Function at 0x4108c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455ceb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x1d0]
mov ecx, 0x71
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x460280]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0x40], ecx
jmp 0x410929
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x410a2c
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 8]
sub ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0xc]
sbb edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1c4], edx
jne 0x410960
cmp dword [ebp - 0x1c8], 0x40000
jb 0x410a0f
mov eax, dword [ebp - 0x28]
add eax, 0x40000
mov ecx, dword [ebp - 0x24]
adc ecx, 0
sub eax, 1
sbb ecx, 0
push 0
push 0x40000
push ecx
push eax
call fcn.004337f0
push edx
push eax
call fcn.004331eb
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, 0x40000
mul ecx
add eax, 0x40000
adc edx, 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
jmp 0x4109c4
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x40000
mov edx, dword [ebp - 0x24]
adc edx, 0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c4]
mov edx, dword [ebp - 0x24]
cmp edx, dword [ecx + 0xc]
ja 0x410a07
jb 0x4109eb
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax + 8]
ja 0x410a07
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [ecx + edx]
cmp eax, 2
jge 0x410a05
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
jmp 0x410a07
jmp 0x4109a6
cmp dword [ebp - 0x34], 0xffffffff
je 0x410a0f
jmp 0x410a2c
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov edx, dword [eax + 8]
add edx, dword [ecx + 0x10]
mov eax, dword [eax + 0xc]
adc eax, dword [ecx + 0x14]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
jmp 0x410920
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x5c], ecx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x24]
jb 0x410ae8
ja 0x410a55
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x28]
jbe 0x410ae8
cmp dword [ebp - 0x34], 0xffffffff
jne 0x410ae8
mov eax, dword [ebp - 0x28]
add eax, 0x40000
mov ecx, dword [ebp - 0x24]
adc ecx, 0
sub eax, 1
sbb ecx, 0
push 0
push 0x40000
push ecx
push eax
call fcn.004337f0
push edx
push eax
call fcn.004331eb
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov ecx, 0x40000
mul ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
jmp 0x410aa6
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
ja 0x410ae8
jb 0x410ab8
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x5c]
jae 0x410ae8
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x68]
movzx eax, byte [ecx + edx]
cmp eax, 2
jge 0x410ad2
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x34], eax
jmp 0x410ae8
mov eax, dword [ebp - 0x28]
add eax, 0x40000
mov ecx, dword [ebp - 0x24]
adc ecx, 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x410a9d
cmp dword [ebp - 0x34], 0xffffffff
je 0x410e11
lea ecx, [ebp - 0xcc]
call fcn.00409e60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xcc]
call fcn.00409f50
mov eax, dword [ebp - 0x34]
shl eax, 0x12
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
sub esi, eax
mov eax, dword [edx + 0x1c]
sbb eax, ecx
push eax
push esi
call fcn.004331eb
cmp eax, 0x40000
jbe 0x410b3e
mov dword [ebp - 0x1c4], 0x40000
jmp 0x410b60
mov ecx, dword [ebp - 0x34]
shl ecx, 0x12
xor edx, edx
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x18]
sub esi, ecx
mov ecx, dword [eax + 0x1c]
sbb ecx, edx
push ecx
push esi
call fcn.004331eb
mov dword [ebp - 0x1c4], eax
mov edx, dword [ebp - 0x1c4]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x34]
mov eax, dword [ecx + edx*4]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0040a010
lea ecx, [ebp - 0xcc]
call fcn.0040a060
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xcc]
call fcn.00409fc0
push 0x10
mov eax, dword [ebp - 0x34]
shl eax, 4
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx + 0x30]
push eax
lea edx, [ebp - 0xe4]
push edx
call fcn.004333e0
add esp, 0xc
test eax, eax
jne 0x410d16
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x34]
mov byte [ecx + edx], 2
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x2c]
add ecx, 1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x2c], ecx
cmp dword [0x462550], 0
je 0x410c08
mov esi, esp
push 0
push 1
push 0x403
mov eax, dword [0x462550]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.0043234a
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00410830
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xf4], 0
jne 0x410c3c
mov eax, dword [0x462390]
push eax
mov ecx, dword [0x462338]
mov ecx, dword [ecx]
call fcn.004030f0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0xf4], eax
mov eax, dword [ebp - 0x34]
shl eax, 0x12
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
sub esi, eax
mov eax, dword [edx + 0x1c]
sbb eax, ecx
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1c4], eax
ja 0x410c6b
cmp dword [ebp - 0x1c8], 0x40000
jbe 0x410c81
mov dword [ebp - 0x1d0], 0x40000
mov dword [ebp - 0x1cc], 0
jmp 0x410ca2
mov ecx, dword [ebp - 0x34]
shl ecx, 0x12
xor edx, edx
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x18]
sub esi, ecx
mov ecx, dword [eax + 0x1c]
sbb ecx, edx
mov dword [ebp - 0x1d0], esi
mov dword [ebp - 0x1cc], ecx
push 0
mov edx, dword [ebp - 0x1cc]
push edx
mov eax, dword [ebp - 0x1d0]
push eax
mov ecx, dword [ebp - 0x34]
shl ecx, 0x12
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x34]
mov eax, dword [ecx + edx*4]
push eax
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0xf4]
call fcn.00402e00
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x34]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
push ecx
call fcn.004323ff
add esp, 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x34]
mov dword [ecx + edx*4], 0
jmp 0x410dff
mov eax, dword [ebp - 0x34]
push eax
push str.validate_fail:_block_d_n
push 0x20
push 0x462328
call fcn.00401280
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x34]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0x1b0]
push ecx
call fcn.004323ff
add esp, 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x34]
mov dword [ecx + edx*4], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x34]
mov byte [ecx + edx], 1
mov eax, dword [ebp - 0x34]
shl eax, 0x12
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
sub esi, eax
mov eax, dword [edx + 0x1c]
sbb eax, ecx
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1c4], eax
ja 0x410da1
cmp dword [ebp - 0x1c8], 0x40000
jbe 0x410db7
mov dword [ebp - 0x1d0], 0x40000
mov dword [ebp - 0x1cc], 0
jmp 0x410dd8
mov ecx, dword [ebp - 0x34]
shl ecx, 0x12
xor edx, edx
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x18]
sub esi, ecx
mov ecx, dword [eax + 0x1c]
sbb ecx, edx
mov dword [ebp - 0x1d0], esi
mov dword [ebp - 0x1cc], ecx
mov edx, dword [ebp - 0x1cc]
push edx
mov eax, dword [ebp - 0x1d0]
push eax
mov ecx, dword [ebp - 0x34]
shl ecx, 0x12
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x18]
add eax, 0x48
push eax
call fcn.00403c40
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.00409f10
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x48], 0
jne 0x410ef6
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x2c]
xor edi, edi
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x18]
add edx, 0x40000
mov eax, dword [ecx + 0x1c]
adc eax, 0
sub edx, 1
sbb eax, 0
push 0
push 0x40000
push eax
push edx
call fcn.004337f0
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1c4], edi
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], edx
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [ebp - 0x1d0]
jne 0x410ef6
mov edx, dword [ebp - 0x1c4]
cmp edx, dword [ebp - 0x1cc]
jne 0x410ef6
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xb8], 1
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xbc], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xf4]
call fcn.004033b0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xf4], 0
mov esi, esp
push 1
push 0
push 0
mov eax, dword [0x462390]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp esi, esp
call fcn.0043234a
mov esi, esp
push 0
push 0
push 0x12
mov eax, dword [0x462534]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, esp
call fcn.0043234a
push edx
mov ecx, ebp
push eax
lea edx, [0x410f2d]
call fcn.0043236d
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00432663
pop edi
pop esi
pop ebx
add esp, 0x1d0
cmp ebp, esp
call fcn.0043234a
mov esp, ebp
pop ebp
ret