
push 0x483150
push esi
call fcn.0043688d
mov ecx, dword [0x476180]
push ecx
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
add esp, 0x48
push 0x3e8
push 0x483150
push esi
call fcn.0043688d
push 0x1e
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push 1
push 0x483150
push esi
call fcn.0043688d
add esp, 0x48
push str..COM1
push 0x4823f4
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push str.38400
push 0x4823f4
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push str.1500
push 0x4823f4
push esi
call fcn.0043688d
push str._KE_WR_6_1
push 0x4823f4
push esi
call fcn.0043688d
add esp, 0x48
push str._KE_WR_6_0
push 0x4823f4
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push ebx
push 0x483150
push esi
call fcn.0043688d
push 0x483118
push 0x4823f4
push esi
call fcn.0043688d
push 0x482108
push 0x4823f4
push esi
call fcn.0043688d
mov edx, dword [0x47bbe8]
push edx
push 0x483150
push esi
call fcn.0043688d
mov eax, dword [0x47bbe8]
add esp, 0x48
push eax
push 0x483150
push esi
call fcn.0043688d
mov ecx, dword [0x47bbe8]
push ecx
push 0x483150
push esi
call fcn.0043688d
mov edx, dword [0x47bbe8]
push edx
push 0x483150
push esi
call fcn.0043688d
push esi
call fcn.00436200
add esp, 0x28
mov eax, 0xa
push str.UB6LFT.exe
mov dword [esp + 0x24], eax
mov word [esp + 0x44], ax
push 0x4959f8
lea eax, [esp + 0xa6c]
push str._s_s
push eax
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov word [esp + 0x52], bx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x34], 0x173
mov dword [esp + 0x4c], 4
call fcn.004361ae
lea ecx, [esp + 0x274]
lea edx, [esp + 0x674]
push ecx
push str.UB6LFT.exe
push 0x4959f8
push str.__s_s___s
push edx
call fcn.004361ae
add esp, 0x24
lea eax, [esp + 0x54]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x664]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xa84]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xe54
ret