Function at 0x41f450
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x462512
call fcn.0043b400
sub esp, 0x120
cmp byte [0x47d660], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
jne 0x41f47e
cmp byte [0x47dec0], 0
je 0x41f508
lea eax, [ebp - 0x11]
push 1
push eax
push 0x47859c
lea ecx, [ebp - 0xb4]
call fcn.0040a610
and dword [ebp - 4], 0
mov eax, 0x478864
mov ecx, eax
mov dword [ebp - 0xdc], 0x4675b0
test ecx, ecx
mov dword [ebp - 0xbc], 0x4675a8
jne 0x41f4bc
mov eax, 0x47d770
lea ecx, [ebp - 0x12]
push 0
push ecx
push eax
lea ecx, [ebp - 0xdc]
call fcn.0040b32a
lea eax, [ebp - 0xb4]
push 0x15a
push eax
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 1
call fcn.0045d6d0
and byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.00406295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.00406295
mov edi, dword [ebp + 8]
and dword [ebp - 0x20], 0
sub esp, 0x28
lea eax, [ebp + 0xb]
mov ecx, esp
mov dword [ebp - 0x24], esp
push 1
push eax
push edi
call fcn.00401712
lea ecx, [ebp - 0x12c]
call fcn.0041fad3
push 0x3c
lea eax, [ebp - 0x8c]
pop esi
mov dword [ebp - 4], 2
push esi
push 0
push eax
mov byte [ebp - 4], 3
call fcn.0043c580
lea eax, [ebx + 0x244]
lea ecx, [ebx + 0x248]
neg eax
sbb eax, eax
push 0x477794
and eax, ecx
mov dword [ebp - 0x8c], esi
push eax
call fcn.004297b2
add esp, 0x14
xor ecx, ecx
test al, al
sete cl
lea eax, [ebp - 0x12]
push 1
mov dword [ebp - 0x70], ecx
push eax
push edi
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x88], 0x800440
mov dword [ebp - 0x74], edi
call fcn.0040a610
lea eax, [ebx + 0x1a4]
lea ecx, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 4
call fcn.00425ac1
lea ecx, [ebp - 0xb4]
call fcn.0040bbda
mov ecx, ebx
mov dword [ebp - 0x7c], eax
call fcn.004086de
test al, al
jne 0x41f5d4
mov ecx, ebx
call fcn.0041fa49
test al, al
je 0x41f5db
mov dword [ebp - 0x80], 0x47885c
cmp dword [ebp + 0xc], 0
jne 0x41f5f0
cmp byte [ebx + 0x161], 0
lea eax, [ebx + 0x1cc]
je 0x41f5f6
lea eax, [ebx + 0x1f4]
push eax
lea eax, [ebp - 0xdc]
push eax
mov ecx, ebx
call fcn.00425517
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 5
call fcn.0040bbda
mov dword [ebp - 0x78], eax
mov eax, 0x478844
mov ecx, eax
mov edi, 0x4675b0
mov esi, 0x4675a8
mov dword [ebp - 0x50], edi
test ecx, ecx
mov dword [ebp - 0x30], esi
jne 0x41f637
mov eax, 0x47d770
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b32a
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0042149d
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406295
push 0
lea eax, [ebp - 0xb4]
push 0
push eax
mov ecx, ebx
call fcn.0042149d
mov eax, 0x47883c
mov dword [ebp - 0x50], edi
mov ecx, eax
mov dword [ebp - 0x30], esi
test ecx, ecx
jne 0x41f68d
mov eax, 0x47d770
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b32a
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 7
call fcn.0042149d
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406295
lea eax, [ebp + 0xf]
push 1
push eax
lea ecx, [ebp - 0x50]
push dword [ebp - 0x80]
call fcn.0040a610
push 0
lea eax, [ebp - 0x50]
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.0042149d
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406295
mov eax, 0x478834
mov dword [ebp - 0x50], edi
mov ecx, eax
mov dword [ebp - 0x30], esi
test ecx, ecx
jne 0x41f701
mov eax, 0x47d770
xor esi, esi
lea ecx, [ebp + 0xf]
push esi
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b32a
push esi
lea eax, [ebp - 0x50]
push esi
push eax
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.0042149d
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00406295
push esi
lea eax, [ebp - 0xdc]
push 1
push eax
mov ecx, ebx
call fcn.0042149d
mov ecx, ebx
call fcn.00420f40
mov eax, dword [ebp - 0xd4]
cmp eax, esi
jne 0x41f75a
mov ebx, 0x4675bc
mov dword [ebp - 0x28], ebx
jmp 0x41f762
mov dword [ebp - 0x28], eax
mov ebx, 0x4675bc
lea eax, [ebp + 0xf]
push 1
push eax
lea ecx, [ebp - 0x104]
push dword [ebp - 0x80]
call fcn.0040a610
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xa
cmp eax, esi
mov dword [ebp - 0x24], ebx
je 0x41f787
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xac], esi
mov esi, ebx
je 0x41f797
mov esi, dword [ebp - 0xac]
lea eax, [ebp - 0x11]
push 1
mov edi, 0x47859c
push eax
push edi
lea ecx, [ebp - 0x50]
call fcn.0040a610
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xb
test eax, eax
jne 0x41f7b8
mov eax, ebx
push dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x17e
push dword [ebp - 0x24]
push esi
push 0x4787a0
push eax
call fcn.004083a8
add esp, 0x14
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xa
call fcn.00406295
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 5
call fcn.00406295
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41f95e
cmp dword [ebp - 0x54], 0
jne 0x41f88c
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a610
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xc
test eax, eax
jne 0x41f82f
mov eax, ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x478734
push eax
mov dword [ebp - 0x18], 0x185
call fcn.004083a8
pop ecx
mov byte [ebp - 4], 5
pop ecx
lea ecx, [ebp - 0x104]
call fcn.00406295
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00406295
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00406295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.0041fb6c
xor eax, eax
jmp 0x41f9e3
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x113
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x54]
push 0
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x41f8fc
cmp eax, 1
jne 0x41f8fc
push 1
push ebx
push ebx
lea eax, [ebp - 0x44]
push 0
push eax
call esi
test eax, eax
jne 0x41f8d7
push 0x270001
push eax
push eax
push eax
lea eax, [ebp - 0x44]
push eax
call esi
test eax, eax
je 0x41f897
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41f8b5
jmp 0x41f897
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a610
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xd
test eax, eax
jne 0x41f934
mov eax, 0x4675bc
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x1a9
push 0x4786d4
push eax
call fcn.004083a8
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
jmp 0x41f9ac
lea eax, [ebp + 0xf]
push 1
push eax
push edi
lea ecx, [ebp - 0x104]
call fcn.0040a610
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x41f97d
mov eax, ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x1ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push 0x478654
push eax
call fcn.004083a8
add esp, 0x10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
call fcn.00406295
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00406295
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00406295
mov esi, dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.0041fb6c
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8