Function at 0x417090
Capabilities:
Create process on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x78], 0x1433e
mov dword [ebp - 0xc], 0x118d8
mov dword [ebp - 0x7c], 0x169aa
mov dword [ebp - 0x40], 0x1a12
mov dword [ebp - 0x68], 0xba04
mov dword [ebp - 0x3c], 0xa358
mov dword [ebp - 0x24], 0x16738
mov dword [ebp - 0x74], 0x73d3
mov dword [ebp - 0x38], 0x185f
mov dword [ebp - 0x54], 0x2933
mov dword [ebp - 0x10], 0x17033
mov dword [ebp - 0x1c], 0x100ae
mov dword [ebp - 0x18], 0xbc5
mov dword [ebp - 0x48], 0xbd82
mov dword [ebp - 0x44], 0xcb90
mov dword [ebp - 0x60], 0xb474
mov dword [ebp - 0x80], 0x170fb
mov dword [ebp - 0x70], 0x113ed
mov dword [ebp - 0x58], 0x13319
mov dword [ebp - 4], 0x7884
mov dword [ebp - 0x6c], 0x14a77
mov dword [ebp - 0x30], 0x6c62
mov dword [ebp - 0x34], 0x100c2
mov dword [ebp - 8], 0x131d0
mov dword [ebp - 0x5c], 0x900a
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
jmp 0x417163
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
sub edx, 0x5c43
cmp dword [ebp - 0x14], edx
jge 0x4172bf
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jge 0x4172ba
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x44]
jne 0x4172ba
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x10]
jne 0x4172ba
push 0x23ce
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
add esp, 4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x50]
jge 0x4171cd
mov dword [ebp - 0x28], 1
jmp 0x4171d4
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x58]
jge 0x4171e5
mov dword [ebp - 0x2c], 1
jmp 0x4171ec
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x28]
and edx, dword [ebp - 0x30]
and edx, dword [ebp - 0x5c]
and edx, dword [ebp - 0x2c]
je 0x4172ba
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0x4172ba
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0xc]
jne 0x4172ba
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x60]
jne 0x4172ba
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jne 0x4172ba
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x40]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x64], 0
je 0x417289
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jne 0x417289
mov ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp - 8]
jne 0x417289
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x1c]
jne 0x417289
push 0x3c8a
push 0xf2aa
push 0x113c8
push 0x8d30
push 0xb4ce
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
add esp, 0x14
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
push 0x3916
push 0xbc49
push 0x3c28
push 0x7957
push 0x126d9
push 0x16353
push 0x10a44
push 0x309c
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
add esp, 0x20
jmp 0x41715a
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x8316
push ecx
mov edx, dword [ebp - 0x6c]
add edx, 0x2af4
push edx
call fcn.0041a140
add esp, 8
mov eax, dword [ebp - 0x70]
sub eax, 0x307b
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x963
push ecx
mov edx, dword [ebp + 8]
add edx, 0xc54b
push edx
mov eax, dword [ebp - 0x40]
add eax, 0x4822
push eax
call fcn.00412290
add esp, 0x10
mov dword [ebp - 0x20], 0
jmp 0x41731b
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x74]
sub edx, 0x73d2
cmp dword [ebp - 0x20], edx
jge 0x417334
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x417312
mov esp, ebp
pop ebp
ret