Function at 0x41bf20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc64
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc14], 0xf
mov dword [ebp - 0xc18], 1
push 0x2c
mov eax, dword [ebp + 8]
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 0xc08], eax
cmp dword [ebp - 0xc08], 0
jne 0x41bf6b
xor eax, eax
jmp 0x41c2b3
push 0x2c
mov ecx, dword [ebp - 0xc08]
add ecx, 1
push ecx
call fcn.00439480
add esp, 8
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0xc0c], 0
jne 0x41bf95
xor eax, eax
jmp 0x41c2b3
mov edx, dword [ebp - 0xc08]
mov byte [edx], 0
mov eax, dword [ebp - 0xc08]
add eax, 1
mov dword [ebp - 0xc08], eax
mov ecx, dword [ebp - 0xc0c]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc0c]
add edx, 1
mov dword [ebp - 0xc0c], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00424f20
add esp, 4
mov ecx, dword [ebp - 0xc08]
push ecx
call fcn.00424f20
add esp, 4
mov edx, dword [ebp - 0xc0c]
push edx
call fcn.00424f20
add esp, 4
push 0x400
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x804]
push ecx
call fcn.00414070
add esp, 0xc
push 0x400
mov edx, dword [ebp - 0xc0c]
push edx
lea eax, [ebp - 0xc04]
push eax
call fcn.00414070
add esp, 0xc
mov ecx, dword [ebp - 0xc08]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x41c059
push 0x400
lea eax, [ebp - 0x404]
push eax
push 0x474a78
push 0
mov ecx, dword [ebp - 0xc08]
push ecx
push 0x80000000
call fcn.004244f0
add esp, 0x18
jmp 0x41c074
push 0x400
mov edx, dword [ebp - 0xc08]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.00414070
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x41c086
mov dword [ebp - 0xc20], 0x46931c
jmp 0x41c090
mov dword [ebp - 0xc20], 0x469324
mov ecx, dword [ebp - 0xc20]
push ecx
lea edx, [ebp - 0xc04]
push edx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0x469330
call fcn.004145f0
add esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x41c0cb
mov dword [ebp - 0xc1c], 0x469350
jmp 0x41c0d5
mov dword [ebp - 0xc1c], 0x469358
mov edx, dword [ebp - 0xc1c]
push edx
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x804]
push edx
push str.Shellexecute__s__s__s_and__s
call fcn.00426800
add esp, 0x14
mov dword [ebp - 0xc64], 0x3c
mov dword [ebp - 0xc60], 0x141
mov dword [ebp - 0xc5c], 0
lea eax, [ebp - 0x804]
mov dword [ebp - 0xc58], eax
lea ecx, [ebp - 0xc04]
mov dword [ebp - 0xc54], ecx
mov dword [ebp - 0xc50], 0
mov dword [ebp - 0xc4c], 0
mov dword [ebp - 0xc48], 5
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0xc40], 0
lea edx, [ebp - 0x404]
mov dword [ebp - 0xc3c], edx
mov dword [ebp - 0xc38], 0
mov dword [ebp - 0xc34], 0
mov dword [ebp - 0xc30], 0
mov dword [ebp - 0xc2c], 0
lea eax, [ebp - 0xc64]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 0xc24], eax
mov dword [0x4736ac], 0
cmp dword [ebp - 0xc24], 0
je 0x41c28a
cmp dword [ebp + 0xc], 0
je 0x41c27b
mov ecx, dword [ebp - 0xc2c]
push ecx
call fcn.00420030
add esp, 4
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0xc14]
sub eax, 1
mov dword [ebp - 0xc14], eax
cmp dword [ebp - 0xc28], 0
je 0x41c236
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xc2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41c225
cmp dword [ebp - 0xc10], 0x103
je 0x41c236
mov eax, dword [ebp - 0xc2c]
push eax
call fcn.00420030
add esp, 4
jmp 0x41c1dd
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xc2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41c267
cmp dword [ebp - 0xc10], 0x103
je 0x41c265
mov eax, dword [ebp - 0xc10]
mov dword [0x4736ac], eax
jmp 0x41c27b
mov dword [ebp - 0xc18], 0
push 0
call fcn.0041c710
add esp, 4
mov ecx, dword [ebp - 0xc2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41c29e
mov dword [ebp - 0xc18], 0
push 0
call fcn.0041c710
add esp, 4
mov edx, dword [0x4736ac]
push edx
call fcn.0041bc10
add esp, 4
mov eax, dword [ebp - 0xc18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret