Function at 0x4162cc
Capabilities:
Create process on windows

Disassembly:
push 0x98
mov eax, 0x59cc0b
call fcn.005693c7
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x44
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
pop esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xa4]
push ebx
push eax
mov dword [ebp - 0x48], ebx
call fcn.0056f390
push 0x10
lea eax, [ebp - 0x60]
mov dword [ebp - 0xa4], esi
push ebx
push eax
call fcn.0056f390
add esp, 0x18
mov dword [ebp - 0x18], ebx
xor eax, eax
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 1
call fcn.0042add8
test al, al
je 0x416353
invalid
call fcn.0042aa9c
test al, al
je 0x416377
std
dec esp
cld
cmp dword [ebx - 0x6d35f111], 0x1d
mov esp, 0x41cf0e3b
mov byte [0x11769aa3], al
cmp dword [ecx], eax
or eax, 0xe843f64c
call fcn.0042aa9c
test al, al
je 0x41639b
jo 0x4163fd
cli
xor ch, byte [ebx + 0x61]
jo 0x41631b
stosd dword es:[edi], eax
dec ebp
test cl, bl
mov eax, 0x96cb3a38
invalid
mov ebx, dword [ebp - 0x4c]
xor esi, esi
test ebx, ebx
je 0x4163be
cmp word [ebx], si
jne 0x4163ad
mov eax, esi
jmp 0x4163b4
push ebx
call fcn.00578706
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00403772
or edi, 0xffffffff
cmp dword [ebp - 0x30], 0
jne 0x4163e6
mov ebx, dword [ebp - 0x44]
cmp word [ebx], si
jne 0x4163d3
mov eax, esi
jmp 0x4163da
push ebx
call fcn.00578706
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00403772
jmp 0x41643c
mov esi, 0x5a3918
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov ebx, dword [ebp - 0x44]
xor eax, eax
cmp word [ebx], ax
je 0x41640d
pop ebp
mov esp, 0x3966c033
add esi, dword [edi + eax + 0x53]
push ebx
call fcn.00578706
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00408c34
mov esi, 0x5a391c
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
push edi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
call fcn.0042a9cd
test al, al
je 0x416465
cmpsb byte [esi], byte es:[edi]
out dx, eax
cwde
test dword [ebp + 0x7a3279b9], edi
lds edi, [ecx - 0x63]
xor al, 0x19
dec ebp
inc ebp
mov al, 0x88
pushfd
push ebp
retf 0x36e7
call fcn.0042ae62
test al, al
je 0x41648d
mov ch, 0x54
and al, 0x86
mov eax, dword [0x949ddf37]
test dword [ebp + 0x7add686e], ecx
pop eax
push ebx
mov ah, bh
scasd eax, dword es:[edi]
inc ecx
pop edx
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
invalid
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x67
call fcn.00413331
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
pop ecx
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4164d4
mov esi, ebx
jmp 0x416555
cmp byte [ebp + 0x10], bl
je 0x4164ea
cmp dword [ebp + 0x14], ebx
cmovg edi, dword [ebp + 0x14]
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [0x11415ff]
pop edx
add byte [ebx - 0x97a4f8b], cl
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x416507
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x416507
mov eax, dword [ebp - 0x48]
mov dword [esi], eax
call fcn.0042aae1
test al, al
je 0x416521
pushfd
mov cl, 0xa1
mov dh, 0x39
mov dword [eax - 0x7b], ebp
hlt
call fcn.0042aa57
test al, al
je 0x416540
jle 0x416531
inc ecx
sub eax, 0xc8bb99bf
add dword [esi + 0x42], ebx
enter 0x5e01, 0x42
sub byte [edi + ebx + 0x6d], cl
cmc
pop edx
sti
mov ecx, 0xff689a61
jne 0x4164e3
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x5c]
call esi
xor esi, esi
inc esi
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
mov eax, esi
call fcn.00569382
ret