Function at 0x412ca1
Capabilities:
Create process on windows

Disassembly:
push 0x108
push 0x42bbd8
call fcn.004172ec
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xbc], ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xb4], 0x20
lea eax, [ebp - 0xb4]
push eax
push esi
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x41f01c
mov dword [ebp - 0xb8], 1
push esi
push esi
push 4
lea eax, [ebp - 0xb8]
push eax
push 0x60001
push esi
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x41f066
push 0x48
push esi
lea eax, [ebp - 0x118]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x118], 0x48
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], esi
xor ecx, ecx
inc ecx
mov dword [ebp - 0x104], ecx
push 0x64
pop eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xec], esi
mov word [ebp - 0xe8], cx
push 0x40
push esi
lea eax, [ebp - 0x64]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], 0x44
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x110], eax
mov dword [ebp - 4], esi
mov ecx, 0x4023ac
call fcn.00412570
test eax, eax
jne 0x412dcc
mov eax, 0x40263c
mov ecx, eax
call fcn.0040ce50
mov dword [ebp - 0xb0], eax
test eax, eax
je 0x41f04b
cmp dword [0x443cdc], 0
je 0x41f087
push 0x5c
pop edx
mov ecx, ebx
call fcn.004111d9
test eax, eax
je 0x412e10
push 0x402624
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x41f0a6
call fcn.00413f50
mov eax, dword [0x443cd4]
test eax, eax
jne 0x412f4e
xor eax, eax
mov ecx, dword [0x443cc8]
test ecx, ecx
setne al
test al, al
je 0x41f0ef
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x118]
push eax
push ecx
push esi
push 0x80000
xor eax, eax
inc eax
push eax
push esi
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x41f0f9
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xa4], eax
push dword [ebp - 0xc8]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov edx, dword [ebp - 0xb0]
mov ecx, 0x4023ac
call fcn.00412faa
test edi, edi
je 0x41f10f
mov eax, dword [ebp - 0xa4]
movzx edi, al
xor edx, edx
inc edx
and edi, edx
movzx ecx, al
shr ecx, 1
and ecx, edx
test eax, eax
je 0x41f1d6
mov ebx, dword [ebp - 0xa8]
cmp dword [0x443cdc], 0
je 0x412f5e
push 2
pop ecx
mov dword [ebp - 0xac], esi
xor eax, eax
inc eax
mov dword [0x433848], eax
test ebx, ebx
jne 0x412f70
mov ecx, dword [ebp - 0xa4]
call fcn.00413f8e
mov dword [0x43b8c0], eax
mov dword [ebp - 0xa4], esi
mov esi, eax
mov dword [ebp - 0xac], esi
push esi
push 0x402654
push 0x14
lea eax, [ebp - 0x4c]
push eax
call fcn.0040c4ef
add esp, 0x10
lea edx, [ebp - 0x4c]
mov ecx, 0x402640
call fcn.00412faa
cmp esi, 0x20
jge 0x41f1e1
mov edx, 0x402680
mov ecx, 0x402660
call fcn.00412faa
test edi, edi
jne 0x412fa3
mov dword [ebp - 4], 0xfffffffe
call fcn.00412f8a
mov eax, esi
call fcn.00417334
ret 0x10
mov edx, dword [eax + 0x30]
test edx, edx
je 0x412e22
jmp 0x41f0b0
cmp dword [0x443cd4], 0
jne 0x412ec4
jmp 0x41f19c
cmp ebx, 4
je 0x41f206
cmp ebx, ecx
jne 0x412f38
mov eax, dword [ebp - 0xa4]
mov dword [0x42d554], eax
jmp 0x412f38
call fcn.00425bb2
jmp 0x412f38
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
mov ecx, ebx
call fcn.00425420
jmp 0x41f05e
push ebx
mov edx, 0x7fe7
mov ecx, esi
call fcn.00410820
mov ecx, esi
call fcn.00425420
mov ecx, esi
call fcn.0040f480
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x42d0b4
call sub.msvcrt.dll__local_unwind4
add esp, 0xc
xor eax, eax
inc eax
jmp 0x412f46
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
mov ecx, ebx
call fcn.00425420
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_DeleteProcThreadAttributeList]
jmp 0x41f05e
cmp dword [0x448470], 0
jne 0x412dee
cmp dword [0x443cd4], 0
je 0x412e10
jmp 0x412dee
call fcn.00424866
jmp 0x412e10
xor eax, eax
mov ecx, dword [0x443cc8]
test ecx, ecx
setne al
test al, al
jne 0x41f0c6
mov ecx, 0x443ac0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x118]
push eax
push ecx
push esi
push 0x80000
xor eax, eax
inc eax
push eax
push esi
push esi
push edi
push ebx
push edx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateProcessAsUserW]
jmp 0x412e5a
mov ecx, 0x443ac0
jmp 0x412e37
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [ebp - 0xac], eax
mov dword [0x443d00], eax
jmp 0x412e7c
cmp byte [0x443cd9], 0
je 0x41f124
cmp dword [0x443d00], 0xc1
je 0x41f130
cmp dword [0x443d00], 0x2e4
jne 0x41f17b
call fcn.004174b8
test al, al
je 0x41f179
xor eax, eax
mov ecx, dword [0x443cc8]
test ecx, ecx
setne al
test al, al
jne 0x41f14f
mov ecx, 0x443ac0
push 0x443d00
lea eax, [ebp - 0xa4]
push eax
movzx eax, word [ebp - 0xe8]
push eax
push ecx
mov eax, dword [ebp - 0xbc]
push dword [eax + 0x3c]
push ebx
push esi
call dword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_ShellExecuteWorker]
mov edi, eax
jmp 0x41f17b
mov edi, esi
test edi, edi
jne 0x412e94
mov ecx, 0xffce
call fcn.0040f4e0
mov esi, eax
test esi, esi
je 0x41f04b
jmp 0x41f030
cmp byte [0x443cd9], 0
je 0x412ec4
cmp dword [0x448470], 0
jne 0x412ec4
test ebx, ebx
jne 0x412ec4
test ecx, ecx
jne 0x41f1d6
mov ecx, eax
call fcn.004256fb
push 2
pop ecx
cmp cx, ax
je 0x41f1d9
jmp 0x412ec7
push 2
pop ecx
push 4
pop ebx
jmp 0x412ec7
cmp esi, 0x7e
jg 0x412f25
push esi
push 0x403854
push 0xc
lea eax, [ebp - 0x80]
push eax
call fcn.0040c4ef
add esp, 0x10
lea edx, [ebp - 0x80]
jmp 0x412f2a
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x412f38
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [ebp - 0xa4], esi
jmp 0x412f38