Function at 0x411f70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
xor eax, eax
push esi
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov ecx, 0x11
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x80]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x34], eax
mov eax, 0xfffff830
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 5
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x68], 7
je 0x412099
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411fd2
sub eax, edx
mov esi, eax
cmp esi, 9
jl 0x411ffc
lea ecx, [esi + edi - 9]
push str.cmd.exe_
push ecx
call fcn.0041f7a1
add esp, 8
test eax, eax
je 0x412109
cmp esi, 8
jl 0x41201b
lea edx, [esi + edi - 8]
push 0x422d9c
push edx
call fcn.0041f7a1
add esp, 8
test eax, eax
je 0x412109
cmp esi, 0xe
jl 0x41203a
lea eax, [esi + edi - 0xe]
push str._typeperf.exe_
push eax
call fcn.0041f7a1
add esp, 8
test eax, eax
je 0x412109
cmp esi, 0xd
jl 0x412059
lea ecx, [esi + edi - 0xd]
push str._typeperf.exe
push ecx
call fcn.0041f7a1
add esp, 8
test eax, eax
je 0x412109
cmp esi, 0xc
jl 0x412078
lea edx, [esi + edi - 0xe]
push str._nircmd.exe_
push edx
call fcn.0041f7a1
add esp, 8
test eax, eax
je 0x412109
cmp esi, 0xb
jl 0x41210e
lea eax, [esi + edi - 0xd]
push str._nircmd.exe
push eax
call fcn.0041f7a1
add esp, 8
test eax, eax
jne 0x41210e
jmp 0x412109
cmp ebp, ebx
je 0x41210e
push 0x422d54
push ebp
call fcn.0040e560
add esp, 8
test eax, eax
jne 0x412109
push 0x422d48
push ebp
call fcn.0040e560
add esp, 8
test eax, eax
jne 0x412109
push 0x422d38
push ebp
call fcn.0040e560
add esp, 8
test eax, eax
jne 0x412109
push 0x422d28
push ebp
call fcn.0040e560
add esp, 8
test eax, eax
jne 0x412109
push 0x422d18
push ebp
call fcn.0040e560
add esp, 8
test eax, eax
jne 0x412109
push 0x422d08
push ebp
call fcn.0040e560
add esp, 8
test eax, eax
je 0x41210e
mov word [esp + 0x68], bx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push ebx
mov eax, 0xc
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x38]
push ecx
push ebp
push edi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41215e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x6c
ret
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x88], ebx
je 0x412208
mov edi, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov dword [esp + 0x80], 0x103
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x80]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4121e9
cmp dword [esp + 0x80], 0x103
jne 0x412208
push 0x1f4
call ebp
inc esi
test edi, edi
jle 0x4121c7
lea edx, [edi + edi]
cmp edx, esi
jl 0x412203
cmp dword [esp + 0x80], 0x103
je 0x412190
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x6c
ret
mov eax, dword [esp + 0x28]
push eax
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x6c
ret
mov ebx, 2
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x6c
ret