Function at 0x41be10
Capabilities:
Create process on windows

Disassembly:
push ebp
xor ecx, ecx
push ebx
mov ebx, eax
push edi
mov eax, 0x10
push esi
mov byte [esp - 0xa04], 0
sub esp, 0xa10
mov byte [esp + 0xa28], dl
mov dword [esp + 0xc], edx
mov dword [esp + 0xa24], ebx
mov dword [esp + 0xa04], 0
mov dword [esp + eax*8 + 0x30], ecx
mov dword [esp + eax*8 + 0x34], ecx
mov dword [esp + eax*8 + 0x38], ecx
mov dword [esp + eax*8 + 0x3c], ecx
sub eax, 2
jge 0x41be48
mov dword [esp + 0xc0], ecx
lea edi, [esp + 0x30]
mov dword [esp + 0x30], 0x94
push edi
mov ecx, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.0041114c
mov ecx, ebx
mov dword [esp + 0xa00], eax
mov byte [eax + 0x24], 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x68]
mov dword [eax + 0x2c], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
mov dword [eax + 0x30], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x88]
mov dword [eax + 0x34], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x8c]
mov dword [eax + 0x38], edx
mov edx, dword [ecx]
mov dl, byte [edx + 0x95]
mov byte [eax + 0x3c], dl
mov edx, dword [ecx]
mov dl, byte [edx + 0x97]
mov byte [eax + 0x3d], dl
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
mov dword [eax + 0x28], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x88]
lea ebx, [esp + 0x8bc]
mov dword [eax + 0x34], edx
mov edi, ebx
mov ecx, dword [ecx]
mov edx, 0x100
mov esi, 0x460050
mov ecx, dword [ecx + 0x8c]
mov dword [eax + 0x38], ecx
mov byte [eax + 0x3e], 1
mov eax, ebx
mov dword [esp + 0x9c4], 0x4601bc
mov dword [esp + 0x9bc], 0x44
mov dword [esp + 0x9c0], 0
mov dword [esp + 0x9c8], 0
mov dword [esp + 0x9d8], 0
mov dword [esp + 0x9d4], 0
mov dword [esp + 0x9d0], 0
mov dword [esp + 0x9cc], 0
mov dword [esp + 0x9e8], 0
mov word [esp + 0x9ec], 5
mov dword [esp + 0x9f0], 0
mov word [esp + 0x9ee], 0
call fcn.00411134
xor eax, eax
mov edx, dword [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebx
movsw word es:[edi], word [esi]
mov edi, ecx
cmp dl, 1
jne 0x41bfc1
xor eax, eax
mov esi, 0x4601cc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x4601e0
jmp 0x41c174
cmp byte [esp + 0xa28], 2
jne 0x41bff7
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x4601ec
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x460200
jmp 0x41c174
cmp byte [esp + 0xa28], 4
jne 0x41c030
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x46020c
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x460220
jmp 0x41c174
cmp byte [esp + 0xa28], 8
jne 0x41c066
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x46022c
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x460240
jmp 0x41c174
cmp byte [esp + 0xa28], 0x10
jne 0x41c0a0
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x46022c
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x460254
jmp 0x41c174
cmp byte [esp + 0xa28], 0x20
jne 0x41c0d6
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x460264
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x460278
jmp 0x41c174
cmp byte [esp + 0xa28], 0x40
jne 0x41c110
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x460288
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x46029c
jmp 0x41c174
cmp byte [esp + 0xa28], 0x80
jne 0x41c143
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x4602ac
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x4602c0
jmp 0x41c174
cmp byte [esp + 0xa28], 0
jne 0x41c174
xor eax, eax
lea edi, [esp + 0x8bc]
or ecx, 0xffffffff
mov esi, 0x4602d0
repne scasb al, byte es:[edi]
dec edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa0c], 0x4602e4
lea ebx, [esp + 0xc4]
push ebx
lea ebx, [esp + 0x9c0]
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, dword [esp + 0xa2c]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41c1c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0xc4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov esi, dword [esp + 0xc8]
push esi
call ebx
mov edi, dword [esp + 0xa00]
cmp byte [edi + 0x24], 0
jne 0x41c1e1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
cmp byte [edi + 0x24], 0
je 0x41c1d7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x4602f1
lea eax, [esp + 0x8bc]
call fcn.0041ea20
mov dword [esp + 0xa08], eax
test eax, eax
jne 0x41c216
add esp, 0xa10
or eax, 0xffffffff
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0xa08]
lea esi, [esp + 0xd4]
mov eax, ebx
mov edi, dword [esp + 0xa24]
call fcn.0041e940
lea edx, [esp + 0x10]
call fcn.0041ee70
mov edx, dword [esp + 0x20]
mov eax, edi
mov ecx, edx
sar ecx, 0x18
and ecx, 0xff
mov byte [esp + 0xd4], cl
mov ecx, edx
sar ecx, 0x10
and ecx, 0xff
mov byte [esp + 0xd5], cl
mov ecx, edx
sar ecx, 8
and edx, 0xff
and ecx, 0xff
mov byte [esp + 0xd7], dl
mov byte [esp + 0xd6], cl
mov ecx, 4
mov edx, esi
call fcn.0041c360
push ebx
mov eax, esi
mov ecx, 0x7e8
sub esp, 0xc
mov edx, 1
call fcn.0041ed30
add esp, 0x10
mov ecx, edi
test eax, eax
mov esi, eax
je 0x41c2ef
mov edi, dword [esp + 0xa04]
mov eax, esi
mov esi, ecx
lea ebp, [esp + 0xd4]
add edi, eax
mov ecx, eax
mov edx, ebp
mov eax, esi
call fcn.0041c360
push ebx
mov eax, ebp
sub esp, 0xc
mov ecx, 0x7e8
mov edx, 1
call fcn.0041ed30
mov ecx, esi
add esp, 0x10
test eax, eax
mov esi, eax
jne 0x41c2b7
mov eax, dword [esp + 0xa08]
call fcn.0041e880
call fcn.00411152
add esp, 0xa10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret