Function at 0x411a40
Capabilities:
Create process on windows
Create thread
Get file size
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472408
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x48d000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebx + 0x384]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1b4]
push 7
call edx
mov eax, dword [0x4905b8]
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411ac5
mov ecx, dword [ebx + 4]
push 0
push 0x47eaa0
push 0x47fca8
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push 0
push 0x400
push eax
push ecx
call fcn.004607c0
push 0
push 0x400
push edx
push eax
call fcn.004607c0
test edx, edx
jg 0x411b2b
jl 0x411afd
cmp eax, 0x64
jae 0x411b2b
mov edx, dword [ebx + 4]
push 0
push 0x47eaa0
push 0x47fcc0
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4905b8]
cmp dword [eax - 0xc], 0
jge 0x411b47
push 0x80070057
call fcn.004020c0
movzx ecx, word [0x4905c8]
movzx eax, word [eax]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.0041a000
mov dword [ebp - 4], 0
mov ax, word [0x4905c8]
movzx edx, ax
movzx eax, ax
push edx
push eax
lea ecx, [ebp - 0x10]
call fcn.0041a000
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
cmp dword [ecx - 0xc], 0
je 0x411cb8
mov edx, dword [ebp - 0x14]
cmp dword [edx - 0xc], 0
je 0x411cb8
mov eax, dword [0x4905b8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.00401a40
add eax, 0x10
mov dword [esi], eax
mov esi, 0x4903a0
call fcn.00416d10
test eax, eax
jne 0x411be6
push 1
push 0x47f748
push 0x47fd08
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x411be6
push 0
push 0
push 2
mov ecx, ebx
call fcn.0042803a
jmp 0x411c97
mov esi, 0x4903a0
call fcn.00417a40
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
push 0x47fd78
lea edi, [ebp - 0x18]
call fcn.004019a0
mov ecx, dword [ebx + 0x468]
add esp, 0xc
push 0x47fdf0
call fcn.00431460
call fcn.00414840
mov edx, dword [ebx + 4]
push 0
push 0
push edx
push 0x410950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebx + 4]
push 4
mov esi, eax
mov eax, dword [ebp - 0x18]
push 0x47eaa0
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x411c7f
push 1
call fcn.00414930
push 0
push str.cmd__c_shutdown__r__t_0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x411c8f
push 2
call fcn.00414930
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [ebp - 0x18]
call fcn.004020a0
lea ecx, [ebp - 0x10]
call fcn.004020a0
lea ecx, [ebp - 0x14]
call fcn.004020a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 4]
push 0
push 0x47eaa8
push 0x47eab0
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411cf1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411d17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret