Function at 0x41d964
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x41d96c
push ecx
push ebx
push esi
push edi
mov eax, 0x41adc4
call fcn.0040b9d0
xor eax, eax
push ebp
push 0x41dcc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x426ce4
mov edx, 0x41dce0
call fcn.004068cc
xor eax, eax
push ebp
push 0x41d9ce
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0041acd4
test al, al
je 0x41d9c4
mov eax, 0x426ce4
mov edx, 0x41dd08
call fcn.004068cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41da1a
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x41dca1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00404b94
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00415608
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov ecx, 0x41dd44
call fcn.00406d74
push dword [ebp - 0x14]
push dword [0x426ce4]
push 0x41dd54
mov eax, 0x426ce4
mov edx, 3
call fcn.00406dfc
mov dl, 1
mov eax, dword [0x426ce4]
call fcn.00415570
test al, al
jne 0x41daa4
lea eax, [ebp - 0x2c]
mov ecx, 0x41dd6c
mov edx, dword [0x426ce4]
call fcn.00406d74
mov eax, dword [ebp - 0x2c]
call fcn.0041ad5c
call fcn.00405ed4
jmp 0x41dca8
push 5
mov eax, dword [ebp - 0x14]
call fcn.00406bb8
push eax
push 0
mov eax, dword [0x426ce4]
call fcn.00406bb8
push eax
push 0x41dd84
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
cmp ebx, 0x20
ja 0x41dc89
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x41dc82
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, 0x41dd9c
call fcn.00406914
mov eax, ebx
cmp eax, 0x20
ja case.0x41db05.1
movzx eax, byte [eax + 0x41db0c]
jmp dword [eax*4 + 0x41db2d]
lea eax, [ebp - 0x18]
mov edx, 0x41ddc4
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41de08
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41de88
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41df08
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41dfb8
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e064
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e10c
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e22c
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e294
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e35c
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e404
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e4c0
call fcn.00406914
jmp case.0x41db05.1
lea eax, [ebp - 0x18]
mov edx, 0x41e504
call fcn.00406914
push 0x41e56c
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.004152bc
push dword [ebp - 0x34]
push 0x41e5bc
push 0x41e5cc
push dword [ebp - 0x18]
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00406dfc
mov eax, dword [ebp - 0x30]
call fcn.0041ad5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dc89
lea eax, [ebp - 0x18]
call fcn.00406604
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dca8
lea eax, [ebp - 0x14]
call fcn.00406604
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dccc
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00406664
pop eax
jmp eax