Function at 0x41af9f
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x470320
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a946c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, 0x484c08
xor edi, edi
push ebx
push edi
mov dword [esp + 0x20], edi
call ebp
push eax
call fcn.004451dd
push str.Event_Viewer
push edi
mov esi, eax
call ebp
push eax
call fcn.004451dd
push ebx
push edi
mov dword [esp + 0x1c], eax
call ebp
push eax
call fcn.004451dd
cmp esi, edi
mov dword [esp + 0x1c], eax
jne 0x41b097
cmp dword [esp + 0x14], edi
jne 0x41b083
cmp eax, edi
jne 0x41b02f
push 5
mov eax, 0x477979
push eax
push eax
push str.eventvwr.msc
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x14], edi
jne 0x41b083
cmp dword [esp + 0x1c], edi
jne 0x41b083
mov eax, dword [esp + 0x18]
inc dword [esp + 0x18]
cmp eax, 0x1e
jge 0x41b083
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
call ebp
push eax
call fcn.004451dd
push str.Event_Viewer
push edi
mov esi, eax
call ebp
push eax
call fcn.004451dd
push ebx
push edi
mov dword [esp + 0x1c], eax
call ebp
push eax
call fcn.004451dd
cmp esi, edi
mov dword [esp + 0x1c], eax
je 0x41b02f
cmp esi, edi
jne 0x41b097
cmp dword [esp + 0x14], edi
jne 0x41b097
cmp dword [esp + 0x1c], edi
je 0x41b3da
call fcn.00442144
push eax
lea ecx, [esp + 0x24]
call fcn.0040132d
cmp esi, edi
mov dword [esp + 0x38], edi
jne 0x41b0c1
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x41b0bd
push str.Event_Viewer
jmp 0x41b0c2
mov esi, dword [esp + 0x1c]
push ebx
lea ecx, [esp + 0x24]
call fcn.00401759
push 0x484bac
mov ecx, esi
call fcn.004486d4
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov dword [esp + 0x1c], edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push edi
push edi
push 7
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push edi
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
push edi
push edi
push 0x28
call ebx
push edi
push 2
push edi
push 0x28
call ebx
push 0x484bac
mov ecx, esi
call fcn.004486d4
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push edi
push edi
push 7
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push edi
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
push edi
push edi
push 0x12
call ebx
push edi
push edi
push edi
push 0x41
call ebx
push edi
push 2
push edi
push 0x41
call ebx
push edi
push 2
push edi
push 0x12
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push edi
push edi
push 7
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push edi
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
push edi
push edi
push 0x43
call ebx
push edi
push 2
push edi
push 0x43
call ebx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x484c08
push str.32770
call ebp
push eax
call fcn.004451dd
push str.Event_Viewer
push str.32770
mov dword [esp + 0x1c], eax
call ebp
push eax
call fcn.004451dd
push 0x484c08
push str.32770
mov dword [esp + 0x30], eax
call ebp
push eax
call fcn.004451dd
cmp dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
jne 0x41b296
cmp dword [esp + 0x28], edi
jne 0x41b290
cmp eax, edi
jne 0x41b290
mov ecx, dword [esp + 0x24]
inc dword [esp + 0x24]
cmp ecx, 0xa
jge 0x41b290
push 0x484c08
push str.32770
call ebp
push eax
call fcn.004451dd
push str.Event_Viewer
push str.32770
mov dword [esp + 0x1c], eax
call ebp
push eax
call fcn.004451dd
push 0x484c08
push str.32770
mov dword [esp + 0x30], eax
call ebp
push eax
call fcn.004451dd
push 0x28
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], edi
mov eax, dword [esp + 0x2c]
je 0x41b225
cmp dword [esp + 0x14], edi
je 0x41b29c
mov eax, dword [esp + 0x14]
jmp 0x41b2b2
mov ecx, dword [esp + 0x28]
cmp ecx, edi
je 0x41b2aa
mov dword [esp + 0x14], ecx
jmp 0x41b2b6
cmp eax, edi
je 0x41b37a
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41b37a
push 0x484b9c
push str.Button
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, edi
mov dword [esp + 0x28], eax
jne 0x41b2fe
mov eax, dword [esp + 0x14]
push 0x484b90
push str.Button
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, edi
mov dword [esp + 0x28], eax
je 0x41b323
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [esp + 0x28]
movzx eax, ax
push eax
mov eax, dword [esp + 0x1c]
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41b37a
mov eax, dword [esp + 0x14]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esp + 0x14]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esp + 0x14]
push edi
push edi
push 7
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x14]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x14]
push edi
push edi
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
push edi
push edi
push 0x4e
call ebx
push edi
push 2
push edi
push 0x4e
call ebx
cmp dword [esp + 0x1c], 3
je 0x41b38c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x41b0e1
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x41b3c5
mov eax, dword [esp + 0x18]
inc dword [esp + 0x18]
cmp eax, 0x14
jge 0x41b3ce
push edi
push edi
push 0x10
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x20]
call ebx
test eax, eax
jne 0x41b3a3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.004010af
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret