Function at 0x406480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3fe
xor esi, esi
lea ecx, [ebp - 0x406]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x408], ax
call fcn.00414930
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x408]
push 0x41e694
push edx
call edi
lea eax, [ebp - 0x408]
push eax
call fcn.004033d0
add esp, 0xc
call fcn.004077a0
mov dword [ebp - 0x410], eax
call fcn.00407940
cmp eax, 1
jne 0x406508
lea ecx, [ebp - 0x408]
push 0x41e6bc
push ecx
call edi
lea edx, [ebp - 0x408]
push edx
jmp 0x406739
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x40c], 1
mov edi, edi
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x408]
push 0x41e6e4
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x408]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
push esi
push str.C:Program_Filesww2017cfwmcUser7.exe
call fcn.0040e72e
add esp, 8
test eax, eax
jne 0x406752
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x44c], 0x3c
mov dword [ebp - 0x448], 0x40
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], 0x41a750
mov dword [ebp - 0x438], str.__registrystop
mov dword [ebp - 0x434], str.C:Program_Filesww2017cf
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], esi
call ebx
push 0x41e6fc
call fcn.004033d0
add esp, 4
push 0xbb8
call edi
call fcn.00407940
cmp eax, 1
je 0x406797
push 0x7d0
call edi
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp eax, 3
jle 0x406520
cmp dword [ebp - 0x410], esi
je 0x40670c
push 0x41e768
call fcn.004033d0
add esp, 4
push esi
push str.C:Program_Filesww2010cfwmcUser.exe
call fcn.0040e72e
add esp, 8
test eax, eax
jne 0x406685
lea ecx, [ebp - 0x44c]
push ecx
mov dword [ebp - 0x44c], 0x3c
mov dword [ebp - 0x448], 0x40
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], str.wmcUser.exe
mov dword [ebp - 0x438], str.__registrystop
mov dword [ebp - 0x434], str.C:Program_Filesww2010cf
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], esi
call ebx
push 0x41e848
call fcn.004033d0
add esp, 4
push 0xbb8
call edi
push esi
push str.C:Program_Files__x86_WW2010CFwmcUser.exe
call fcn.0040e72e
add esp, 8
test eax, eax
jne 0x4066fe
lea edx, [ebp - 0x44c]
push edx
mov dword [ebp - 0x44c], 0x3c
mov dword [ebp - 0x448], 0x40
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], str.wmcUser.exe
mov dword [ebp - 0x438], str.__registrystop
mov dword [ebp - 0x434], str.C:Program_Files__x86_WW2010CF
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], esi
call ebx
push 0x41e900
call fcn.004033d0
add esp, 4
push 0xbb8
call edi
call fcn.00407940
cmp eax, 1
je 0x406797
add dword [0x4288f0], 8
push 0x41e744
call fcn.004033d0
add esp, 4
lea edx, [ebp - 0x408]
push 0x41e6bc
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x408]
push eax
call fcn.004033d0
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push 0x41e714
call fcn.004033d0
add esp, 4
call fcn.00407940
test eax, eax
jne 0x40677c
add dword [0x4288f0], 8
push 0x41e744
call fcn.004033d0
add esp, 4
lea ecx, [ebp - 0x408]
push 0x41e6bc
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x408]
push edx
jmp 0x406739
lea eax, [ebp - 0x408]
push 0x41e6bc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x408]
push ecx
jmp 0x406739