Function at 0x416084
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
and dword [ebp - 0x468], 0
and dword [ebp - 0x34c], 0
and dword [ebp - 0x350], 0
and dword [ebp - 0x244], 0
and dword [ebp - 0x240], 0
and dword [ebp - 0x470], 0
and dword [ebp - 0x134], 0
and dword [ebp - 0x130], 0
and dword [ebp - 0x46c], 0
and dword [ebp - 0x354], 0
and dword [ebp - 0x23c], 0
mov dword [ebp - 0x464], 1
mov dword [ebp - 0x358], 1
and dword [ebp - 0x460], 0
cmp dword [0x4252b8], 0
je 0x416106
push 1
pop eax
jmp 0x41652e
push 0x421c38
push dword [ebp + 0xc]
call fcn.00411e77
push 0
push 2
push dword [ebp + 8]
call fcn.00406fdc
mov dword [ebp - 0x468], eax
push 0
call fcn.0041e050
mov dword [ebp - 0x34c], eax
push 0
call fcn.0041e050
mov dword [ebp - 0x350], eax
push 1
pop eax
test eax, eax
je 0x41645b
push dword [ebp - 0x34c]
call fcn.0041e110
and dword [ebp - 0x34c], 0
push 0
call fcn.0041e050
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x464], 0
je 0x4161bc
and dword [ebp - 0x464], 0
push 1
push dword [ebp - 0x34c]
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x421c3c
push dword [ebp + 0xc]
call fcn.00411ec8
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 1
jne 0x4161ba
push 1
pop eax
jmp 0x41652e
jmp 0x4161ec
push 2
push dword [ebp - 0x34c]
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x421c40
push dword [ebp + 0xc]
call fcn.00411ec8
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jge 0x4161fd
push 0xffffffffffffffe6
pop eax
jmp 0x41652e
push dword [ebp - 0x34c]
call fcn.0041dcf0
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
jne 0x41622a
cmp dword [ebp - 0x46c], 1
jne 0x416225
jmp 0x41645b
jmp 0x41613f
push dword [ebp - 0x34c]
call fcn.0041dd50
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x416257
cmp dword [ebp - 0x46c], 1
jne 0x416252
jmp 0x41645b
jmp 0x41613f
mov eax, dword [ebp - 0x240]
and eax, 0x20
test eax, eax
jne 0x416269
jmp 0x41613f
push dword [ebp - 0x134]
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x416293
push dword [ebp - 0x470]
call fcn.0040c670
test eax, eax
je 0x416293
jmp 0x41613f
push dword [ebp - 0x134]
call fcn.0040c670
test eax, eax
jne 0x4162a7
jmp 0x41613f
push 1
pop eax
test eax, eax
je 0x41644b
mov eax, dword [ebp - 0x240]
and eax, 2
test eax, eax
je 0x4162df
push 0
push 1
push 1
push 0xffffffffffffffff
push dword [ebp - 0x134]
call fcn.0040f786
mov dword [ebp - 0x244], eax
xor eax, eax
jmp 0x41652e
push 0
push 0
push 1
push 0xffffffffffffffff
push dword [ebp - 0x134]
call fcn.0040f786
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jle 0x416306
jmp 0x41613f
cmp dword [ebp - 0x244], 0
jge 0x416321
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
jmp 0x41613f
push dword [ebp - 0x134]
call fcn.00417e57
pop ecx
test eax, eax
je 0x416438
push dword [ebp - 0x134]
call fcn.00417296
pop ecx
test eax, eax
je 0x416438
lea eax, [ebp - 0x348]
push eax
push dword [ebp - 0x134]
call fcn.00409458
push 0x421c44
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4163e1
push 0
lea eax, [ebp - 0x45c]
push eax
call fcn.00408838
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x134]
call fcn.00408266
lea eax, [ebp - 0x238]
push eax
call fcn.00408802
push dword [ebp - 0x134]
push str.__s___UNREGSERVER
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x4163d3
and dword [ebp - 0x358], 0
lea eax, [ebp - 0x45c]
push eax
call fcn.00408802
jmp 0x4163f2
push dword [ebp - 0x134]
call fcn.00417443
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jne 0x41641a
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
push 0
push dword [ebp - 0x134]
push 0x3f8
call fcn.00407c8f
push dword [ebp - 0x134]
push dword [ebp - 0x350]
call fcn.0041ddb0
test eax, eax
jne 0x416436
xor eax, eax
jmp 0x41652e
jmp 0x41644b
push 0
push 1
push 1
push 0
push dword [ebp - 0x134]
call fcn.0040f786
cmp dword [ebp - 0x46c], 1
jne 0x416456
jmp 0x41645b
jmp 0x41613f
push 1
pop eax
test eax, eax
je 0x41651e
push dword [ebp - 0x350]
call fcn.0041dcf0
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x41651e
push dword [ebp - 0x130]
call fcn.0040c266
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
and eax, 1
test eax, eax
je 0x4164c2
mov eax, dword [ebp - 0x460]
xor eax, 1
mov dword [ebp - 0x460], eax
push dword [ebp - 0x460]
push dword [ebp - 0x130]
call fcn.0040ab22
push 1
push dword [ebp - 0x130]
push dword [ebp + 8]
call fcn.00417639
add esp, 0xc
test eax, eax
jne 0x416508
push dword [ebp - 0x130]
call fcn.0040b363
cmp eax, 0xffffffff
jne 0x416508
push 0
push dword [ebp - 0x130]
push 0x3f2
call fcn.00407c8f
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
push dword [ebp - 0x350]
call fcn.0041dd50
mov dword [ebp - 0x130], eax
jmp 0x416477
cmp dword [ebp - 0x23c], 0
jle 0x41652b
xor eax, eax
jmp 0x41652e
push 1
pop eax
leave
ret 8