Function at 0x441495
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test byte [0x5558f4], 0x40
je 0x4414bf
push 0xb
push 0
push dword [esi]
push 0
call fcn.00467118
jmp 0x44179b
mov dword [0x56f82c], 1
xor eax, eax
mov dword [0x56f834], eax
mov dword [0x56f830], 5
mov eax, dword [esi + 4]
test eax, eax
je 0x441520
cmp byte [eax], 0x2d
jne 0x441520
push 0x6e
push eax
call fcn.00539518
add esp, 8
test eax, eax
je 0x4414ff
mov dword [0x56f830], 7
push 0x70
push dword [esi + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x44151a
mov dword [0x56f834], 1
inc dword [0x56f82c]
mov edx, dword [0x56f82c]
cmp dword [esi + edx*4], 0
jne 0x44153e
push 0
push 0
push dword [esi]
push 0
call fcn.00467118
jmp 0x44179b
mov ecx, dword [0x56f82c]
mov eax, dword [esi + ecx*4]
cmp byte [eax], 0x22
jne 0x44158b
push 0
push 0x104
push edi
push dword [0x56f82c]
push esi
call fcn.004d670d
mov dword [0x56f82c], eax
cmp dword [0x56f82c], 0
jge 0x441580
push 3
push 0
push dword [esi]
push 0
call fcn.00467118
jmp 0x44179b
inc dword [0x56f82c]
jmp 0x441685
mov byte [edi], 0
jmp 0x441676
cmp byte [edi], 0
je 0x4415dc
cmp byte [edi + 1], 0
je 0x4415dc
push 0x3a
mov edx, dword [0x56f82c]
push dword [esi + edx*4]
call fcn.00539518
add esp, 8
test eax, eax
jne 0x441685
push ebx
push 0x54e017
push edi
call sub.SHELL32.dll_FindExecutableA
cmp eax, 0x1f
ja 0x441685
push 0x54e01a
push edi
call fcn.005394dc
add esp, 8
mov ecx, dword [0x56f82c]
push dword [esi + ecx*4]
push edi
call fcn.005394dc
add esp, 8
mov eax, dword [0x56f82c]
mov edx, dword [esi + eax*4]
push esi
push edi
mov edi, edx
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.00541e38
pop ecx
push 0x54e01d
push ebx
call fcn.005398cc
add esp, 8
test eax, eax
je 0x44163c
inc dword [0x56f82c]
jmp 0x441685
push 0x54e023
push ebx
call fcn.005398cc
add esp, 8
test eax, eax
je 0x441656
inc dword [0x56f82c]
jmp 0x441685
push str..bat
push ebx
call fcn.005398cc
add esp, 8
test eax, eax
je 0x441670
inc dword [0x56f82c]
jmp 0x441685
inc dword [0x56f82c]
mov eax, dword [0x56f82c]
cmp dword [esi + eax*4], 0
jne 0x441593
mov byte [ebx], 0
push esi
push ebx
push dword [0x56f82c]
call fcn.004d5691
cmp byte [edi], 0
jne 0x4416c7
cmp byte [ebx], 0
je 0x4416c7
push esi
push edi
mov esi, edi
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebx], 0
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 0x3e7
push 0
push 0x579058
call fcn.00539438
add esp, 0xc
cmp dword [0x56f834], 0
je 0x441727
push 0x572713
push 0x572613
push 0x572513
push 0x572510
push edi
call fcn.0053e8e0
add esp, 0x14
push 0x572513
push 0x572510
push 0x54e02f
push 0x579058
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp byte [0x579058], 0
jne 0x44175b
push esi
push edi
mov esi, 0x579058
mov edi, 0x553318
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push dword [0x56f830]
push 0x579058
push ebx
push edi
push 0
push dword [0x55b3c8]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x44178f
push 0
call sub.KERNEL32.dll_SetErrorMode
push 4
push edi
push dword [esi]
push 0
call fcn.00467118
jmp 0x44179b
push 0
call sub.KERNEL32.dll_SetErrorMode
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc