Function at 0x413a71
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
push edi
mov esi, 0x47f0b8
je 0x413af9
mov edi, 0x47f2ac
mov ecx, esi
push edi
call fcn.004174c1
push edi
mov ecx, esi
call fcn.0041b99b
push 0x7fffffff
push edi
mov ecx, esi
call fcn.0041c515
push 1
mov edi, 0x47f2ac
push ebx
push 0x42cc78
mov ecx, edi
call fcn.0041d929
push eax
push ebx
mov ecx, edi
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0xc]
call fcn.0041cffc
push 1
lea ecx, [ebp - 0xc]
call fcn.0041de81
push eax
push ebx
mov ecx, edi
call fcn.0041de81
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0xc]
call fcn.0041d05e
cmp byte [ebp + 8], bl
je 0x413c8a
mov edi, 0x47f2a0
mov ecx, esi
push edi
call fcn.004174c1
push edi
mov ecx, esi
call fcn.0041b99b
push 0x7fffffff
push edi
mov ecx, esi
call fcn.0041c515
lea ecx, [ebp - 0x18]
call fcn.0041cf28
lea ecx, [ebp - 0x24]
call fcn.0041cf28
mov edi, 0x47f2a0
push ebx
mov ecx, edi
call fcn.0041da2a
cmp al, 0x22
jne 0x413b88
mov ecx, edi
call fcn.0041de81
inc eax
lea ecx, [ebp - 0xc]
push eax
call fcn.0041cf98
push 1
push ebx
push 0x42d148
lea ecx, [ebp - 0xc]
call fcn.0041d81e
cmp eax, 0xffffffff
je 0x413b7e
push eax
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d0e3
lea ecx, [ebp - 0xc]
call fcn.0041d05e
jmp 0x413b95
push 0x47f2a0
lea ecx, [ebp - 0x18]
call fcn.0041d0e3
cmp dword [ebp - 0x18], ebx
jbe 0x413bc5
push 1
push ebx
push 0x42cc78
mov ecx, edi
call fcn.0041d929
cmp eax, 0xffffffff
je 0x413bc5
cmp eax, 1
jle 0x413bc5
push eax
push ebx
mov ecx, edi
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x24]
call fcn.0041d0e3
push 0x10
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00425820
push 0x44
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.00425820
add esp, 0x18
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x84], 0x44
push 1
pop eax
mov dword [ebp - 0x58], eax
mov word [ebp - 0x54], ax
call fcn.0041cf28
push ebx
mov ecx, edi
call fcn.0041da2a
cmp al, 0x22
jne 0x413c1a
push 0x47f2a0
lea ecx, [ebp - 0x30]
call fcn.0041d0e3
jmp 0x413c33
mov ecx, edi
call fcn.0041de81
push eax
lea eax, [ebp - 0x30]
push 0x42d140
push eax
call fcn.0041d5b5
add esp, 0xc
cmp dword [ebp - 0x24], ebx
jbe 0x413c42
lea ecx, [ebp - 0x24]
call fcn.0041de81
jmp 0x413c44
xor eax, eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x84]
push ecx
push eax
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.0041de81
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
call fcn.0041d05e
lea ecx, [ebp - 0x24]
call fcn.0041d05e
lea ecx, [ebp - 0x18]
call fcn.0041d05e
cmp byte [ebp + 0x10], bl
je 0x413d3f
mov edi, 0x47f384
mov ecx, esi
push edi
call fcn.004174c1
push edi
mov ecx, esi
call fcn.0041b99b
push 0x7fffffff
push edi
mov ecx, esi
call fcn.0041c515
push 0x10
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00425820
push 0x44
lea eax, [ebp - 0x84]
pop esi
push esi
push ebx
push eax
call fcn.00425820
add esp, 0x18
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x84], esi
push 1
pop eax
mov dword [ebp - 0x58], eax
mov word [ebp - 0x54], ax
call fcn.0041cf28
mov ecx, 0x47f384
call fcn.0041de81
push eax
lea eax, [ebp - 0xc]
push 0x42d140
push eax
call fcn.0041d5b5
add esp, 0xc
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xc]
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
call fcn.0041de81
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
call fcn.0041d05e
pop edi
pop esi
pop ebx
leave
ret 0xc