Function at 0x416690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov edi, edx
mov edx, ecx
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [esp + 0xc8], eax
lea esi, [esp + 0x90]
mov ecx, esi
call fcn.004178b0
mov ecx, esi
call fcn.004223c0
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x2c], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], 0
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov eax, ecx
sub eax, esi
cmp eax, 2
jb 0x416730
lea eax, [esp + 0x1c]
lea edx, [esi + 2]
mov dword [eax + 0x10], edx
mov ebx, eax
cmp ecx, 7
jbe 0x416718
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x30]
mov dword [ebx + esi*2], 0x200022
mov word [ebx + esi*2 + 4], 0
jmp 0x416761
sub esp, 0x10
mov al, byte [esp + 0xc0]
mov byte [esp + 4], al
mov eax, 2
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], 0x42cd38
lea ecx, [esp + 0x2c]
call fcn.0041fc90
lea ecx, [eax + 0x10]
lea edx, [eax + 0x14]
xor esi, esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], esi
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0xc0], xmm0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xb0], xmm0
mov dword [ecx], esi
mov dword [edx], 7
mov word [eax], 0
mov ecx, dword [esp + 0x30]
cmp ecx, 8
jb 0x4167c0
mov eax, dword [esp + 0x1c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x416cc3
push edx
push eax
call fcn.0041dcce
add esp, 8
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 7
mov word [esp + 0x1c], 0
mov ecx, dword [esp + 0xa4]
cmp ecx, 8
jb 0x416806
mov eax, dword [esp + 0x90]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x416cde
push edx
push eax
call fcn.0041dcce
add esp, 8
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
cmp ecx, eax
je 0x416bc4
xor esi, esi
lea eax, [esp + 0xb0]
mov dword [esp + 8], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
cmp dword [ecx + 0x14], 0xf
mov ebx, ecx
jbe 0x416836
mov ebx, dword [ecx]
mov edi, dword [ecx + 0x10]
cmp edi, 0xf
mov dword [esp + 0x14], ecx
ja 0x416ae7
movups xmm0, xmmword [ebx]
movups xmmword [esp + 0x1c], xmm0
mov eax, 0xf
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
lea edi, [esp + 0x60]
mov ecx, edi
lea edx, [esp + 0x1c]
call fcn.004178b0
mov ecx, edi
call fcn.004223c0
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x78], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x88], xmm0
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 7
mov word [eax], 0
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
mov edx, ecx
sub edx, eax
cmp edx, 2
jb 0x4168f4
lea edx, [eax + 2]
mov dword [esp + 0x88], edx
lea edx, [esp + 0x78]
cmp ecx, 7
jbe 0x4168d2
mov edx, dword [esp + 0x78]
mov dword [edx + eax*2], 0x200022
mov word [edx + eax*2 + 4], 0
lea eax, [esp + 0x78]
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x88]
jmp 0x416928
sub esp, 0x10
mov al, byte [esp + 0xa0]
mov byte [esp + 4], al
mov eax, 2
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], 0x42cd38
lea ecx, [esp + 0x88]
call fcn.0041fc90
lea edx, [eax + 0x10]
lea ecx, [eax + 0x14]
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0xa0], xmm0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x90], xmm0
mov dword [edx], esi
mov dword [ecx], 7
mov word [eax], 0
mov eax, dword [esp + 0xa0]
cmp dword [esp + 0xa4], 7
lea ecx, [esp + 0x90]
jbe 0x41697b
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xc4]
mov edi, esi
sub edi, edx
cmp edi, eax
jb 0x4169c6
lea edi, [edx + eax]
mov dword [esp + 0xc0], edi
lea ebx, [esp + 0xb0]
cmp esi, 7
jbe 0x4169ae
mov ebx, dword [esp + 0xb0]
lea edx, [ebx + edx*2]
add eax, eax
push eax
push ecx
push edx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [ebx + edi*2], 0
jmp 0x4169e8
sub esp, 0x10
mov dl, byte [esp + 0x28]
mov byte [esp + 4], dl
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [esp + 0xc0]
call fcn.0041fc90
xor esi, esi
mov ecx, dword [esp + 0xa4]
cmp ecx, 8
jb 0x416a19
mov eax, dword [esp + 0x90]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x416b42
push edx
push eax
call fcn.0041dcce
add esp, 8
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], 0
mov ecx, dword [esp + 0x8c]
cmp ecx, 8
jb 0x416a65
mov eax, dword [esp + 0x78]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x416b63
push edx
push eax
call fcn.0041dcce
add esp, 8
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 7
mov word [esp + 0x78], 0
mov ecx, dword [esp + 0x74]
cmp ecx, 8
jb 0x416aab
mov eax, dword [esp + 0x60]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x416b84
push edx
push eax
call fcn.0041dcce
add esp, 8
mov eax, dword [esp + 0x30]
cmp eax, 0x10
jb 0x416ad1
mov ecx, dword [esp + 0x1c]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x416ba5
push edi
push ecx
call fcn.0041dcce
add esp, 8
mov ecx, dword [esp + 0x14]
add ecx, 0x18
cmp dword [esp + 0x10], ecx
jne 0x416824
jmp 0x416bcf
mov ecx, edi
or ecx, 0xf
mov eax, 0x7fffffff
cmp ecx, eax
cmovae ecx, eax
cmp ecx, 0xfff
mov dword [esp + 0xc], ecx
jae 0x416b29
lea eax, [ecx + 1]
push eax
call fcn.0041dc99
add esp, 4
mov dword [esp + 0x1c], eax
lea ecx, [edi + 1]
push ecx
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xc]
jmp 0x416853
lea eax, [ecx + 0x24]
push eax
call fcn.0041dc99
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x416b0e
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x416d11
add ecx, ecx
add ecx, 0x25
mov edx, ecx
xor esi, esi
jmp 0x416a0f
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x416d11
add ecx, ecx
add ecx, 0x25
mov edx, ecx
xor esi, esi
jmp 0x416a5b
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x416d11
add ecx, ecx
add ecx, 0x25
mov edx, ecx
xor esi, esi
jmp 0x416aa1
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x416d11
add eax, 0x24
mov edi, eax
mov ecx, edx
xor esi, esi
jmp 0x416ac7
lea eax, [esp + 0xb0]
mov dword [esp + 8], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], 0x44
movaps xmmword [esp + 0x90], xmm0
cmp dword [esp + 0xc4], 7
jbe 0x416c0b
mov eax, dword [esp + 0xb0]
mov dword [esp + 8], eax
sub esp, 0x28
lea eax, [esp + 0xb8]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x42a200]
movups xmmword [esp + 8], xmm0
mov ecx, dword [esp + 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x416c7b
cmp byte [ebp + 8], 0
je 0x416c63
push 0xffffffffffffffff
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x90]
call edi
push dword [esp + 0x94]
call edi
mov ecx, dword [esp + 0xc4]
cmp ecx, 8
jb 0x416ca6
mov eax, dword [esp + 0xb0]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x416cf9
push edx
push eax
call fcn.0041dcce
add esp, 8
test esi, esi
setne bl
mov ecx, dword [esp + 0xc8]
xor ecx, ebp
call fcn.0041e640
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x416d11
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4167b6
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x416d11
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4167fc
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x416d11
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x416c9c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3