Function at 0x410510
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4889d9
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4b2288]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b2288]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
mov edi, dword [esp + 0x134]
xor ebx, ebx
mov esi, 0xf
mov eax, edi
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410573
sub eax, ebp
push eax
push edi
lea ecx, [esp + 0xd4]
call fcn.00404640
push 4
push str.Open
lea ecx, [esp + 0x80]
mov dword [esp + 0x134], ebx
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.00404640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xf0]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x154], 1
mov byte [ecx + 4], bl
call fcn.00404330
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040bb70
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd8]
mov byte [esp + 0x138], 2
call fcn.00404330
mov edi, 0x10
cmp dword [esp + 0x38], edi
mov byte [esp + 0x12c], 1
jb 0x41062a
mov edx, dword [esp + 0x24]
push edx
call fcn.00418702
add esp, 4
mov eax, dword [esp + 0xe0]
push ebx
push 0x48fb7c
push eax
push ebx
lea ecx, [esp + 0xdc]
call fcn.00408790
test eax, eax
jne 0x410692
cmp dword [esp + 0x90], edi
jb 0x41065f
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.00418702
add esp, 4
cmp dword [esp + 0xe4], edi
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x41068a
mov edx, dword [esp + 0xd0]
push edx
call fcn.00418702
add esp, 4
or eax, 0xffffffff
jmp 0x410c94
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 1
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4904ac
mov byte [ecx + 4], bl
call fcn.00404640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 1
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x490b70
mov byte [esp + 0x16c], 3
mov byte [ecx + 4], bl
call fcn.00404640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x68], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x128]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x18c], 4
mov byte [ecx + 4], bl
call fcn.00404330
lea ecx, [esp + 0x74]
push ecx
mov byte [esp + 0x184], 1
call fcn.0040b140
add esp, 0x58
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd8]
mov byte [esp + 0x138], 5
call fcn.00404330
cmp dword [esp + 0x38], edi
mov byte [esp + 0x12c], 1
jb 0x410748
mov edx, dword [esp + 0x24]
push edx
call fcn.00418702
add esp, 4
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4904ac
mov byte [ecx + 4], bl
call fcn.00404640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x110]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x174], 6
mov byte [ecx + 4], bl
call fcn.00404330
lea ecx, [esp + 0x140]
push ecx
mov byte [esp + 0x16c], 1
call fcn.0040fc10
add esp, 0x40
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4904ac
mov byte [esp + 0x154], 7
mov byte [ecx + 4], bl
call fcn.00404640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x110]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov byte [esp + 0x174], 8
mov byte [ecx + 4], bl
call fcn.00404330
lea eax, [esp + 0x124]
push eax
mov byte [esp + 0x16c], 7
call fcn.0040fc10
add esp, 0x40
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x110]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov byte [esp + 0x158], 9
mov byte [ecx + 4], bl
call fcn.00404330
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
mov byte [esp + 0x168], 0xa
mov byte [ecx + 4], bl
push 1
push 0x490010
call fcn.00404640
mov byte [esp + 0x168], 9
call fcn.0040eaf0
add esp, 0x3c
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
cmp eax, 0xffffffff
mov byte [esp + 0x12c], 0xc
je 0x410976
push 0xffffffffffffffff
lea ebp, [eax + 1]
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x114]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00404330
lea ecx, [esp + 0x44]
push ecx
call fcn.0040bc10
add esp, 0x28
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xa0]
mov byte [esp + 0x138], 0xd
call fcn.00404330
cmp dword [esp + 0x38], edi
mov byte [esp + 0x12c], 0xc
jb 0x410919
mov edx, dword [esp + 0x24]
push edx
call fcn.00418702
add esp, 4
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x110]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00404330
lea ecx, [esp + 0x40]
push ecx
call fcn.0040bcd0
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xbc]
mov byte [esp + 0x138], 0xe
call fcn.00404330
cmp dword [esp + 0x38], edi
jb 0x41099f
mov edx, dword [esp + 0x24]
push edx
call fcn.00418702
add esp, 4
jmp 0x41099f
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0xa0]
call fcn.00404330
push ebx
push 0x48fb7c
lea ecx, [esp + 0xb8]
call fcn.00404640
push 0x38
lea ecx, [esp + 0x44]
push ebx
push ecx
call fcn.0045a0f0
add esp, 0xc
cmp dword [esp + 0x90], edi
mov dword [esp + 0x3c], 0x3c
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], ebx
jb 0x4109d6
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x48], edx
jmp 0x4109de
lea eax, [esp + 0x7c]
mov dword [esp + 0x48], eax
cmp dword [esp + 0xac], edi
jb 0x4109f4
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x4c], ecx
jmp 0x4109ff
lea edx, [esp + 0x98]
mov dword [esp + 0x4c], edx
cmp dword [esp + 0x11c], edi
jb 0x410a15
mov eax, dword [esp + 0x108]
mov dword [esp + 0x50], eax
jmp 0x410a20
lea ecx, [esp + 0x108]
mov dword [esp + 0x50], ecx
cmp dword [esp + 0xc8], edi
jb 0x410a36
mov edx, dword [esp + 0xb4]
mov dword [esp + 0x54], edx
jmp 0x410a41
lea eax, [esp + 0xb4]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x138]
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x5c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x410b96
cmp dword [esp + 0x13c], ebx
mov eax, dword [esp + 0x74]
mov ebp, eax
je 0x410a8f
cmp eax, ebx
je 0x410a8f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
mov dword [esp + 0x1c], ebx
jne 0x410a8f
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc8], edi
jb 0x410aaf
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.00418702
add esp, 4
cmp dword [esp + 0xac], edi
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
jb 0x410add
mov edx, dword [esp + 0x98]
push edx
call fcn.00418702
add esp, 4
cmp dword [esp + 0x100], edi
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
jb 0x410b0b
mov eax, dword [esp + 0xec]
push eax
call fcn.00418702
add esp, 4
cmp dword [esp + 0x11c], edi
mov dword [esp + 0x100], esi
mov dword [esp + 0xfc], ebx
mov byte [esp + 0xec], bl
jb 0x410b39
mov ecx, dword [esp + 0x108]
push ecx
call fcn.00418702
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0x11c], esi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
jb 0x410b64
mov edx, dword [esp + 0x7c]
push edx
call fcn.00418702
add esp, 4
cmp dword [esp + 0xe4], edi
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x410b8f
mov eax, dword [esp + 0xd0]
push eax
call fcn.00418702
add esp, 4
xor eax, eax
jmp 0x410c94
cmp dword [esp + 0xc8], edi
jb 0x410baf
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.00418702
add esp, 4
cmp dword [esp + 0xac], edi
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
jb 0x410bdd
mov edx, dword [esp + 0x98]
push edx
call fcn.00418702
add esp, 4
cmp dword [esp + 0x100], edi
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
jb 0x410c0b
mov eax, dword [esp + 0xec]
push eax
call fcn.00418702
add esp, 4
cmp dword [esp + 0x11c], edi
mov dword [esp + 0x100], esi
mov dword [esp + 0xfc], ebx
mov byte [esp + 0xec], bl
jb 0x410c39
mov ecx, dword [esp + 0x108]
push ecx
call fcn.00418702
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0x11c], esi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
jb 0x410c64
mov edx, dword [esp + 0x7c]
push edx
call fcn.00418702
add esp, 4
cmp dword [esp + 0xe4], edi
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x410c8f
mov eax, dword [esp + 0xd0]
push eax
call fcn.00418702
add esp, 4
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00459426
add esp, 0x11c
ret