Function at 0x4143e6
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x483784], eax
mov eax, dword [0x482c54]
xor ebx, ebx
cmp eax, ebx
jle 0x4144b6
cmp eax, 0x65
jge 0x4144b6
cmp dword [0x482c58], ebx
jne 0x41442d
cmp dword [0x482c5c], ebx
je 0x4144b6
cmp eax, ebx
mov dword [0x482c70], ebx
mov dword [0x482c74], ebx
mov dword [esp + 0x34], ebx
jle 0x4144b6
xor ebp, ebp
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
stosd dword es:[edi], eax
mov eax, dword [0x482c50]
mov edi, 0x482408
add eax, ebp
mov ecx, edi
push eax
call fcn.0041d6f6
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x482c50]
lea ecx, [eax + ebp]
call fcn.0041ff07
push eax
mov ecx, 0x4836e8
call fcn.00411afa
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x482c70]
jle 0x414490
mov dword [0x482c70], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [0x482c74]
jle 0x4144a1
mov dword [0x482c74], eax
inc dword [esp + 0x34]
add ebp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, dword [0x482c54]
jl 0x414443
jmp 0x4144bb
mov edi, 0x482408
cmp byte [0x48375c], bl
je 0x414531
call fcn.004275af
call fcn.0042762c
call fcn.004276ea
call fcn.0042771a
call fcn.0042774a
call fcn.0042777a
call fcn.00427837
call fcn.004279fa
call fcn.00427b14
call fcn.00427c2e
call fcn.00427cec
mov ecx, edi
call fcn.0041c037
cmp byte [0x48375c], bl
je 0x414531
mov eax, dword [0x482b14]
mov ecx, dword [0x482b0c]
cmp eax, ecx
mov eax, dword [0x482b08]
jb 0x414531
ja 0x414529
mov edx, dword [0x482b10]
cmp edx, eax
jbe 0x414531
or eax, ecx
jne 0x41463b
cmp dword [0x4827b8], 3
jbe 0x41455d
cmp dword [0x482acc], ebx
jne 0x41455d
push ebx
mov ecx, 0x4827b8
call fcn.0041ff07
push eax
call fcn.0040ef3c
pop ecx
test al, al
pop ecx
je 0x41463b
mov ecx, edi
call fcn.0041d578
push ebx
push ebx
mov ecx, esi
mov dword [0x482b18], 1
call fcn.00417086
cmp dword [0x483760], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x10], ebx
je 0x4145b8
push str._DisableWOW64FSRedirection_
call fcn.00420b6e
cmp eax, 1
jne 0x4145b8
push str.Wow64DisableWow64FsRedirection
push str.Kernel32
call ebp
push eax
call edi
cmp eax, ebx
je 0x4145b8
lea ecx, [esp + 0x10]
push ecx
call eax
mov ecx, esi
call fcn.00413c7d
cmp dword [0x483760], ebx
mov byte [esp + 0x34], al
je 0x4145f3
push str._DisableWOW64FSRedirection_
call fcn.00420b6e
cmp eax, 1
jne 0x4145f3
push str.Wow64RevertWow64FsRedirection
push str.Kernel32
call ebp
push eax
call edi
cmp eax, ebx
je 0x4145f3
push dword [esp + 0x10]
call eax
cmp byte [esp + 0x34], bl
je 0x41463b
push 2
pop eax
test byte [0x48260c], al
je 0x414614
mov ecx, esi
mov dword [0x482b18], eax
call 0x4120f5
test al, al
je 0x41463b
test byte [0x48260c], 4
je 0x414642
push ebx
push ebx
mov ecx, esi
mov dword [0x482b18], 3
call fcn.00417086
mov ecx, esi
call fcn.00411df3
test al, al
jne 0x414642
xor al, al
jmp 0x414919
cmp byte [0x48375c], bl
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [0x482b18], 4
jne 0x414674
mov ecx, 0x4833b0
call fcn.0041ff07
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421d2d
pop ecx
pop ecx
push ebx
push ebx
mov ecx, 0x482d70
call fcn.00417086
push ebx
push ebx
mov ecx, esi
call fcn.00417086
lea ecx, [esp + 0x24]
mov byte [0x482d09], 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.0041ef35
mov ebp, 0x482830
mov eax, dword [ebp]
sub esp, 0xc
mov dword [esp + 0x40], eax
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.0041f009
lea eax, [esp + 0x24]
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x4c]
call fcn.0041560d
add ebp, 0x44
cmp ebp, 0x482940
jl 0x4146a6
cmp dword [esp + 0x14], ebx
jle 0x414701
push ebx
mov ecx, 0x4833bc
call fcn.0041ff07
push eax
mov ecx, 0x482408
push dword [esi + 8]
call fcn.0041e1f3
jmp 0x41490e
cmp byte [0x48375c], bl
mov dword [0x482b18], 5
jne 0x41472d
mov ecx, 0x4833c8
call fcn.0041ff07
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421d2d
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00417086
mov ecx, esi
call fcn.00415485
test al, al
jne 0x41475a
push ebx
mov ecx, 0x4833d4
call fcn.0041ff07
push eax
mov ecx, 0x482408
push dword [esi + 8]
call fcn.0041e1f3
cmp byte [0x48375c], bl
mov dword [0x482b18], 6
jne 0x414786
mov ecx, 0x4833e0
call fcn.0041ff07
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421d2d
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00417086
mov ecx, esi
call fcn.0041507e
cmp byte [0x48375c], bl
mov dword [0x482b18], 7
jne 0x4147c2
mov ecx, 0x4833ec
call fcn.0041ff07
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421d2d
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00417086
mov ecx, esi
call fcn.004123ef
test al, al
jne 0x4147ef
push ebx
mov ecx, 0x4833f8
call fcn.0041ff07
push eax
mov ecx, 0x482408
push dword [esi + 8]
call fcn.0041e1f3
cmp byte [0x48375c], bl
mov dword [0x482b18], 8
jne 0x41481b
mov ecx, 0x483404
call fcn.0041ff07
push eax
push 0x14
push dword [esi + 8]
call edi
push eax
call fcn.00421d2d
pop ecx
pop ecx
push ebx
push ebx
mov ecx, esi
call fcn.00417086
push 0x4829f8
mov ecx, esi
call fcn.00416053
push dword [esi + 8]
mov ecx, 0x482c78
call fcn.00426c75
test al, al
je 0x41490e
push ebx
push 0x64
mov ecx, esi
call fcn.00417086
cmp dword [0x482acc], ebx
jne 0x414896
cmp dword [0x482950], ebx
mov eax, dword [0x482610]
jg 0x41486b
test eax, 0x20000
jne 0x414896
cmp byte [0x48375c], bl
jne 0x4148e7
test eax, 0x10000
je 0x41489e
push 1
push 0x432518
push ebx
mov ecx, esi
call fcn.00413664
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x48375c], bl
jne 0x4148e7
mov ecx, 0x4836e8
call fcn.00411670
push dword [0x4825f8]
call dword [sym.imp.USER32.dll_GetDC]
push 0xcc0020
push ebx
push ebx
mov esi, eax
push dword [0x482604]
push dword [0x4825f4]
push dword [0x4825f0]
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push dword [0x4825f8]
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x4148f6
call fcn.00427d1c
call fcn.00427d4c
call fcn.00427dfd
cmp dword [0x482acc], ebx
jne 0x41490c
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov bl, 1
lea ecx, [esp + 0x24]
call fcn.0041f06b
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4