Function at 0x416020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b628
mov eax, dword fs:[0]
push eax
sub esp, 0xa4c
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x9ec], eax
mov dword [ebp - 0x9e4], ecx
call fcn.0042fa4e
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41607f
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x9f8], eax
mov dword [ebp - 4], edi
call fcn.0042fa4e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4160ae
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x9fc], eax
mov byte [ebp - 4], 1
call fcn.0042fa4e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4160de
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x9f4], eax
mov byte [ebp - 4], 2
call fcn.0042fa4e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41610e
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa00], eax
mov byte [ebp - 4], 3
call fcn.0042fa4e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41613e
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x9e8], eax
mov eax, dword [esi]
sub eax, 0x10
push eax
mov byte [ebp - 4], 4
call fcn.00402ba0
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0xa48], esi
mov eax, dword [ebp + 0x14]
mov bl, 5
mov byte [ebp - 4], bl
cmp eax, 1
jne 0x4161d1
cmp dword [ebp + 0x18], edi
jne 0x4161a7
mov ecx, dword [ebp - 0x9ec]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x9e4]
push edx
push esi
push eax
lea ecx, [ebp - 0x9e8]
push str.__s__x___o__ibck___s____s_
push ecx
call fcn.00403af0
add esp, 0x14
jmp 0x4162f9
mov edx, dword [ebp - 0x9ec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x9e4]
push eax
push esi
push ecx
lea edx, [ebp - 0x9e8]
push str.__s__a___ep__ibck___s____s_
push edx
call fcn.00403af0
add esp, 0x14
jmp 0x4162f9
cmp eax, 2
jne 0x41626c
mov eax, dword [ebp - 0x9e4]
push eax
lea ecx, [ebp - 0x9e4]
call fcn.00408390
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 6
call fcn.004037f0
push str.haozipc.exe
push str.haozip.exe
lea ecx, [ebp - 0x9e4]
call fcn.0040ba10
cmp dword [ebp + 0x18], edi
jne 0x416242
mov ecx, dword [ebp - 0x9ec]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x9e4]
push edx
push esi
push eax
lea ecx, [ebp - 0x9e8]
push str.__s__e___s___o__s_
push ecx
call fcn.00403af0
mov eax, dword [ebp - 0x9e4]
jmp 0x4162d7
mov edx, dword [ebp - 0x9ec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x9e4]
push eax
push esi
push ecx
lea edx, [ebp - 0x9e8]
push str.__s__a__tzip___s____s_
push edx
call fcn.00403af0
mov eax, dword [ebp - 0x9e4]
jmp 0x4162d7
cmp eax, 3
jne 0x4162f9
mov ecx, dword [ebp - 0x9e4]
push ecx
lea ecx, [ebp - 0x9f0]
call fcn.00408390
mov byte [ebp - 4], 7
cmp dword [ebp + 0x18], edi
jne 0x4162af
mov edx, dword [ebp - 0x9ec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x9f0]
push eax
push esi
push ecx
push str.__s___x___s____s_
lea edx, [ebp - 0x9e8]
push edx
jmp 0x4162cc
mov eax, dword [ebp - 0x9ec]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x9f0]
push ecx
push esi
push edx
push str.__s____s____s_
lea eax, [ebp - 0x9e8]
push eax
call fcn.00403af0
mov eax, dword [ebp - 0x9f0]
add eax, 0xfffffff0
add esp, 0x14
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4162f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0xa40], edi
mov dword [ebp - 0xa38], edi
mov dword [ebp - 0xa3c], edi
mov dword [ebp - 0xa34], edi
mov dword [ebp - 0xa30], edi
mov dword [ebp - 0xa2c], edi
mov dword [ebp - 0xa28], edi
mov dword [ebp - 0xa24], edi
mov dword [ebp - 0xa20], edi
xor ecx, ecx
mov dword [ebp - 0xa10], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
mov dword [ebp - 0xa44], 0x44
mov dword [ebp - 0xa18], 0x100
mov dword [ebp - 0xa14], ecx
call edi
push 0xfffffffffffffff5
mov dword [ebp - 0xa0c], eax
call edi
push 0xfffffffffffffff4
mov dword [ebp - 0xa08], eax
call edi
mov ebx, dword [ebp - 0x9e8]
mov dword [ebp - 0xa04], eax
mov ecx, dword [ebx - 8]
mov eax, 1
sub eax, dword [ebx - 4]
or ecx, eax
jge 0x41639d
push 0
lea ecx, [ebp - 0x9e8]
call fcn.00402b50
mov ebx, dword [ebp - 0x9e8]
push ebx
lea eax, [ebp - 0x9e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0xa58]
push ecx
lea edx, [ebp - 0xa44]
push edx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x9e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x416402
mov ecx, dword [ebp - 0xa58]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xa58]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0xa54]
push eax
call edi
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416422
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 3
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416442
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xa00]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416468
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x9f4]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 1
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41648e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x9fc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4164b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x9f8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4164d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret