Function at 0x41b3f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bafb
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
mov eax, dword [0x48a1d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x477050
lea ecx, [ebp - 0x28]
call fcn.00406660
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x124], esp
push 0x477074
call fcn.00406660
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x118], ecx
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x120], esp
push 0x477088
call fcn.00406660
mov dword [ebp - 0x11c], eax
push SysStringLen
mov byte [ebp - 4], 0
call fcn.00412d10
add esp, 0x38
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
je 0x41b4bd
mov dword [ebp - 0x104], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406810
mov eax, dword [ebp - 0x104]
jmp 0x41b883
push str.UnZipTheme.exe
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.004188c0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.004067f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x40]
call fcn.004077f0
push eax
call fcn.004106b0
add esp, 8
cmp eax, 1
jne 0x41b55b
push 0x4770cc
mov edx, dword [ebp - 0xa8]
push edx
call fcn.00437104
add esp, 8
test eax, eax
je 0x41b559
mov dword [ebp - 0x10c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.00406840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406810
mov eax, dword [ebp - 0x10c]
jmp 0x41b883
jmp 0x41b59a
mov dword [ebp - 0x114], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.00406840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406810
mov eax, dword [ebp - 0x114]
jmp 0x41b883
push 0x477108
lea ecx, [ebp - 0x58]
call fcn.00406660
mov byte [ebp - 4], 4
push 0x4763a0
mov eax, dword [ebp + 0xc]
push eax
push 0x4763a8
push 0x4763ac
mov ecx, dword [ebp + 8]
push ecx
push 0x4763c0
push 0x4763c4
lea edx, [ebp - 0x28]
push edx
push 0x4763d4
lea eax, [ebp - 0x188]
push eax
call fcn.004189c0
add esp, 0xc
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 0xf4], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xf4]
push edx
lea eax, [ebp - 0x158]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x110], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x1a0]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xf8], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0xf8]
push edx
lea eax, [ebp - 0x1d0]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x108], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x108]
push edx
lea eax, [ebp - 0x140]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x100], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x100]
push edx
lea eax, [ebp - 0x1e8]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xcc], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xcc]
push edx
lea eax, [ebp - 0x1b8]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xd4], eax
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0xdc], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0xdc]
push edx
lea eax, [ebp - 0x170]
push eax
call fcn.00418880
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0x58]
call fcn.0040d260
lea ecx, [ebp - 0x170]
call fcn.00406810
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1b8]
call fcn.00406810
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1e8]
call fcn.00406810
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x140]
call fcn.00406810
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1d0]
call fcn.00406810
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1a0]
call fcn.00406810
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x158]
call fcn.00406810
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x188]
call fcn.00406810
mov dword [ebp - 0x94], 0
push 0x38
push 0
lea edx, [ebp - 0x90]
push edx
call fcn.004369a0
add esp, 0xc
mov dword [ebp - 0x94], 0x3c
mov dword [ebp - 0x90], 0x40
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
lea ecx, [ebp - 0x40]
call fcn.004077f0
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x58]
call fcn.004077f0
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41b831
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x128], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xec], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.00406810
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.00406840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406810
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043715b
mov esp, ebp
pop ebp
ret