Function at 0x41e24c
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x41e255
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404660
mov eax, dword [ebp - 8]
call fcn.00404660
mov eax, dword [ebp - 0xc]
call fcn.00404660
mov eax, dword [ebp + 0xc]
call fcn.00404660
xor eax, eax
push ebp
push 0x41e77a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x412910]
call fcn.00412f88
mov esi, eax
mov byte [ebp - 0x29], 1
mov eax, esi
call fcn.00413200
test al, al
je 0x41e2d0
push 5
mov eax, dword [0x425d2c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
call fcn.004137d8
push eax
mov eax, esi
call fcn.00413760
push eax
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x41e798
mov edx, 0x41e7b4
mov eax, esi
call fcn.0041365c
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, esi
call fcn.00413858
mov ecx, dword [ebp - 0x44]
mov eax, dword [0x425e48]
mov eax, dword [eax]
pop edx
call fcn.0041915c
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00404264
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041dcb0
test al, al
jne 0x41e33e
call fcn.00419488
test al, al
je 0x41e33e
lea eax, [ebp - 4]
call fcn.004193cc
mov eax, dword [0x425d38]
mov edx, 0x41e7c0
call fcn.0040488c
mov edx, ebx
call fcn.00403000
mov edx, 0x41e7e0
call fcn.0040488c
call fcn.004030f4
test bl, bl
je 0x41e377
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041dd54
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x41e738
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x41e7f4
mov edx, 0x41e83c
mov eax, esi
call fcn.0041365c
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x41e848
mov edx, 0x41e848
mov eax, esi
call fcn.0041365c
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x41e85c
mov edx, 0x41e894
mov eax, esi
call fcn.0041365c
mov eax, esi
call fcn.00413760
mov edi, eax
test bl, bl
je 0x41e3dc
push 5
mov eax, dword [0x425d0c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov edx, 1
mov eax, 0x3e8
call fcn.0040be24
lea eax, [ebp - 0x2a]
push eax
push 0x41b790
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.0041dbe8
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041889c
xor edx, edx
mov eax, 0x3e8
call fcn.0040be24
cmp dword [ebp - 0x18], 0
je 0x41e6d8
call fcn.004129bc
test al, al
jne 0x41e6d8
cmp byte [ebp - 0x2a], 0
je 0x41e6d8
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00404264
mov edx, dword [ebp - 0x18]
mov eax, 0x41e8a4
call fcn.004047b4
mov edi, eax
test edi, edi
jle 0x41e4d5
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.004046d0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x1c]
call fcn.00406bc8
push dword [ebp + 0xc]
push 0x41e8b0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404470
mov ecx, eax
lea edx, [edi + 1]
mov eax, dword [ebp - 0x18]
call fcn.004046d0
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00406bc8
push dword [ebp - 0x54]
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00404530
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.00406bc8
mov edx, dword [ebp - 0x4c]
lea eax, [ebp + 0xc]
call fcn.00404264
lea ecx, [ebp - 0x5c]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0040cb1c
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.004044bc
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404264
cmp dword [ebp + 0xc], 0
je 0x41e519
push dword [ebp - 0x14]
push 0x41e8b0
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404530
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.00406d50
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x3c]
mov edx, 0x41e8bc
call fcn.004044bc
push dword [ebp - 0x14]
push 0x41e8c8
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404530
push dword [ebp - 0x14]
push 0x41e8dc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
call fcn.0040cbc0
mov eax, dword [ebp - 0x68]
mov ecx, 0x41e8a4
mov edx, 0x41e8b0
call fcn.0040c9c4
push dword [ebp - 0x64]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404530
mov eax, dword [0x425ddc]
cmp byte [eax], 0
je 0x41e59f
lea eax, [ebp - 0x14]
mov edx, 0x41e8f4
call fcn.00404478
lea eax, [ebp - 0x24]
call fcn.00419c80
lea eax, [ebp - 0x28]
call fcn.00419cfc
mov eax, dword [0x425d38]
mov edx, 0x41e910
call fcn.0040488c
mov edx, dword [ebp - 0x14]
call fcn.0040488c
mov edx, 0x41e91c
call fcn.0040488c
call fcn.004030f4
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0x3c]
mov edx, 0x41e928
call fcn.004044bc
mov eax, dword [ebp - 0x6c]
call fcn.00404670
mov edi, eax
push edi
call sub.kernel32.dll_GlobalAddAtomA
test bl, bl
je 0x41e60b
push 5
mov eax, dword [ebp - 0x14]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
jmp 0x41e61b
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
push 0
mov eax, dword [0x425d0c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, 0x3e8
call fcn.0040be24
mov eax, dword [ebp - 0x18]
call fcn.0041d5f8
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 0x3c]
mov edx, 0x41e94c
call fcn.004044bc
mov eax, dword [ebp - 0x70]
call fcn.00404670
xor edx, edx
call fcn.0041d704
xor edx, edx
mov eax, 0x3e8
call fcn.0040be24
mov edx, 0x41e928
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x3c]
call fcn.004044bc
push edi
call sub.kernel32.dll_GlobalFindAtomA
test ax, ax
sete byte [ebp - 0xd]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
cmp byte [ebp - 0xd], 0
je 0x41e6d8
call fcn.0041b1b4
test al, al
je 0x41e6b5
cmp dword [ebp - 0x24], 0
je 0x41e6b5
mov eax, dword [ebp - 0x24]
call fcn.00406f2c
test al, al
je 0x41e6b5
mov eax, dword [ebp - 0x24]
call fcn.00407194
call fcn.0041b274
test al, al
je 0x41e6d8
cmp dword [ebp - 0x28], 0
je 0x41e6d8
mov eax, dword [ebp - 0x28]
call fcn.00406f2c
test al, al
je 0x41e6d8
mov eax, dword [ebp - 0x28]
call fcn.00407194
cmp byte [ebp - 0x2a], 0
jne 0x41e738
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x41e85c
mov edx, 0x41e894
mov eax, esi
call fcn.0041365c
mov eax, dword [ebp - 0x78]
push eax
mov eax, esi
call fcn.00413760
push eax
lea eax, [ebp - 0x7c]
push eax
mov ecx, 0x41e96c
mov edx, 0x41e96c
mov eax, esi
call fcn.0041365c
mov eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x41e97c
mov edx, 0x41e9cc
mov eax, esi
call fcn.0041365c
mov edx, dword [ebp - 0x80]
xor eax, eax
pop ecx
call fcn.0040c200
call fcn.004196d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e781
lea eax, [ebp - 0x80]
mov edx, 0x15
call fcn.004041f0
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.004041f0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041f0
lea eax, [ebp + 0xc]
call fcn.004041cc
ret