Function at 0x41ccf6
Capabilities:
Create process on windows

Disassembly:
push 0x74
mov eax, 0x4364ec
call fcn.00434186
mov dword [ebp - 0x44], edx
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004091ad
test al, al
jne 0x41cfa3
call fcn.0040185e
mov esi, eax
cmp esi, 0x10000
jae 0x41cfa3
push 0x3c
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00420420
add esp, 0xc
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x1c0
cmp byte [ebp + 0x20], bl
je 0x41cd58
mov dword [ebp - 0x7c], 0x5c0
push ebx
lea ecx, [ebp + 8]
call fcn.00402344
push 0x22
pop ecx
cmp word [eax], cx
jne 0x41cd73
push 1
lea ecx, [ebp + 8]
call fcn.00402344
mov dword [ebp - 0x70], eax
mov edx, ebx
test esi, esi
je 0x41cde5
push edx
lea ecx, [ebp + 8]
call fcn.00402344
push 0x22
pop ecx
cmp word [eax], cx
jne 0x41cdb8
lea ecx, [ebp + 8]
inc edx
call fcn.0040185e
mov esi, eax
jmp 0x41cdac
push edx
lea ecx, [ebp + 8]
call fcn.00402344
push 0x22
pop ecx
cmp word [eax], cx
je 0x41cdb2
inc edx
cmp edx, esi
jb 0x41cd9a
jmp 0x41cdb8
push 0x20
pop ecx
mov word [eax], cx
push edx
lea ecx, [ebp + 8]
call fcn.00402344
push 0x20
pop ecx
inc edx
cmp word [eax], cx
je 0x41ce10
push edx
lea ecx, [ebp + 8]
call fcn.00402344
cmp word [eax], 0x2f
je 0x41ce15
lea ecx, [ebp + 8]
call fcn.0040185e
cmp edx, eax
jb 0x41cd7c
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x41cdf1
cmp word [eax], bx
jne 0x41ce23
mov bh, byte [ebp + 0x20]
test bh, bh
jne 0x41ce26
mov ecx, 0x4459e8
call fcn.004091ad
test al, al
jne 0x41ce26
call fcn.0040126f
mov dword [ebp - 0x6c], eax
jmp 0x41ce26
xor ecx, ecx
mov word [eax], cx
push edx
lea ecx, [ebp + 8]
call fcn.00402344
mov dword [ebp - 0x6c], eax
jmp 0x41cde8
mov bh, byte [ebp + 0x20]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
call fcn.0040e9b4
mov esi, eax
test esi, esi
je 0x41ce51
mov edx, str..inf
mov ecx, esi
call fcn.0041421a
test eax, eax
jne 0x41ce51
mov dword [ebp - 0x74], 0x43e574
push dword [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00401ce3
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040ce34
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00401e29
lea ecx, [ebp - 0x40]
call fcn.004021b6
mov byte [ebp - 4], 2
test bl, bl
je 0x41ceaf
push dword [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00401ce3
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.0040efad
lea ecx, [ebp - 0x28]
call fcn.00401e29
lea ecx, [ebp - 0x40]
call fcn.0040126f
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41cf9b
cmp byte [0x4459a8], 0
jne 0x41ced6
test bh, bh
jne 0x41ced6
cmp byte [0x445982], bh
je 0x41cf44
test edi, edi
je 0x41cef3
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
xor ebx, ebx
test eax, eax
je 0x41cef5
push ebx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov bl, 1
jmp 0x41cef5
xor ebx, ebx
push 0x7d0
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0x48]
call fcn.0041cfb3
cmp byte [0x445982], 0
je 0x41cf46
cmp byte [ebp + 0x20], 0
jne 0x41cf46
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41cf46
mov eax, dword [ebp - 0x44]
cmp eax, dword [0x445ebc]
jbe 0x41cf3b
mov dword [0x445ebc], eax
mov byte [0x445983], 1
jmp 0x41cf46
xor ebx, ebx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41cf63
mov edx, str..exe
mov ecx, esi
call fcn.0041421a
test eax, eax
je 0x41cf87
cmp byte [0x4459a8], 0
mov al, byte [ebp + 0x20]
je 0x41cf8a
test al, al
jne 0x41cf8a
cmp byte [0x445982], al
jne 0x41cf8a
mov dword [0x445ed8], 0x1b58
jmp 0x41cf8a
mov al, byte [ebp + 0x20]
test bl, bl
je 0x41cf9b
test al, al
je 0x41cf9b
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x40]
call fcn.00401e29
lea ecx, [ebp + 8]
call fcn.00401e29
call fcn.00434135
ret 0x1c