Function at 0x414368
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x483684], eax
mov eax, dword [0x482b4c]
xor ebx, ebx
cmp eax, ebx
jle 0x414438
cmp eax, 0x65
jge 0x414438
cmp dword [0x482b50], ebx
jne 0x4143af
cmp dword [0x482b54], ebx
je 0x414438
cmp eax, ebx
mov dword [0x482b68], ebx
mov dword [0x482b6c], ebx
mov dword [esp + 0x34], ebx
jle 0x414438
xor ebp, ebp
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
stosd dword es:[edi], eax
mov eax, dword [0x482b48]
mov edi, 0x482320
add eax, ebp
mov ecx, edi
push eax
call fcn.0041d46a
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x482b48]
lea ecx, [eax + ebp]
call fcn.0041fa6a
push eax
mov ecx, 0x4835e0
call fcn.00411ab6
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x482b68]
jle 0x414412
mov dword [0x482b68], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [0x482b6c]
jle 0x414423
mov dword [0x482b6c], eax
inc dword [esp + 0x34]
add ebp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, dword [0x482b4c]
jl 0x4143c5
jmp 0x41443d
mov edi, 0x482320
cmp byte [0x483654], bl
je 0x4144b3
call fcn.00426f05
call fcn.00426f82
call fcn.00427040
call fcn.00427070
call fcn.004270a0
call fcn.004270d0
call fcn.0042718d
call fcn.00427350
call fcn.0042746a
call fcn.00427584
call fcn.00427642
mov ecx, edi
call fcn.0041bdfa
cmp byte [0x483654], bl
je 0x4144b3
mov eax, dword [0x482a0c]
mov ecx, dword [0x482a04]
cmp eax, ecx
mov eax, dword [0x482a00]
jb 0x4144b3
ja 0x4144ab
mov edx, dword [0x482a08]
cmp edx, eax
jbe 0x4144b3
or eax, ecx
jne 0x4145bd
cmp dword [0x4826b0], 3
jbe 0x4144df
cmp dword [0x4829c4], ebx
jne 0x4144df
push ebx
mov ecx, 0x4826b0
call fcn.0041fa6a
push eax
call fcn.0040ef19
pop ecx
test al, al
pop ecx
je 0x4145bd
mov ecx, edi
call fcn.0041d2ec
push ebx
push ebx
mov ecx, esi
mov dword [0x482a10], 1
call fcn.00416feb
cmp dword [0x483658], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x10], ebx
je 0x41453a
push str._DisableWOW64FSRedirection_
call fcn.004206d1
cmp eax, 1
jne 0x41453a
push str.Wow64DisableWow64FsRedirection
push str.Kernel32
call ebp
push eax
call edi
cmp eax, ebx
je 0x41453a
lea ecx, [esp + 0x10]
push ecx
call eax
mov ecx, esi
call fcn.00413c42
cmp dword [0x483658], ebx
mov byte [esp + 0x34], al
je 0x414575
push str._DisableWOW64FSRedirection_
call fcn.004206d1
cmp eax, 1
jne 0x414575
push str.Wow64RevertWow64FsRedirection
push str.Kernel32
call ebp
push eax
call edi
cmp eax, ebx
je 0x414575
push dword [esp + 0x10]
call eax
cmp byte [esp + 0x34], bl
je 0x4145bd
push 2
pop eax
test byte [0x482504], al
je 0x414596
mov ecx, esi
mov dword [0x482a10], eax
call fcn.004120b1
test al, al
je 0x4145bd
test byte [0x482504], 4
je 0x4145c4
push ebx
push ebx
mov ecx, esi
mov dword [0x482a10], 3
call fcn.00416feb
mov ecx, esi
call fcn.00411daf
test al, al
jne 0x4145c4
xor al, al
jmp 0x41489b
cmp byte [0x483654], bl
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [0x482a10], 4
jne 0x4145f6
mov ecx, 0x4832a8
call fcn.0041fa6a
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421890
pop ecx
pop ecx
push ebx
push ebx
mov ecx, 0x482c68
call fcn.00416feb
push ebx
push ebx
mov ecx, esi
call fcn.00416feb
lea ecx, [esp + 0x24]
mov byte [0x482c01], 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.0041eab0
mov ebp, 0x482728
mov eax, dword [ebp]
sub esp, 0xc
mov dword [esp + 0x40], eax
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.0041eb84
lea eax, [esp + 0x24]
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x4c]
call fcn.0041558f
add ebp, 0x44
cmp ebp, 0x482838
jl 0x414628
cmp dword [esp + 0x14], ebx
jle 0x414683
push ebx
mov ecx, 0x4832b4
call fcn.0041fa6a
push eax
mov ecx, 0x482320
push dword [esi + 8]
call fcn.0041df67
jmp 0x414890
cmp byte [0x483654], bl
mov dword [0x482a10], 5
jne 0x4146af
mov ecx, 0x4832c0
call fcn.0041fa6a
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421890
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00416feb
mov ecx, esi
call fcn.00415407
test al, al
jne 0x4146dc
push ebx
mov ecx, 0x4832cc
call fcn.0041fa6a
push eax
mov ecx, 0x482320
push dword [esi + 8]
call fcn.0041df67
cmp byte [0x483654], bl
mov dword [0x482a10], 6
jne 0x414708
mov ecx, 0x4832d8
call fcn.0041fa6a
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421890
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00416feb
mov ecx, esi
call fcn.00415000
cmp byte [0x483654], bl
mov dword [0x482a10], 7
jne 0x414744
mov ecx, 0x4832e4
call fcn.0041fa6a
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421890
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00416feb
mov ecx, esi
call fcn.004123ab
test al, al
jne 0x414771
push ebx
mov ecx, 0x4832f0
call fcn.0041fa6a
push eax
mov ecx, 0x482320
push dword [esi + 8]
call fcn.0041df67
cmp byte [0x483654], bl
mov dword [0x482a10], 8
jne 0x41479d
mov ecx, 0x4832fc
call fcn.0041fa6a
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421890
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00416feb
push 0x4828f0
mov ecx, esi
call fcn.00415fd5
push dword [esi + 8]
mov ecx, 0x482b70
call fcn.004265cb
test al, al
je 0x414890
push ebx
push 0x64
mov ecx, esi
call fcn.00416feb
cmp dword [0x4829c4], ebx
jne 0x414818
cmp dword [0x482848], ebx
mov eax, dword [0x482508]
jg 0x4147ed
test eax, 0x20000
jne 0x414818
cmp byte [0x483654], bl
jne 0x414869
test eax, 0x10000
je 0x414820
push 1
push 0x432428
push ebx
mov ecx, esi
call fcn.00413629
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x483654], bl
jne 0x414869
mov ecx, 0x4835e0
call fcn.0041162c
push dword [0x4824f0]
call dword [sym.imp.USER32.dll_GetDC]
push 0xcc0020
push ebx
push ebx
mov esi, eax
push dword [0x4824fc]
push dword [0x4824ec]
push dword [0x4824e8]
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push dword [0x4824f0]
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x414878
call fcn.00427672
call fcn.004276a2
call fcn.00427753
cmp dword [0x4829c4], ebx
jne 0x41488e
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov bl, 1
lea ecx, [esp + 0x24]
call fcn.0041ebe6
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4