Function at 0x411a30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x463f08
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47dac0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x46cc78
call fcn.00401af0
push ecx
xor edi, edi
mov dword [esp + 0x50], edi
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x46c598
call fcn.00401af0
push 0x481cf4
mov dword [esp + 0x54], 0xffffffff
call fcn.00417820
mov eax, dword [esi + 0xf0]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x18b
push eax
call ebx
test eax, eax
je 0x411c5d
call fcn.004268df
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x411cc1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
lea ebp, [esi + 0xd0]
push edi
mov ecx, ebp
mov dword [esp + 0x50], 1
call fcn.0042d991
mov ecx, dword [esi + 0x164]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x411cc1
mov eax, dword [esp + 0x14]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411b36
test dx, dx
je 0x411b32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411b36
add eax, 4
add ecx, 4
test dx, dx
jne 0x411b10
xor eax, eax
jmp 0x411b3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x411b57
push edi
mov ecx, ebp
call fcn.0042e6fb
test eax, eax
setne dl
mov byte [esi + 0x15e], dl
mov ecx, dword [esi + 0x168]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x411cc1
mov eax, dword [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411b96
test dx, dx
je 0x411b92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411b96
add eax, 4
add ecx, 4
test dx, dx
jne 0x411b70
xor eax, eax
jmp 0x411b9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x411bb7
push edi
mov ecx, ebp
call fcn.0042e6fb
test eax, eax
setne al
mov byte [esi + 0x15d], al
mov ecx, dword [esi + 0x188]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x411cc1
mov eax, dword [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411bf6
test dx, dx
je 0x411bf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411bf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x411bd0
xor eax, eax
jmp 0x411bfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x411c18
push edi
mov ecx, ebp
call fcn.0042e6fb
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x18c], eax
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411c40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xf0]
push 0
push 0
push 0x18b
push ecx
add edi, 1
call ebx
cmp edi, eax
jne 0x411ab1
lea edx, [esp + 0x18]
push edx
push esi
call fcn.00412050
push 0x46baac
lea ecx, [esp + 0x20]
mov dword [esp + 0x4c], 2
call fcn.00401af0
push 0x46cc84
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 3
call fcn.00401af0
mov byte [esp + 0x48], 4
mov edi, dword [esp + 0x14]
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add edi, 0xfffffff0
call edx
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x411ccb
cmp eax, dword [edi]
jne 0x411ccb
mov ebp, edi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x411d07
push 0x80004005
call fcn.00401820
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
jne 0x411ce4
jmp fcn.00401970
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.00448978
add esp, 0x10
add ebp, 0x10
mov dword [esp + 0x28], ebp
mov byte [esp + 0x48], 5
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x411d3e
cmp eax, dword [edi]
jne 0x411d3e
mov ebp, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x411d7a
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
jne 0x411d57
jmp fcn.00401970
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.00448978
add esp, 0x10
add ebp, 0x10
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x48], 7
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411da6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x48], 8
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411dcb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0x174]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004089a0
mov ebp, dword [esp + 0x34]
mov byte [esi + 0x15c], 0
mov eax, dword [ebp - 0xc]
add esp, 8
test eax, eax
mov ebx, 9
je 0x411e20
push ebp
call fcn.004498ce
add esp, 4
test eax, eax
je 0x411e19
cmp eax, ebx
je 0x411e10
mov edi, eax
call fcn.00413b70
jmp 0x411e20
mov byte [esi + 0x15c], 1
jmp 0x411e20
mov byte [esi + 0x15c], 0
push esi
mov byte [esi + 0x15e], 1
mov byte [esi + 0x15d], 1
mov dword [esi + 0x18c], 1
call fcn.00412280
lea eax, [esp + 0x30]
push eax
call fcn.004022a0
add esp, 4
mov byte [esp + 0x48], bl
mov eax, dword [esp + 0x34]
test eax, eax
je 0x411edc
mov ecx, dword [esp + 0x38]
sub ecx, eax
sar ecx, 2
cmp ecx, 1
jbe 0x411edc
mov eax, dword [eax + 4]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00401a80
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x46cc88
mov byte [esp + 0x54], 0xa
call fcn.00401af0
mov byte [esp + 0x50], bl
call fcn.0040a8a0
add esp, 8
test eax, eax
jne 0x411f41
mov eax, dword [esp + 0x18]
push 5
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401a80
lea ecx, [esp + 0x2c]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.00407790
mov eax, dword [eax]
add esp, 8
push eax
push 0
jmp 0x411f0f
mov eax, dword [esp + 0x18]
push 5
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401a80
lea ecx, [esp + 0x2c]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.00407790
mov eax, dword [eax]
add esp, 8
push eax
push str.tray
mov edx, dword [esp + 0x24]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411f41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.004130e0
call fcn.00413060
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x411f60
xor ebx, ebx
cmp dword [0x481d14], ebx
push 0x3e8
je 0x411f7b
call edi
add esi, 1
cmp esi, 0xa
jl 0x411f60
jmp 0x411f7d
call edi
mov byte [esp + 0x48], 8
mov esi, dword [esp + 0x34]
cmp esi, ebx
je 0x411fc6
mov eax, dword [esp + 0x38]
cmp esi, eax
mov edi, eax
je 0x411fbd
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411fb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x411f94
mov esi, dword [esp + 0x34]
push esi
call fcn.00426848
add esp, 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x48], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411ff3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412013
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41203b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret