Function at 0x41ac70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e37f9
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x59da54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xd8], esi
xor edi, edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xd4], edi
push 0xe
push str.Launching_step
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.004071c0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push eax
call fcn.0040edd0
mov edx, dword [ebp - 0x2c]
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x41ad16
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41ad0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41ad0c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00493424
add esp, 8
push 9
push str.Launching
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.004071c0
mov ecx, dword [esi + 0x24]
lea eax, [ebp - 0x40]
push 1
push 1
push eax
mov dword [ebp - 4], 1
call fcn.0040d7b0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x41ad8b
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41ad81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41ad81
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00493424
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0x44
movlpd qword [ebp - 0x118], xmm0
movlpd qword [ebp - 0x110], xmm0
movlpd qword [ebp - 0x108], xmm0
movlpd qword [ebp - 0x100], xmm0
movlpd qword [ebp - 0xf8], xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
movlpd qword [ebp - 0xe0], xmm0
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov ecx, dword [esi + 0x28]
mov dword [ebp - 4], 2
cmp byte [ecx + 0xb8], 0
je 0x41aed2
lea eax, [ecx + 0x78]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00408600
push 5
push str.__ip
push 0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004105f0
lea ecx, [ebp - 0x40]
mov edi, 3
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x58]
push eax
movq qword [ebp - 0x48], xmm0
call fcn.00412770
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x41ae92
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41ae88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41aec2
push edx
push ecx
call fcn.00493424
add esp, 8
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x41aed2
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41aec8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41aec8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00493424
add esp, 8
push 4
push str..exe
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.004071c0
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x58]
add eax, 0x60
mov byte [ebp - 4], 4
push eax
call fcn.00408600
or edi, 4
push 0xc
push str.ControlTower
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00407060
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov edx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
mov byte [ebp - 4], 6
cmp edx, eax
jbe 0x41af8c
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0x41af8c
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x88]
push eax
push 0
call fcn.004105f0
jmp 0x41afa6
cmp esi, 0x10
lea eax, [ebp - 0x88]
push edx
cmovae eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x28]
push eax
call fcn.00407060
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov byte [eax], 0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 8
cmp edx, 0x10
jb 0x41b00e
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b004
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b093
push edx
push ecx
call fcn.00493424
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov edx, dword [ebp - 0x44]
mov byte [ebp - 4], 9
cmp edx, 0x10
jb 0x41b054
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b04a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b093
push edx
push ecx
call fcn.00493424
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov edx, dword [ebp - 0x74]
mov byte [ebp - 4], 0xa
cmp edx, 0x10
jb 0x41b0a3
mov ecx, dword [ebp - 0x88]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b099
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41b099
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00493424
add esp, 8
mov ecx, dword [ebp - 0x60]
mov eax, edi
or eax, 0x38
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
lea esi, [ecx + 1]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0xd4], eax
cmp esi, 0xf
jbe 0x41b118
cmp esi, 0x7fffffff
ja 0x41b48a
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x41b0ed
mov esi, accept
jmp 0x41b0f7
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407000
mov cl, byte [ebp - 0x28]
mov dword [ebp - 0x14], esi
mov byte [eax], cl
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
push ecx
cmovae eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x28]
push eax
call fcn.00407060
push 1
push 0x4e879c
lea ecx, [ebp - 0x28]
call fcn.00407060
push 8
push str.launched
lea ecx, [ebp - 0x28]
call fcn.00407060
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x48], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, edi
or eax, 0x78
mov dword [ebp - 0xd4], eax
push 1
push 0x4e879c
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xc
call fcn.00407060
mov dword [ebp - 0x90], 0
or edi, 0xf8
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0xd4], edi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 0xd
call fcn.00407060
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0xf
cmp edx, 0x10
jb 0x41b279
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b26f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b304
push edx
push ecx
call fcn.00493424
add esp, 8
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
mov edx, dword [ebp - 0x44]
mov byte [ebp - 4], 0x10
cmp edx, 0x10
jb 0x41b2c8
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b2be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b304
push edx
push ecx
call fcn.00493424
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x11
cmp edx, 0x10
jb 0x41b314
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b30a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41b30a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00493424
add esp, 8
cmp dword [ebp - 0xa4], 0x10
lea edx, [ebp - 0x12c]
push edx
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x18], 0
push edx
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x14], 0xf
cmovae ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 0x10
push 0
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41b48f
push 0
lea ecx, [ebp - 0x88]
call fcn.004898c0
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0x88]
push eax
push 0
mov byte [ebp - 4], 0x13
mov ecx, dword [ecx + 0x20]
call fcn.0040e400
lea ecx, [ebp - 0x88]
call fcn.00489ba0
mov edx, dword [ebp - 0xa4]
cmp edx, 0x10
jb 0x41b3dc
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b3d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b45f
push edx
push ecx
call fcn.00493424
add esp, 8
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
cmp edx, 0x10
jb 0x41b427
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b41d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b45f
push edx
push ecx
call fcn.00493424
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp edx, 0x10
jb 0x41b46f
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41b465
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41b465
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00493424
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493440
mov esp, ebp
pop ebp
ret
call fcn.00406ff0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0041b4d0
add esp, 8
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x12
call fcn.0040f3e0
push 0x511a84
lea eax, [ebp - 0x7c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3