Function at 0x41e184
Capabilities:
Create process on windows
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2bc
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], ecx
test ebx, ebx
jne 0x41e1f6
xor edx, edx
mov dword [ebp - 0x28c], edx
jmp 0x41e20b
mov dword [esp + 8], 5
mov dword [esp + 4], str.PATH
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x41e204
mov dword [esp + 8], 5
mov dword [esp + 4], str.Path
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x41e204
add ebx, 4
mov eax, dword [ebx]
mov dword [ebp - 0x28c], eax
test eax, eax
jne 0x41e1af
jmp 0x41e20b
add dword [ebp - 0x28c], 5
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 5
mov dword [esp], eax
call fcn.00411351
mov edi, eax
mov eax, dword [ebp + 0x14]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [ebp - str..exe], 0x42f8a4
add eax, edi
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x290]
mov ebx, dword [eax]
test ebx, ebx
je 0x41e375
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x294]
lea esi, [ebp - 0x220]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
xor eax, eax
mov dword [esp + 0x10], esi
mov ebx, dword [sym.imp.KERNEL32.dll_SearchPathA]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x41e2d6
xor eax, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], edi
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x41e369
cmp eax, 0x104
ja 0x41e369
xor esi, esi
lea eax, [ebp - 0x220]
xor ebx, ebx
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x41e369
mov dword [esp], edi
lea edi, [ebp - 0x11c]
call fcn.004254f4
xor ecx, ecx
lea eax, [ebp - 0x280]
mov dword [esp], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x103
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x41e453
jmp 0x41e45e
add dword [ebp - 0x290], 4
jmp 0x41e24c
mov dword [esp], edi
call fcn.004254f4
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0x2f
je 0x41e3a3
mov ecx, dword [ebp + 0xc]
mov edx, eax
xor eax, eax
mov edi, 1
xor esi, esi
call fcn.0041daa1
mov dword [ebp - 0x28c], eax
jmp 0x41e641
mov dword [esp], str.__SHELL_
xor ebx, ebx
call fcn.0040492d
mov dword [esp + 4], eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x220]
mov dword [esp + 4], 0x42f6d4
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
lea edi, [ebx + 1]
test eax, eax
je 0x41e3f5
mov dword [esp], eax
add esi, 4
call sub.msvcrt.dll_strlen
lea ebx, [eax + edi]
jmp 0x41e3dc
mov dword [esp], edi
call fcn.00411351
mov edi, dword [ebp + 0xc]
mov byte [eax], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x41e42c
mov dword [esp + 4], eax
add edi, 4
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x42f727
mov dword [esp], esi
call sub.msvcrt.dll_strcat
jmp 0x41e405
mov eax, dword [ebp + 0xc]
mov byte [esi + ebx - 1], 0
lea ebx, [ebp - 0x11c]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004254f4
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], esi
mov dword [eax + 4], edx
jmp 0x41e514
mov eax, dword [ebp - 0x280]
cmp eax, 1
ja 0x41e480
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], 0x66
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x41e659
xor ebx, ebx
cmp byte [ebp - 0x11c], 0x23
jne 0x41e4ed
cmp byte [ebp - 0x11b], 0x21
jne 0x41e4ed
mov byte [ebp + eax - 0x11c], 0
mov dword [esp + 4], 0xa
mov dword [esp], edi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x41e4b3
mov byte [eax], 0
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], 0xd
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x41e4d0
mov byte [eax], 0
mov dword [esp], ebx
lea ebx, [ebp - 0x11a]
mov dword [esp + 4], 0x2f
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x41e4ed
lea ebx, [eax + 1]
mov dword [esp], esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
test ebx, ebx
jne 0x41e629
lea esi, [ebp - 0x220]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp eax, 4
ja 0x41e51b
xor esi, esi
jmp 0x41e629
lea edi, [esi + eax - 4]
mov dword [esp + 8], 4
mov esi, dword [sym.imp.msvcrt.dll__strnicmp]
mov dword [esp + 4], str..bat
mov dword [esp], edi
call esi
test eax, eax
jne 0x41e55a
lea edi, [ebp - 0x220]
mov dword [esp + 4], 0x42f72e
mov dword [esp], edi
call sub.msvcrt.dll_strpbrk
test eax, eax
jne 0x41e575
jmp 0x41e514
mov dword [esp + 8], 4
mov dword [esp + 4], str..cmd
mov dword [esp], edi
call esi
test eax, eax
je 0x41e53e
jmp 0x41e514
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x41e514
mov eax, dword [ebp + 0xc]
mov dword [esp], edi
lea esi, [eax + 4]
call sub.msvcrt.dll_strlen
mov edi, esi
lea ebx, [eax + 1]
mov eax, dword [edi]
test eax, eax
je 0x41e5b8
mov dword [esp], eax
add edi, 4
call sub.msvcrt.dll_strlen
lea ebx, [ebx + eax + 1]
jmp 0x41e5a1
mov dword [esp], ebx
lea edi, [ebp - 0x220]
call fcn.00411351
mov dword [ebp - 0x28c], eax
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea edi, [ebx + eax + 1]
mov ebx, dword [esi]
test ebx, ebx
je 0x41e60c
mov dword [esp], edi
add esi, 4
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcpy
mov dword [esi - 4], edi
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea edi, [edi + eax + 1]
jmp 0x41e5e6
mov eax, dword [ebp + 0xc]
mov esi, 1
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004254f4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x28c]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x220]
mov eax, ebx
xor edi, edi
call fcn.0041daa1
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x41e661
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [eax + 0x40], esi
mov dword [eax + 0x44], 0x67
or eax, 0xffffffff
jmp 0x41e8f6
cmp dword [ebp + 0x10], 0
je 0x41e6f4
lea eax, [ebp - 0x278]
mov dword [esp + 8], eax
lea eax, [ebp - 0x27c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0041d976
test eax, eax
jne 0x41e6f4
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 0x67
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call fcn.004254f4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40]
cmp eax, 0x57
je 0x41e6b8
cmp eax, 0xea
jne 0x41e6e7
mov ebx, dword [ebp - 0x278]
cmp ebx, 0x8000
jbe 0x41e6e7
mov dword [esp], 2
call dword [0x428f14]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CreateProcess_failed__probably_because_environment_is_too_large___Iu_bytes_._n
mov dword [esp], eax
call fcn.0041da50
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [eax + 0x40], ebx
jmp 0x41e659
or esi, ebx
jne 0x41e702
lea ebx, [ebp - 0x220]
test edi, edi
je 0x41e704
xor ebx, ebx
lea esi, [ebp - 0x264]
xor eax, eax
mov ecx, 0x11
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor edx, edx
xor ecx, ecx
push eax
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
mov dword [ebp - 0x260], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x238], 0x100
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 8]
mov word [ebp - 0x232], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x224], eax
je 0x41e777
mov eax, dword [ebp - 0x27c]
jmp 0x41e864
test byte [0x43154c], 4
je 0x41e7b9
test ebx, ebx
mov eax, str.NULL
mov ecx, dword [ebp - 0x28c]
mov dword [esp], str.CreateProcess__s__s_...__n
cmovne eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.0041da71
mov dword [esp], 1
call dword [0x428f14]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
lea eax, [ebp - 0x274]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
jne 0x41e871
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], 0x68
test ebx, ebx
jne 0x41e825
mov ebx, str.NULL
mov dword [esp], 2
call dword [0x428f14]
mov edx, dword [ebp - 0x28c]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.process_begin:_CreateProcess__s___s__...__failed._n
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0041da50
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call fcn.004254f4
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call fcn.004254f4
jmp 0x41e659
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x41e8a0
mov dword [esp], eax
call ebx
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41e8b1
mov dword [esp], eax
call ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
cmp eax, 0xffffffff
je 0x41e8c2
mov dword [esp], eax
call ebx
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call fcn.004254f4
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call fcn.004254f4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x44], ecx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret