Function at 0x41ac60
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4684b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x798
mov eax, dword [0x487cdc]
push ebx
push esi
push edi
mov dword [esp + 0x79c], eax
mov esi, ecx
call fcn.00462fcd
mov ecx, dword [eax + 4]
call fcn.0045cc76
xor ebx, ebx
mov dword [esp + 0x7ac], ebx
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x7ac], 1
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x7ac], 2
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x7ac], 3
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x7ac], 4
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x7ac], 5
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x28c]
mov byte [esp + 0x7b0], 6
call fcn.0045acd0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x32c]
call fcn.0045acd0
lea edx, [esp + 0x14]
push edx
lea ecx, [esi + 0x3cc]
call fcn.0045acd0
mov eax, dword [esp + 0x1c]
push eax
push str._APMXE_
lea ecx, [esp + 0x20]
call fcn.00403450
mov ecx, dword [esp + 0x1c]
push ecx
push str._APMXE_
lea ecx, [esp + 0x1c]
call fcn.00403450
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0040b590
xor eax, eax
mov byte [esp + 0x88], bl
mov ecx, 0xc2
lea edi, [esp + 0x89]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x88]
push eax
push 0x30c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [esp + 0x14]
xor eax, eax
mov byte [esp + 0x398], bl
mov ecx, 0xff
lea edi, [esp + 0x399]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str.nginx.exe
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push str._s__c___s_
push eax
call fcn.0042f210
mov ecx, dword [esp + 0x30]
add esp, 0x10
push ecx
lea edx, [esp + 0x39c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x44]
push edx
push ebx
push ebx
push 0x8000000
mov dword [esp + 0x44], eax
push ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
push ebx
mov dword [esp + 0x58], eax
push ebx
lea eax, [esp + 0x3b8]
push eax
push ebx
mov dword [esp + 0x68], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
je 0x41aee5
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x34]
push edx
call edi
push ebx
lea ecx, [esi + 0x55c]
call fcn.0045c3ad
push 1
lea ecx, [esi + 0x91c]
call fcn.0045c3ad
push ebx
lea ecx, [esi + 0x37c]
call fcn.0045c3ad
push 0x46fa3c
push 0x40a
mov ecx, esi
call fcn.0045c21e
mov ecx, eax
call fcn.0045c2f7
push ebx
push 0x40c
mov ecx, esi
call fcn.0045c21e
mov ecx, eax
call fcn.0045c371
jmp 0x41afbc
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x30]
push 0x470c38
push edx
mov byte [esp + 0x7bc], 7
call fcn.0042f210
mov edi, dword [esp + 0x38]
push edi
push str._s_r_n
push ebx
call fcn.00430ba0
push 0x7c0
push str..GMWebDlg.cpp
push 2
push 0xc353
call fcn.004310d0
mov eax, dword [esi + 0x1bdc]
add esp, 0x2c
push eax
mov ecx, esi
call fcn.00419450
test eax, eax
mov ecx, esi
jne 0x41af70
push 0x470c28
push 0x40a
call fcn.0045c21e
mov ecx, eax
call fcn.0045c2f7
push 5
jmp 0x41af87
push 0x46fa3c
push 0x40a
call fcn.0045c21e
mov ecx, eax
call fcn.0045c2f7
push ebx
mov ecx, esi
push 0x40c
call fcn.0045c21e
mov ecx, eax
call fcn.0045c371
lea eax, [edi - 0x10]
mov byte [esp + 0x7ac], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41afbc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x7ac], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aff0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x7ac], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b016
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x7ac], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b03c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x7ac], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b062
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x7ac], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b088
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x7ac], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b0ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x7ac], 0xffffffff
call fcn.00462fcd
mov ecx, dword [eax + 4]
call fcn.0045cc8b
mov ecx, dword [esp + 0x7a4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x79c]
call fcn.00446654
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret