Function at 0x41e173
Capabilities:
Create process on windows
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2bc
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], ecx
test ebx, ebx
jne 0x41e1e5
xor edx, edx
mov dword [ebp - 0x28c], edx
jmp 0x41e1fa
mov dword [esp + 8], 5
mov dword [esp + 4], str.PATH
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x41e1f3
mov dword [esp + 8], 5
mov dword [esp + 4], str.Path
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x41e1f3
add ebx, 4
mov eax, dword [ebx]
mov dword [ebp - 0x28c], eax
test eax, eax
jne 0x41e19e
jmp 0x41e1fa
add dword [ebp - 0x28c], 5
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 5
mov dword [esp], eax
call fcn.00411363
mov edi, eax
mov eax, dword [ebp + 0x14]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [ebp - str..exe], 0x42f8a4
add eax, edi
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x290]
mov ebx, dword [eax]
test ebx, ebx
je 0x41e364
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x294]
lea esi, [ebp - 0x220]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
xor eax, eax
mov dword [esp + 0x10], esi
mov ebx, dword [sym.imp.KERNEL32.dll_SearchPathA]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x41e2c5
xor eax, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], edi
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x41e358
cmp eax, 0x104
ja 0x41e358
xor esi, esi
lea eax, [ebp - 0x220]
xor ebx, ebx
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x41e358
mov dword [esp], edi
lea edi, [ebp - 0x11c]
call fcn.004258bc
xor ecx, ecx
lea eax, [ebp - 0x280]
mov dword [esp], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x103
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x41e442
jmp 0x41e44d
add dword [ebp - 0x290], 4
jmp 0x41e23b
mov dword [esp], edi
call fcn.004258bc
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0x2f
je 0x41e392
mov ecx, dword [ebp + 0xc]
mov edx, eax
xor eax, eax
mov edi, 1
xor esi, esi
call fcn.0041da95
mov dword [ebp - 0x28c], eax
jmp 0x41e630
mov dword [esp], str.__SHELL_
xor ebx, ebx
call fcn.00404945
mov dword [esp + 4], eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x220]
mov dword [esp + 4], 0x42f6d4
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
lea edi, [ebx + 1]
test eax, eax
je 0x41e3e4
mov dword [esp], eax
add esi, 4
call sub.msvcrt.dll_strlen
lea ebx, [eax + edi]
jmp 0x41e3cb
mov dword [esp], edi
call fcn.00411363
mov edi, dword [ebp + 0xc]
mov byte [eax], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x41e41b
mov dword [esp + 4], eax
add edi, 4
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x42f727
mov dword [esp], esi
call sub.msvcrt.dll_strcat
jmp 0x41e3f4
mov eax, dword [ebp + 0xc]
mov byte [esi + ebx - 1], 0
lea ebx, [ebp - 0x11c]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004258bc
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], esi
mov dword [eax + 4], edx
jmp 0x41e503
mov eax, dword [ebp - 0x280]
cmp eax, 1
ja 0x41e46f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], 0x66
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x41e648
xor ebx, ebx
cmp byte [ebp - 0x11c], 0x23
jne 0x41e4dc
cmp byte [ebp - 0x11b], 0x21
jne 0x41e4dc
mov byte [ebp + eax - 0x11c], 0
mov dword [esp + 4], 0xa
mov dword [esp], edi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x41e4a2
mov byte [eax], 0
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], 0xd
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x41e4bf
mov byte [eax], 0
mov dword [esp], ebx
lea ebx, [ebp - 0x11a]
mov dword [esp + 4], 0x2f
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x41e4dc
lea ebx, [eax + 1]
mov dword [esp], esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
test ebx, ebx
jne 0x41e618
lea esi, [ebp - 0x220]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp eax, 4
ja 0x41e50a
xor esi, esi
jmp 0x41e618
lea edi, [esi + eax - 4]
mov dword [esp + 8], 4
mov esi, dword [sym.imp.msvcrt.dll__strnicmp]
mov dword [esp + 4], str..bat
mov dword [esp], edi
call esi
test eax, eax
jne 0x41e549
lea edi, [ebp - 0x220]
mov dword [esp + 4], 0x42f72e
mov dword [esp], edi
call sub.msvcrt.dll_strpbrk
test eax, eax
jne 0x41e564
jmp 0x41e503
mov dword [esp + 8], 4
mov dword [esp + 4], str..cmd
mov dword [esp], edi
call esi
test eax, eax
je 0x41e52d
jmp 0x41e503
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x41e503
mov eax, dword [ebp + 0xc]
mov dword [esp], edi
lea esi, [eax + 4]
call sub.msvcrt.dll_strlen
mov edi, esi
lea ebx, [eax + 1]
mov eax, dword [edi]
test eax, eax
je 0x41e5a7
mov dword [esp], eax
add edi, 4
call sub.msvcrt.dll_strlen
lea ebx, [ebx + eax + 1]
jmp 0x41e590
mov dword [esp], ebx
lea edi, [ebp - 0x220]
call fcn.00411363
mov dword [ebp - 0x28c], eax
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea edi, [ebx + eax + 1]
mov ebx, dword [esi]
test ebx, ebx
je 0x41e5fb
mov dword [esp], edi
add esi, 4
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcpy
mov dword [esi - 4], edi
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea edi, [edi + eax + 1]
jmp 0x41e5d5
mov eax, dword [ebp + 0xc]
mov esi, 1
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004258bc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x28c]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x220]
mov eax, ebx
xor edi, edi
call fcn.0041da95
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x41e650
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [eax + 0x40], esi
mov dword [eax + 0x44], 0x67
or eax, 0xffffffff
jmp 0x41e8e5
cmp dword [ebp + 0x10], 0
je 0x41e6e3
lea eax, [ebp - 0x278]
mov dword [esp + 8], eax
lea eax, [ebp - 0x27c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0041d96a
test eax, eax
jne 0x41e6e3
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 0x67
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call fcn.004258bc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40]
cmp eax, 0x57
je 0x41e6a7
cmp eax, 0xea
jne 0x41e6d6
mov ebx, dword [ebp - 0x278]
cmp ebx, 0x8000
jbe 0x41e6d6
mov dword [esp], 2
call dword [0x428f30]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CreateProcess_failed__probably_because_environment_is_too_large___Iu_bytes_._n
mov dword [esp], eax
call fcn.0041da44
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [eax + 0x40], ebx
jmp 0x41e648
or esi, ebx
jne 0x41e6f1
lea ebx, [ebp - 0x220]
test edi, edi
je 0x41e6f3
xor ebx, ebx
lea esi, [ebp - 0x264]
xor eax, eax
mov ecx, 0x11
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor edx, edx
xor ecx, ecx
push eax
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
mov dword [ebp - 0x260], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x238], 0x100
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 8]
mov word [ebp - 0x232], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x224], eax
je 0x41e766
mov eax, dword [ebp - 0x27c]
jmp 0x41e853
test byte [0x43154c], 4
je 0x41e7a8
test ebx, ebx
mov eax, str.NULL
mov edx, dword [ebp - 0x28c]
mov dword [esp], str.CreateProcess__s__s_...__n
cmovne eax, ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0041da65
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
lea eax, [ebp - 0x274]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
jne 0x41e860
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], 0x68
test ebx, ebx
jne 0x41e814
mov ebx, str.NULL
mov dword [esp], 2
call dword [0x428f30]
mov edx, dword [ebp - 0x28c]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.process_begin:_CreateProcess__s___s__...__failed._n
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0041da44
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call fcn.004258bc
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call fcn.004258bc
jmp 0x41e648
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x41e88f
mov dword [esp], eax
call ebx
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41e8a0
mov dword [esp], eax
call ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
cmp eax, 0xffffffff
je 0x41e8b1
mov dword [esp], eax
call ebx
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call fcn.004258bc
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call fcn.004258bc
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x44], ecx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret