Function at 0x41f76d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x46279a
call fcn.0043b5c0
sub esp, 0x120
cmp byte [0x47d7d0], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
jne 0x41f79b
cmp byte [0x47e030], 0
je 0x41f825
lea eax, [ebp - 0x11]
push 1
push eax
push 0x47871c
lea ecx, [ebp - 0xb4]
call fcn.0040a6ae
and dword [ebp - 4], 0
mov eax, 0x4789e4
mov ecx, eax
mov dword [ebp - 0xdc], 0x4675b0
test ecx, ecx
mov dword [ebp - 0xbc], 0x4675a8
jne 0x41f7d9
mov eax, 0x47d8e0
lea ecx, [ebp - 0x12]
push 0
push ecx
push eax
lea ecx, [ebp - 0xdc]
call fcn.0040b3c8
lea eax, [ebp - 0xb4]
push 0x15a
push eax
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 1
call fcn.0045d920
and byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.00406320
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.00406320
mov edi, dword [ebp + 8]
and dword [ebp - 0x20], 0
sub esp, 0x28
lea eax, [ebp + 0xb]
mov ecx, esp
mov dword [ebp - 0x24], esp
push 1
push eax
push edi
call fcn.00401717
lea ecx, [ebp - 0x12c]
call fcn.0041fdf0
push 0x3c
lea eax, [ebp - 0x8c]
pop esi
mov dword [ebp - 4], 2
push esi
push 0
push eax
mov byte [ebp - 4], 3
call fcn.0043c750
lea eax, [ebx + 0x244]
lea ecx, [ebx + 0x248]
neg eax
sbb eax, eax
push 0x477914
and eax, ecx
mov dword [ebp - 0x8c], esi
push eax
call fcn.00429a2e
add esp, 0x14
xor ecx, ecx
test al, al
sete cl
lea eax, [ebp - 0x12]
push 1
mov dword [ebp - 0x70], ecx
push eax
push edi
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x88], 0x800440
mov dword [ebp - 0x74], edi
call fcn.0040a6ae
lea eax, [ebx + 0x1a4]
lea ecx, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 4
call fcn.00425dcf
lea ecx, [ebp - 0xb4]
call fcn.0040bc78
mov ecx, ebx
mov dword [ebp - 0x7c], eax
call fcn.0040877c
test al, al
jne 0x41f8f1
mov ecx, ebx
call fcn.0041fd66
test al, al
je 0x41f8f8
mov dword [ebp - 0x80], 0x4789dc
cmp dword [ebp + 0xc], 0
jne 0x41f90d
cmp byte [ebx + 0x161], 0
lea eax, [ebx + 0x1cc]
je 0x41f913
lea eax, [ebx + 0x1f4]
push eax
lea eax, [ebp - 0xdc]
push eax
mov ecx, ebx
call fcn.00425834
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 5
call fcn.0040bc78
mov dword [ebp - 0x78], eax
mov eax, 0x4789c4
mov ecx, eax
mov edi, 0x4675b0
mov esi, 0x4675a8
mov dword [ebp - 0x50], edi
test ecx, ecx
mov dword [ebp - 0x30], esi
jne 0x41f954
mov eax, 0x47d8e0
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b3c8
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.004217ba
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406320
push 0
lea eax, [ebp - 0xb4]
push 0
push eax
mov ecx, ebx
call fcn.004217ba
mov eax, 0x4789bc
mov dword [ebp - 0x50], edi
mov ecx, eax
mov dword [ebp - 0x30], esi
test ecx, ecx
jne 0x41f9aa
mov eax, 0x47d8e0
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b3c8
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 7
call fcn.004217ba
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406320
lea eax, [ebp + 0xf]
push 1
push eax
lea ecx, [ebp - 0x50]
push dword [ebp - 0x80]
call fcn.0040a6ae
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.004217ba
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406320
mov eax, 0x4789b4
mov dword [ebp - 0x50], edi
mov ecx, eax
mov dword [ebp - 0x30], esi
test ecx, ecx
jne 0x41fa1e
mov eax, 0x47d8e0
xor esi, esi
lea ecx, [ebp + 0xf]
push esi
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b3c8
push esi
lea eax, [ebp - 0x50]
push esi
push eax
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.004217ba
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406320
push esi
lea eax, [ebp - 0xdc]
push 1
push eax
mov ecx, ebx
call fcn.004217ba
mov ecx, ebx
call fcn.0042125d
mov eax, dword [ebp - 0xd4]
cmp eax, esi
jne 0x41fa77
mov ebx, 0x4675bc
mov dword [ebp - 0x28], ebx
jmp 0x41fa7f
mov dword [ebp - 0x28], eax
mov ebx, 0x4675bc
lea eax, [ebp + 0xf]
push 1
push eax
lea ecx, [ebp - 0x104]
push dword [ebp - 0x80]
call fcn.0040a6ae
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xa
cmp eax, esi
mov dword [ebp - 0x24], ebx
je 0x41faa4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xac], esi
mov esi, ebx
je 0x41fab4
mov esi, dword [ebp - 0xac]
lea eax, [ebp - 0x11]
push 1
mov edi, 0x47871c
push eax
push edi
lea ecx, [ebp - 0x50]
call fcn.0040a6ae
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xb
test eax, eax
jne 0x41fad5
mov eax, ebx
push dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x17e
push dword [ebp - 0x24]
push esi
push 0x478920
push eax
call fcn.00408446
add esp, 0x14
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xa
call fcn.00406320
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 5
call fcn.00406320
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41fc7b
cmp dword [ebp - 0x54], 0
jne 0x41fba9
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a6ae
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xc
test eax, eax
jne 0x41fb4c
mov eax, ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x4788b4
push eax
mov dword [ebp - 0x18], 0x185
call fcn.00408446
pop ecx
mov byte [ebp - 4], 5
pop ecx
lea ecx, [ebp - 0x104]
call fcn.00406320
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00406320
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00406320
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.0041fe89
xor eax, eax
jmp 0x41fd00
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x113
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x54]
push 0
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x41fc19
cmp eax, 1
jne 0x41fc19
push 1
push ebx
push ebx
lea eax, [ebp - 0x44]
push 0
push eax
call esi
test eax, eax
jne 0x41fbf4
push 0x270001
push eax
push eax
push eax
lea eax, [ebp - 0x44]
push eax
call esi
test eax, eax
je 0x41fbb4
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41fbd2
jmp 0x41fbb4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a6ae
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xd
test eax, eax
jne 0x41fc51
mov eax, 0x4675bc
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x1a9
push 0x478854
push eax
call fcn.00408446
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
jmp 0x41fcc9
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a6ae
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x41fc9a
mov eax, ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x1ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push 0x4787d4
push eax
call fcn.00408446
add esp, 0x10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
call fcn.00406320
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00406320
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00406320
mov esi, dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.0041fe89
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8