Function at 0x41f95f
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x46276a
call fcn.0043c274
sub esp, 0x120
push ebx
push esi
push edi
xor esi, esi
cmp byte [0x47e280], 0
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
jne 0x41f990
cmp byte [0x47ec98], 0
je 0x41fa1b
lea eax, [ebp - 0x16]
push 1
push eax
push 0x478c04
lea ecx, [ebp - 0xb4]
call fcn.0040a47f
mov eax, 0x478ec4
mov ebx, 0x4675e8
mov ecx, eax
mov dword [ebp - 4], esi
test ecx, ecx
mov dword [ebp - 0xdc], 0x4675f0
mov dword [ebp - 0xbc], ebx
jne 0x41f9ce
mov eax, 0x47e390
lea ecx, [ebp - 0x15]
push esi
push ecx
push eax
lea ecx, [ebp - 0xdc]
call fcn.0040b1f1
lea eax, [ebp - 0xb4]
push 0x15a
push eax
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 1
call fcn.0045d780
and byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.0040604e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.0040604e
jmp 0x41fa20
mov ebx, 0x4675e8
mov edi, dword [ebp + 8]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x24], esi
cmp edi, esi
mov dword [ebp - 0x28], esp
mov dword [ecx], 0x467594
mov dword [ecx + 0x20], 0x46758c
mov eax, edi
jne 0x41fa46
mov eax, 0x47e390
lea edx, [ebp - 0x15]
push 0
push edx
push eax
call fcn.00401779
lea ecx, [ebp - 0x12c]
call fcn.00420045
push 0x3c
lea eax, [ebp - 0x8c]
pop esi
mov dword [ebp - 4], 2
push esi
push 0
push eax
mov byte [ebp - 4], 3
call fcn.0043d1f0
mov eax, dword [ebp - 0x14]
push 0x477b6c
mov dword [ebp - 0x8c], esi
lea ecx, [eax + 0x344]
add eax, 0x348
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call fcn.00429af5
add esp, 0x14
xor ecx, ecx
test al, al
sete cl
mov esi, 0x4675f0
mov dword [ebp - 0x70], ecx
test edi, edi
mov dword [ebp - 0x88], 0x800440
mov dword [ebp - 0x74], edi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x94], ebx
jne 0x41fad3
mov edi, 0x47e390
lea eax, [ebp + 0xb]
push 0
push eax
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040b1f1
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
lea eax, [edi + 0x2a4]
push eax
call fcn.00426008
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x7c], 0x4675fc
test eax, eax
je 0x41fb12
mov dword [ebp - 0x7c], eax
mov ecx, edi
call fcn.004085cc
test al, al
jne 0x41fb28
mov ecx, edi
call fcn.0041ffbb
test al, al
je 0x41fb2f
mov dword [ebp - 0x80], 0x476568
cmp dword [ebp + 0xc], 0
jne 0x41fb44
cmp byte [edi + 0x261], 0
lea eax, [edi + 0x2cc]
je 0x41fb4a
lea eax, [edi + 0x2f4]
push eax
lea eax, [ebp - 0xdc]
push eax
mov ecx, edi
call fcn.00425af6
mov eax, dword [ebp - 0xd4]
mov byte [ebp - 4], 5
test eax, eax
mov dword [ebp - 0x78], 0x4675fc
je 0x41fb71
mov dword [ebp - 0x78], eax
mov eax, 0x478eac
mov dword [ebp - 0x50], esi
mov ecx, eax
mov dword [ebp - 0x30], ebx
test ecx, ecx
mov edi, 0x47e390
jne 0x41fb89
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b1f1
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov byte [ebp - 4], 6
call fcn.00421a2a
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.0040604e
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0xb4]
push 0
push eax
call fcn.00421a2a
mov eax, 0x478ea4
mov dword [ebp - 0x50], esi
mov ecx, eax
mov dword [ebp - 0x30], ebx
test ecx, ecx
jne 0x41fbde
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b1f1
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov byte [ebp - 4], 7
call fcn.00421a2a
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.0040604e
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x50], esi
test eax, eax
mov dword [ebp - 0x30], ebx
jne 0x41fc1c
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b1f1
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov byte [ebp - 4], 8
call fcn.00421a2a
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.0040604e
mov eax, 0x478e9c
mov dword [ebp - 0x50], esi
mov ecx, eax
mov dword [ebp - 0x30], ebx
test ecx, ecx
jne 0x41fc5e
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b1f1
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov byte [ebp - 4], 9
call fcn.00421a2a
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.0040604e
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0xdc]
push 1
push eax
call fcn.00421a2a
mov ecx, dword [ebp - 0x14]
call fcn.004214b1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x14], 0x4675fc
test eax, eax
je 0x41fcbc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x50], esi
test eax, eax
mov dword [ebp - 0x30], ebx
jne 0x41fccb
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b1f1
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xa
test eax, eax
mov dword [ebp - 0x28], 0x4675fc
je 0x41fcef
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0xac]
test ebx, ebx
jne 0x41fcfe
mov ebx, 0x4675fc
lea eax, [ebp - 0x16]
push 1
mov edi, 0x478c04
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a47f
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xb
test eax, eax
mov esi, 0x4675fc
jne 0x41fd27
mov eax, esi
push dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x17e
push dword [ebp - 0x28]
push ebx
push 0x478e08
push eax
call fcn.00408297
add esp, 0x14
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0xa
call fcn.0040604e
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.0040604e
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41fed0
cmp dword [ebp - 0x54], 0
jne 0x41fdfb
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a47f
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xc
test eax, eax
jne 0x41fd9e
mov eax, esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push 0x478d9c
push eax
mov dword [ebp - 0x1c], 0x185
call fcn.00408297
pop ecx
mov byte [ebp - 4], 5
pop ecx
lea ecx, [ebp - 0x104]
call fcn.0040604e
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.0040604e
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.0040604e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.004200e0
xor eax, eax
jmp 0x41ff55
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov esi, 0x113
xor ebx, ebx
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x54]
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
je 0x41fe6a
cmp eax, 1
jne 0x41fe6a
push 1
push esi
push esi
lea eax, [ebp - 0x44]
push ebx
push eax
call edi
test eax, eax
jne 0x41fe46
push 0x270001
push ebx
push ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call edi
test eax, eax
je 0x41fe08
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41fe25
jmp 0x41fe08
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0xf]
push 1
push eax
push 0x478c04
lea ecx, [ebp - 0x104]
call fcn.0040a47f
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xd
cmp eax, ebx
jne 0x41fea6
mov eax, 0x4675fc
push dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x1a9
push 0x478d3c
push eax
call fcn.00408297
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
jmp 0x41ff1e
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a47f
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x41feef
mov eax, esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x1ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20]
push 0x478cbc
push eax
call fcn.00408297
add esp, 0x10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
call fcn.0040604e
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.0040604e
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.0040604e
mov esi, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.004200e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8