Function at 0x41fb20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
cmp dword [ebp + 8], 0
je 0x41fbff
push 0x4650c8
push str.Der_Programmpfad_enth
lea eax, [ebp - 0x1d4]
push eax
call fcn.00444f70
add esp, 0xc
push 0x459768
lea edx, [ebp - 0x1d4]
push edx
call fcn.004414ec
add esp, 8
push 0x45976a
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.004414ec
add esp, 8
lea eax, [ebp - 0x1d4]
push eax
push 0x24
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
cmp eax, 6
jne 0x41fbff
push 0x4650c8
lea edx, [ebp - 0x1d4]
push edx
call fcn.004415c8
add esp, 8
cmp byte [ebp - 0x1d4], 0
je 0x41fbdc
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.004415f8
pop ecx
movsx eax, byte [ebp + eax - 0x1d5]
cmp eax, 0x5c
jne 0x41fbdc
lea edx, [ebp - 0x1d4]
push edx
call fcn.004415f8
pop ecx
mov byte [ebp + eax - 0x1d5], 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1d4]
push ecx
push 0x45977e
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov eax, 1
jmp 0x41ff19
push str.c:_temppcddump.txt
lea edx, [ebp - 0x3a0]
push edx
call fcn.004415c8
add esp, 8
push 0x5c
lea ecx, [ebp - 0x3a0]
push ecx
call fcn.004416fd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41fc33
mov eax, dword [ebp - 4]
mov byte [eax], 0
cmp dword [0x4519e4], 0
je 0x41fcb0
call fcn.004042f0
push str.DUMP_ist_EIN._Mach_es_AUS_
push 0x44
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
cmp eax, 6
jne 0x41fda5
push 0x4652d5
push 0x4597a6
push 0x45979e
push str.PCDOCW
call sub.KERNEL32.DLL_WritePrivateProfileStringA
test eax, eax
jne 0x41fc9b
push 0x4652d5
push str.Die_Datei__s_kann_nicht_geschrieben_werden._nWahrscheinlich_wird_die_Datei_von_einer_anderen_Anwendung_verwendet_oder_sie_ist_schreibgesch
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x41fda5
xor edx, edx
mov dword [0x44f8ec], edx
xor ecx, ecx
mov dword [0x4519e4], ecx
jmp 0x41fda5
push str.DUMP_ist_AUS._Mach_es_EIN_
push 0x44
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
cmp eax, 6
jne 0x41fda5
lea eax, [ebp - 0x3a0]
push eax
call fcn.0040444c
pop ecx
test eax, eax
jne 0x41fd00
lea edx, [ebp - 0x3a0]
push edx
push str.Die_Datei__s_kann_nicht_erstellt_werden.
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x41fda5
push 0x4597c3
push str.c:_temppcddump.txt
call fcn.0044362c
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41fd8b
push dword [ebp - 8]
call fcn.00442e70
pop ecx
push 0x4652d5
push 0x4597ce
push str.PCDDUMP
push str.PCDOCW
call sub.KERNEL32.DLL_WritePrivateProfileStringA
test eax, eax
jne 0x41fd5d
push 0x4652d5
push str.Die_Datei__s_kann_nicht_geschrieben_werden._nWahrscheinlich_wird_die_Datei_von_einer_anderen_Anwendung_verwendet_oder_sie_ist_schreibgesch
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x41fda5
xor ecx, ecx
mov dword [0x44f8ec], ecx
mov dword [0x4519e4], 1
push 0
call fcn.0040391c
pop ecx
push 0x4652d5
push str.PathNameProfile_INI____s__r_n
call fcn.0040391c
add esp, 8
jmp 0x41fda5
push str.c:_temppcddump.txt
push str.Die_Datei__s_kann_nicht_erstellt_werden.
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
cmp dword [0x4519e4], 0
je 0x41fe66
push str.c:_temppcddump.txt
push str.Der_Dump_Pfad_enth
lea eax, [ebp - 0x1d4]
push eax
call fcn.00444f70
add esp, 0xc
push 0x459809
lea edx, [ebp - 0x1d4]
push edx
call fcn.004414ec
add esp, 8
push 0x45980b
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.004414ec
add esp, 8
lea eax, [ebp - 0x1d4]
push eax
push 0x24
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
cmp eax, 6
jne 0x41fe66
push str.c:_temppcddump.txt
lea edx, [ebp - 0x1d4]
push edx
call fcn.004415c8
add esp, 8
push 0x5c
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.004416fd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41fe43
mov eax, dword [ebp - 4]
mov byte [eax], 0
push 1
push 0
push 0
lea edx, [ebp - 0x1d4]
push edx
push 0x45981f
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov eax, 1
jmp 0x41ff19
push 0x4652d5
push str.Der_INI_Pfad_enth
lea edx, [ebp - 0x1d4]
push edx
call fcn.00444f70
add esp, 0xc
push 0x45983f
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.004414ec
add esp, 8
push str.Verzeichnis
lea eax, [ebp - 0x1d4]
push eax
call fcn.004414ec
add esp, 8
lea edx, [ebp - 0x1d4]
push edx
push 0x24
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
cmp eax, 6
jne 0x41ff17
push 0x4652d5
lea ecx, [ebp - 0x1d4]
push ecx
call fcn.004415c8
add esp, 8
push 0x5c
lea eax, [ebp - 0x1d4]
push eax
call fcn.004416fd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41fef7
mov edx, dword [ebp - 4]
mov byte [edx], 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1d4]
push ecx
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov eax, 1
jmp 0x41ff19
xor eax, eax
mov esp, ebp
pop ebp
ret