Function at 0x41b38b
Capabilities:
Create process on windows

Disassembly:
push 0x78
mov eax, 0x431f5c
call fcn.0041d228
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x41b6f3
cmp esi, 0x10000
jae 0x41b6f3
push 0x3c
pop edi
push edi
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0041eb10
mov bh, byte [ebp + 0x28]
add esp, 0xc
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x80], 0x1c0
test bh, bh
je 0x41b3e8
mov dword [ebp - 0x80], 0x5c0
mov edx, dword [ebp + 0x20]
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp edx, 7
jbe 0x41b3f8
mov eax, ecx
push 0x22
pop edi
cmp word [eax], di
lea eax, [ebp + 0xc]
jne 0x41b40f
cmp edx, 7
jbe 0x41b40a
mov eax, ecx
add eax, 2
jmp 0x41b416
cmp edx, 7
jbe 0x41b416
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x74], eax
mov eax, edi
test esi, esi
je 0x41b4ac
lea edi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b42f
mov edi, ecx
push 0x22
pop esi
cmp word [edi + eax*2], si
mov esi, dword [ebp + 0x1c]
jne 0x41b471
jmp 0x41b453
lea edi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b447
mov edi, ecx
push 0x22
pop edx
cmp word [edi + eax*2], dx
mov edx, dword [ebp + 0x20]
je 0x41b45a
inc eax
cmp eax, esi
jb 0x41b43d
jmp 0x41b471
lea esi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b464
mov esi, ecx
push 0x20
pop ecx
mov word [esi + eax*2], cx
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0xc]
lea edi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b47b
mov edi, ecx
push 0x20
pop esi
cmp word [edi + eax*2], si
mov esi, dword [ebp + 0x1c]
je 0x41b61a
lea edi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b495
mov edi, ecx
cmp word [edi + eax*2 + 2], 0x2f
je 0x41b61a
inc eax
cmp eax, esi
jb 0x41b425
xor edi, edi
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x41b4b8
cmp word [eax], di
jne 0x41b4db
test bh, bh
jne 0x41b4db
cmp dword [0x45bba0], 0
je 0x41b4db
cmp dword [0x45bba4], 7
mov eax, 0x45bb90
jbe 0x41b4d8
mov eax, dword [0x45bb90]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x74]
mov dword [ebp - 0x68], eax
call fcn.0040655f
mov esi, eax
test esi, esi
je 0x41b505
push str..inf
push esi
call fcn.0040cd59
test eax, eax
jne 0x41b505
mov dword [ebp - 0x78], 0x435254
push dword [ebp - 0x74]
lea ecx, [ebp - 0x40]
call fcn.004014a2
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00404c97
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.00401780
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 0x18], 0
pop edi
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
test bl, bl
je 0x41b57e
push dword [ebp - 0x74]
lea ecx, [ebp - 0x40]
call fcn.004014a2
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00405ff4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00401780
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
jbe 0x41b57b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41b6aa
xor eax, eax
mov bl, al
cmp byte [0x45bb38], al
jne 0x41b5af
test bh, bh
jne 0x41b5af
cmp byte [0x45bb1f], al
je 0x41b65b
mov edi, dword [ebp - 0x44]
test edi, edi
je 0x41b5cd
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41b5cd
xor eax, eax
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov bl, 1
push 0x7d0
push dword [ebp - 0x4c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x4c]
call fcn.0041ba88
cmp byte [0x45bb1f], 0
je 0x41b65e
test bh, bh
jne 0x41b65e
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41b65e
mov eax, dword [ebp - 0x48]
cmp eax, dword [0x45c03c]
jbe 0x41b611
mov dword [0x45c03c], eax
mov byte [0x45c040], 1
jmp 0x41b65e
lea esi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b624
mov esi, ecx
push 0x20
pop edi
cmp word [esi + eax*2], di
jne 0x41b643
lea esi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b637
mov esi, ecx
xor ecx, ecx
mov word [esi + eax*2], cx
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0xc]
lea esi, [ebp + 0xc]
cmp edx, 7
jbe 0x41b64d
mov esi, ecx
inc eax
xor edi, edi
lea eax, [esi + eax*2]
mov dword [ebp - 0x70], eax
jmp 0x41b4af
mov edi, dword [ebp - 0x44]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41b67a
push str..exe
push esi
call fcn.0040cd59
test eax, eax
je 0x41b699
cmp byte [0x45bb38], 0
je 0x41b699
test bh, bh
jne 0x41b699
cmp byte [0x45bb1f], bh
jne 0x41b699
mov dword [0x45c044], 0x1b58
test bl, bl
je 0x41b6aa
test bh, bh
je 0x41b6aa
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x14]
push 7
pop ebx
cmp eax, ebx
jbe 0x41b6e7
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x41b6de
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004016c3
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041d176
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
lea ecx, [ebp + 0xc]
call fcn.00401780
call fcn.0041d1d7
ret 0x24