Function at 0x441a10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455c16
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x462544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ecx, 0x465238
call fcn.0043e680
movzx eax, al
test eax, eax
je 0x441ac1
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x188]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x188]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x18c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x190]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x190]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x194]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x194]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x50]
jne case.default.0x441d9a
cmp dword [ebp + 0x10], 5
jne 0x441b29
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x9e], 0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x19c], 0
je 0x441b0e
push 0x82c9
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x19c]
call fcn.00429050
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x50]
push ecx
call fcn.00429970
add esp, 4
mov ecx, 0x465238
call fcn.0043e680
movzx edx, al
test edx, edx
jne 0x441b29
push 0xfffffffffffffffe
mov ecx, dword [ebp - 0x24]
call fcn.00440370
cmp dword [ebp + 0x10], 0x1c
jne 0x441b6f
mov ecx, 0x465238
call fcn.0043e680
movzx eax, al
test eax, eax
je 0x441b4c
push 5
mov ecx, dword [ebp - 0x24]
call fcn.00440370
jmp 0x441b6f
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x50]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.004227c0
mov eax, dword [0x464b4c]
mov edx, dword [eax]
mov ecx, dword [0x464b4c]
mov eax, dword [edx + 8]
call eax
cmp dword [ebp + 0x10], 0xf
jne 0x441b99
push 0
mov ecx, dword [0x464af4]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.004227c0
mov edx, dword [0x465178]
mov eax, dword [edx]
mov ecx, dword [0x465178]
mov edx, dword [eax + 8]
call edx
cmp dword [ebp + 0x10], 3
jne 0x441bc9
push 6
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x465238
call fcn.0043e680
movzx edx, al
test edx, edx
jne 0x441bc9
push 0xfffffffffffffffe
mov ecx, dword [ebp - 0x24]
call fcn.00440370
cmp dword [ebp + 0x10], 0x1b
jne 0x441d54
mov ecx, 0x465238
call fcn.0043e680
movzx eax, al
test eax, eax
je 0x441c16
push 0xa
push 0
push 0x17
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push 5
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x441d54
push 0x178
call fcn.0040a34c
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x441c66
push 0x8c
push 0x15e
push 0x30
push 0x459407
push 0x13
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x50]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0042cec0
mov dword [ebp - 0x28], eax
jmp 0x441c6d
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x441d54
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x16c]
mov dword [eax + 0x10c], 0x10
push 8
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x16c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16c]
mov edx, dword [edx]
mov eax, dword [edx + 0x84]
call eax
push 0x32
push 0xe6
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x16c]
call fcn.004216f0
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x16c]
call fcn.00401b40
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16c]
call fcn.00401b20
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x16c]
call fcn.00421730
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x16c]
mov dword [eax + 0x108], 0x10
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00401140
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
je 0x441d4d
push 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x2c], eax
jmp 0x441d54
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 0x10], 0x1d
jne 0x441d7e
mov ecx, 0x465238
call fcn.0043e680
movzx ecx, al
test ecx, ecx
jne 0x441d7e
mov edx, dword [0x464b44]
mov eax, dword [edx]
mov ecx, dword [0x464b44]
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x14
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 4
ja case.default.0x441d9a
mov edx, dword [ebp - 0x30]
jmp dword [edx*4 + 0x441fd8]
push 0
mov ecx, dword [0x464b2c]
call fcn.0044eae0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 0
push 1
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.004219d0
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.004219d0
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.004219d0
jmp case.default.0x441d9a
push 1
mov ecx, dword [0x464b2c]
call fcn.0044eae0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 1
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.004219d0
push 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.004219d0
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.004219d0
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.004219d0
jmp case.default.0x441d9a
push 2
mov ecx, dword [0x464b2c]
call fcn.0044eae0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 2
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.004219d0
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.004219d0
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.004219d0
jmp case.default.0x441d9a
push 3
mov ecx, dword [0x464b2c]
call fcn.0044eae0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 3
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.004219d0
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.004219d0
push 1
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.004219d0
jmp case.default.0x441d9a
push 4
mov ecx, dword [0x464b2c]
call fcn.0044eae0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 4
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.004219d0
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.004219d0
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.004219d0
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.004219d0
push 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.004219d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc