Function at 0x41d710
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474ec8
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00405020
test eax, eax
je 0x41d7c0
push 1
push str._fT:_6R
push 0x4836e8
mov ecx, ebx
call fcn.0043124c
cmp eax, 1
jne 0x41d764
call fcn.00405020
test eax, eax
jle 0x41d764
push eax
call fcn.00408160
add esp, 4
call fcn.00405020
test eax, eax
je 0x41d7c0
push 1
push str._fT:_6R
push 0x4836e8
mov ecx, ebx
call fcn.0043124c
cmp eax, 1
jne 0x41d797
call fcn.00405020
test eax, eax
jle 0x41d797
push eax
call fcn.00408160
add esp, 4
call fcn.00405020
test eax, eax
je 0x41d7b3
push 0
push 0x4837d0
push 0x483800
mov ecx, ebx
call fcn.0043124c
call fcn.00405020
test eax, eax
jne 0x41d9e6
cmp dword [0x4a492c], 0
jne 0x41d7ed
cmp dword [0x4a4924], 0
jne 0x41d7e3
push 0
push 1
push 0x479d58
call fcn.0041e1a0
add esp, 0xc
mov dword [0x4a492c], 1
mov esi, dword [ebp + 8]
push esi
call fcn.00467a90
add esp, 4
test eax, eax
je 0x41d88e
push esi
lea ecx, [ebp + 8]
call fcn.004016a0
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], 0
call fcn.00406eb0
add esp, 4
test eax, eax
je 0x41d835
lea eax, [ebp + 8]
push eax
mov ecx, 0x4a46f0
call fcn.00401e70
push 0
push 1
jmp 0x41d84c
push esi
call fcn.00404410
add esp, 4
mov dword [0x4a4930], 0
push 0
push 2
mov ecx, ebx
call fcn.00428180
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41d9e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x47e5ac
push esi
call edi
test eax, eax
jne 0x41d9c8
push str..rar
push esi
call edi
test eax, eax
jne 0x41d9c8
push str..gif
push esi
call edi
test eax, eax
jne 0x41d997
push str..bmp
push esi
call edi
test eax, eax
jne 0x41d997
push str..ico
push esi
call edi
test eax, eax
jne 0x41d997
push 0x47e4c4
push esi
call edi
test eax, eax
jne 0x41d997
push str..gft
push esi
call edi
test eax, eax
jne 0x41d997
push 0x47e4a0
push esi
call edi
test eax, eax
jne 0x41d997
push 0x47e488
push esi
call edi
test eax, eax
jne 0x41d997
push 0x47e3d8
push esi
call edi
test eax, eax
je 0x41d955
push esi
mov ecx, 0x4a46f0
call fcn.00401f00
push 0
push 1
mov ecx, ebx
call fcn.00428180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x483874
push esi
call edi
test eax, eax
je 0x41d997
push 0
push esi
push 0
call fcn.00404770
add esp, 0xc
push 1
push 0
push 0
push dword [0x4a4760]
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [0x4a4760]
call fcn.00404410
add esp, 4
jmp 0x41d9dc
push esi
call fcn.00407270
add esp, 4
mov ecx, ebx
push 0
push 2
mov dword [0x4a4930], 0
call fcn.00428180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00407df0
add esp, 4
mov ecx, ebx
push 0
push 2
call fcn.00428180
mov dword [0x4a4930], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4