Function at 0x40fed9
Capabilities:
Create process on windows
Get process image filename

Disassembly:
push 0x22c
mov eax, 0x43cdcd
call fcn.00423c42
mov eax, dword [ebp + 8]
push 0x73
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x238], eax
pop eax
push 0x63
mov word [ebp - 0x20], ax
pop eax
push 0x62
mov word [ebp - 0x1e], ax
pop eax
push 0x61
pop edi
push 0x42
mov word [ebp - 0x1c], ax
pop eax
push 0x39
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0x18], ax
pop eax
mov word [ebp - 0x16], ax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov dword [ebp - 0x230], esi
mov word [ebp - 0x1a], di
lea edx, [eax + 0x196]
lea ecx, [eax - 0x16f]
add ecx, edx
add eax, ecx
add ecx, edi
push ecx
push edx
push eax
mov dword [esi], eax
mov esi, 0x4552a8
push str._d_d_x
push esi
call fcn.0040a005
add esp, 0x14
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00410a72
push edi
mov edi, esp
pop edi
push 0x44
pop esi
push esi
push 0
push 0x4553a8
call fcn.0041e3e0
push 0x10
push 0
push 0x4553ec
mov dword [0x4553a8], esi
call fcn.0041e3e0
add esp, 0x18
xor eax, eax
inc eax
mov dword [0x4553d4], eax
mov dword [0x45542c], eax
push 5
pop ecx
mov word [0x4553d8], cx
mov word [0x455430], cx
call fcn.004014a4
push eax
lea ecx, [ebp - 0x22c]
call fcn.004012ba
and dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
push 0x22
call fcn.00410a9d
mov edi, dword [ebp - 0x238]
lea ecx, [ebp - 0x22c]
push edi
call fcn.00410a72
push 0x22
lea ecx, [ebp - 0x22c]
call fcn.00410a9d
push 0x20
lea ecx, [ebp - 0x22c]
call fcn.00410a9d
push ebx
lea ecx, [ebp - 0x22c]
call fcn.00410a72
mov esi, dword [ebp - 0x22c]
cmp dword [esi - 4], 1
jle 0x410026
push dword [esi - 0xc]
lea ecx, [ebp - 0x22c]
call fcn.0040a116
mov esi, dword [ebp - 0x22c]
push 0x4553ec
push 0x4553a8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov eax, dword [ebp - 0x230]
je 0x4101d6
mov dword [eax], 0xffcf7f5e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x226]
push eax
mov dword [ebp - 0x230], 0xffe8b33f
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x228]
xor edi, edi
push 0x104
push eax
push dword [0x4553ec]
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jle 0x4101be
lea eax, [ebp + eax*2 - 0x22a]
lea ecx, [ebp - 0x228]
cmp eax, ecx
jb 0x4101be
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x4100d4
cmp ecx, 0x2f
je 0x4100d4
lea ecx, [ebp - 0x228]
inc edi
cmp eax, ecx
jbe 0x4100d7
sub eax, 2
cmp eax, ecx
jae 0x4100b3
jmp 0x4100d7
add eax, 2
test edi, edi
jle 0x4101be
push eax
lea ecx, [ebp - 0x234]
call fcn.00410971
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.00410bed
mov ecx, dword [ebp - 0x234]
call fcn.0041d326
cmp eax, 0x53da980c
je 0x410188
cmp eax, 0x7c44b63d
je 0x410188
cmp eax, 0xa3717f27
jne 0x410136
mov ecx, 0x80054d3
call fcn.004153f6
sub esp, 0xc
xor edx, edx
push 8
pop ecx
call fcn.004135a9
add esp, 0xc
jmp 0x410140
mov ecx, 0x80054d4
call fcn.004153f6
test ebx, ebx
je 0x410161
push ebx
call fcn.0041e3c2
pop ecx
cmp eax, 0xc
jbe 0x410161
cmp word [ebx + 0x14], 0x36
jne 0x410161
mov ecx, 0x80054d5
call fcn.004153f6
sub esp, 0xc
xor edx, edx
push 5
pop ecx
call fcn.004135a9
add esp, 0xc
mov ecx, 0xbbd
call fcn.004153f6
lea edx, [ebp - 0x228]
call fcn.0040ec1d
jmp 0x4101ac
mov ecx, 0x80054d2
call fcn.004153f6
mov ecx, 0xbc7
call fcn.004153f6
sub esp, 0xc
xor edx, edx
push 4
pop ecx
call fcn.004135a9
add esp, 0xc
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.0040153a
push dword [0x4553ec]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [0x4553f0]
call edi
jmp 0x4101e6
mov dword [eax], 0xfff3dfd8
mov dword [ebp - 0x230], 0x19b53b
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00410d60
lea ecx, [esi - 0x10]
call fcn.0040153a
mov eax, dword [ebp - 0x230]
call fcn.00423bf1
ret 0xc