Function at 0x41de70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xb8]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x80], 0
xor eax, eax
push fcn.0041de10
push ebp
push 0x40f960
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00424d20
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x74]
call fcn.0041f000
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xb0], 0
push 0
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 4]
mov ecx, str.extracted_
call fcn.00405b20
mov eax, dword [ebp - 4]
call fcn.0041f250
push 0
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 8]
mov ecx, str.CET_Archive.dat
call fcn.00405b20
mov edx, 1
mov eax, 0x431314
call fcn.00412d30
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 8]
mov dl, 1
call fcn.0041f5c0
test al, al
je 0x41e412
call fcn.0040ed40
test eax, eax
jne 0x41df71
lea eax, [ebp - 0x78]
xor edx, edx
call fcn.00405a20
jmp 0x41dfe0
lea eax, [ebp - 0x78]
mov edx, 0x432e64
call fcn.00405a20
call fcn.0040ed40
mov esi, eax
cmp esi, 1
jl 0x41dfe0
xor ebx, ebx
lea esi, [esi]
add ebx, 1
push 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x90], eax
mov eax, 0x432e74
mov dword [ebp - 0x8c], eax
mov eax, ebx
lea edx, [ebp - 0x80]
call fcn.00410070
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
mov eax, 0x432e74
mov dword [ebp - 0x84], eax
lea edx, [ebp - 0x90]
lea eax, [ebp - 0x78]
mov ecx, 3
call fcn.00405db0
cmp esi, ebx
jg 0x41df90
mov esi, esi
push 0
mov ecx, dword [ebp - 8]
mov edx, 1
mov eax, 0x4315b8
call fcn.00410980
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0xb8]
mov ecx, 4
call fcn.00410570
push 1
mov ecx, dword [ebp - 0xb8]
mov edx, 1
mov eax, 0x4380d4
call fcn.00428b00
mov esi, eax
jmp 0x41e2c1
lea edx, [ebp - 0xc]
mov eax, esi
mov ecx, 4
mov ebx, dword [esi]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [ebp - 0xc]
add eax, 1
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040b340
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov ebx, dword [esi]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov byte [eax + edx], 0
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
xor dx, dx
call fcn.00406370
mov eax, dword [ebp - 0x10]
call fcn.0040b370
lea edx, [ebp - 0xc]
mov eax, esi
mov ecx, 4
mov ebx, dword [esi]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [ebp - 0xc]
add eax, 1
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040b340
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov ebx, dword [esi]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov byte [eax + edx], 0
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
xor dx, dx
call fcn.00406370
mov eax, dword [ebp - 0x10]
call fcn.0040b370
cmp dword [ebp - 0x70], 0
je 0x41e128
lea eax, [ebp - 0x80]
call fcn.004024b0
push 0xffff
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x80]
call fcn.00405b20
mov eax, dword [ebp - 0x80]
call fcn.0041f330
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x84], edx
mov eax, edx
test edx, edx
je 0x41e10f
mov eax, dword [eax - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x41e128
push 0
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x70]
mov ecx, 0x432df0
call fcn.00405b20
mov eax, dword [ebp - 0x6c]
mov edx, str.toolmachine_i386.exe
call fcn.00406590
test eax, eax
jne 0x41e150
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00424d20
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x6c]
call fcn.0041f140
mov esi, esi
mov eax, dword [ebp - 0x6c]
mov edx, str.toolmachine_x86_64.exe
call fcn.00406590
test eax, eax
jne 0x41e178
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00424d20
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x6c]
call fcn.0041f140
mov esi, esi
mov eax, dword [ebp - 0x6c]
mov edx, str.toolmachine_i386.exe.sig
call fcn.00406590
test eax, eax
jne 0x41e1b8
push 0
lea edx, [ebp - 0x94]
xor eax, eax
call fcn.00424d20
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x80]
call fcn.0041f140
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
mov ecx, str..sig
call fcn.00405b20
mov esi, esi
mov eax, dword [ebp - 0x6c]
mov edx, str.toolmachine_x86_64.exe.sig
call fcn.00406590
test eax, eax
jne 0x41e1f8
push 0
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00424d20
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x94]
call fcn.0041f140
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x6c]
mov ecx, str..sig
call fcn.00405b20
mov esi, esi
lea eax, [ebp - 0x98]
call fcn.004024b0
push 0
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x98]
call fcn.00405b20
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xb4]
mov ebx, dword [ebp - 0xb4]
mov ecx, dword [ebx]
call dword [ecx + 0xa8]
push 0xff00
lea eax, [ebp - 0x98]
call fcn.004024b0
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x88], eax
lea edx, [ebp - 0x90]
mov ecx, 2
lea eax, [ebp - 0x98]
call fcn.00405db0
mov ecx, dword [ebp - 0x98]
mov edx, 1
mov eax, 0x4315b8
call fcn.00410980
mov edi, eax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
mov eax, esi
mov ecx, 4
mov ebx, dword [esi]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov edx, esi
mov eax, edi
call fcn.00410680
mov eax, edi
call fcn.00409160
add dword [ebp - 0xb0], 1
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x7c]
jl 0x41e030
mov eax, esi
call fcn.00409160
mov eax, dword [ebp - 0xb8]
call fcn.00409160
push 0
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00424d20
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x94]
call fcn.0041f140
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x14]
call fcn.00405b20
lea eax, [ebp - 0x94]
call fcn.004024b0
push 0xffff
mov edx, dword [ebp - 4]
mov ecx, str.CET_TRAINER.CETRAINER
lea eax, [ebp - 0x94]
call fcn.00405b20
mov eax, dword [ebp - 0x94]
mov dl, 1
call fcn.0041f5c0
test al, al
je 0x41e412
push 0x44
lea eax, [ebp - 0x58]
push eax
call fcn.00428970
push 0x10
lea eax, [ebp - 0x68]
push eax
call fcn.00428970
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41e376
mov eax, 0x43a2f0
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x98]
call fcn.004024b0
push 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], eax
mov eax, 0x432f54
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xa4], eax
mov eax, str.CET_TRAINER.CETRAINER_
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xac]
mov ecx, 4
lea eax, [ebp - 0x98]
call fcn.00405db0
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x41e3e4
mov eax, 0x43a2f0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x41e412
push 0xffffffffffffffff
push dword [ebp - 0x68]
call sub.kernel32.dll_WaitForSingleObject
mov eax, 0x7d0
call fcn.00425fc0
jmp 0x41e412
mov eax, 0x2710
call fcn.00425fc0
mov eax, dword [ebp - 4]
call fcn.0041dbc0
test al, al
je 0x41e408
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0041de10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret