Function at 0x412d5a
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa4
push esi
mov esi, ecx
cmp dword [esi + 0x5c], 0
je 0x412d72
xor eax, eax
jmp 0x412d87
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
call fcn.00401005
test al, al
je 0x412d8f
xor eax, eax
pop edi
pop esi
add ebp, 0x74
leave
ret 4
push edi
lea ecx, [ebp + 0x64]
call fcn.0042f130
cmp byte [ebp + 0x6b], 0xff
lea eax, [ebp + 0x64]
jne 0x412da4
mov eax, dword [ebp + 0x64]
push 0x472f90
push eax
call fcn.0044eb30
pop ecx
test eax, eax
lea eax, [esi + 0x1b8]
pop ecx
push eax
lea eax, [ebp + 0x6c]
jne 0x412dc6
push 0x473c6c
jmp 0x412dcb
push str.distcode
push eax
call fcn.0042fa40
add esp, 0xc
push eax
lea ecx, [ebp + 0x64]
call fcn.0042f690
lea ecx, [ebp + 0x6c]
call fcn.0042f1e0
lea eax, [esi + 0x188]
push eax
lea eax, [ebp + 0x6c]
push 0x473244
push eax
call fcn.0042fa40
add esp, 0xc
push eax
lea ecx, [ebp + 0x64]
call fcn.0042f690
lea ecx, [ebp + 0x6c]
call fcn.0042f1e0
lea eax, [esi + 0x1c0]
push eax
lea eax, [ebp + 0x6c]
push str.li
push eax
call fcn.0042fa40
add esp, 0xc
push eax
lea ecx, [ebp + 0x64]
call fcn.0042f690
lea ecx, [ebp + 0x6c]
call fcn.0042f1e0
lea ecx, [ebp + 0x44]
call fcn.0042ef80
mov eax, dword [esi + 0x298]
cmp eax, 1
jb 0x412e6d
push eax
push 0x2c
lea eax, [ebp + 0x6c]
push eax
lea ecx, [esi + 0x170]
call fcn.0042fac0
push eax
lea ecx, [ebp + 0x44]
call fcn.0042f220
lea ecx, [ebp + 0x6c]
call fcn.0042f1e0
push ebx
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x6c]
push str.cancelled
push eax
call fcn.0042fa40
add esp, 0xc
push eax
lea ecx, [ebp + 0x64]
call fcn.0042f690
lea ecx, [ebp + 0x6c]
call fcn.0042f1e0
lea ecx, [ebp + 0x54]
call fcn.0042ef80
lea ecx, [ebp + 0x5c]
call fcn.0042ef80
lea eax, [ebp + 0xf]
lea ebx, [esi + 0x320]
push eax
mov ecx, ebx
call fcn.00411785
mov esi, eax
lea edi, [ebp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xf]
push eax
mov ecx, ebx
movsb byte es:[edi], byte [esi]
call fcn.004117b5
push eax
lea ecx, [ebp + 0x24]
call fcn.0040fe23
test al, al
jne 0x412fcf
lea ecx, [ebp + 0x24]
call fcn.0040ff21
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x70], eax
call fcn.0040ff21
mov esi, eax
add esi, 8
xor edi, edi
cmp dword [esi], edi
je 0x412f4e
lea ecx, [ebp + 0x54]
call fcn.00401005
test al, al
jne 0x412f2a
push 0x47396c
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0042f9d0
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
call fcn.0042f220
lea ecx, [ebp + 0x1c]
call fcn.0042f1e0
push dword [ebp + 0x70]
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0042f950
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
call fcn.0042f220
lea ecx, [ebp + 0x34]
call fcn.0042f1e0
cmp dword [esi + 4], edi
je 0x412fa9
lea ecx, [ebp + 0x5c]
call fcn.00401005
test al, al
jne 0x412f85
push 0x47396c
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0042f9d0
add esp, 0xc
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042f220
lea ecx, [ebp + 0x3c]
call fcn.0042f1e0
push dword [ebp + 0x70]
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.0042f950
add esp, 0xc
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042f220
lea ecx, [ebp + 0x4c]
call fcn.0042f1e0
lea ecx, [ebp + 0x24]
call fcn.0040fdf1
lea eax, [ebp + 0xf]
push eax
mov ecx, ebx
call fcn.004117b5
push eax
lea ecx, [ebp + 0x24]
call fcn.0040fe23
test al, al
je 0x412eda
jmp 0x412fd1
xor edi, edi
lea ecx, [ebp + 0x54]
call fcn.00401005
mov esi, str.none
pop ebx
test al, al
je 0x412fec
push esi
lea ecx, [ebp + 0x54]
call fcn.0042f2d0
lea ecx, [ebp + 0x5c]
call fcn.00401005
test al, al
je 0x413001
push esi
lea ecx, [ebp + 0x5c]
call fcn.0042f2d0
lea eax, [ebp + 0x5c]
push eax
push str.acceptedoffer
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push str.displayedoffer
push eax
call fcn.0042fa40
add esp, 0xc
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0042f9d0
add esp, 0xc
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.0042f950
add esp, 0xc
push eax
lea ecx, [ebp + 0x64]
call fcn.0042f690
lea ecx, [ebp + 0x4c]
call fcn.0042f1e0
lea ecx, [ebp + 0x3c]
call fcn.0042f1e0
lea ecx, [ebp + 0x34]
call fcn.0042f1e0
push dword [ebp + 0x7c]
lea eax, [ebp + 0x4c]
push str.action
push eax
call fcn.0042fa40
add esp, 0xc
push eax
lea ecx, [ebp + 0x64]
call fcn.0042f690
lea ecx, [ebp + 0x4c]
call fcn.0042f1e0
push 0x38
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0044f280
add esp, 0xc
cmp byte [ebp + 0x6b], 0xff
mov dword [ebp - 0x30], 0x3c
mov dword [ebp - 0x2c], 0x440
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], str.open
lea eax, [ebp + 0x64]
jne 0x4130b2
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x20], eax
xor esi, esi
lea eax, [ebp - 0x30]
inc esi
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4130ff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x5c]
call fcn.0042f1e0
lea ecx, [ebp + 0x54]
call fcn.0042f1e0
lea ecx, [ebp + 0x44]
call fcn.0042f1e0
lea ecx, [ebp + 0x64]
call fcn.0042f1e0
mov eax, esi
jmp 0x412d86
xor esi, esi
jmp 0x4130d8