Function at 0x41d620
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0xe54
lea eax, [esp + 0x254]
push ebx
push ebp
mov ebp, dword [esp + 0xe64]
push esi
push edi
push ebp
push 0x495568
push str._sUsers_s.___
push eax
call fcn.00436cce
lea ecx, [esp + 0x74]
lea edx, [esp + 0x174]
push ecx
lea eax, [esp + 0x278]
push edx
push eax
call fcn.0041d3e0
add esp, 0x1c
xor ebx, ebx
test ax, ax
je 0x41d6df
mov eax, dword [esp + 0xe68]
lea esi, [esp + 0x164]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41d69f
cmp cl, bl
je 0x41d69b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41d69f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x41d67b
xor eax, eax
jmp 0x41d6a4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41d6df
lea esi, [esp + 0x64]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41d6d2
cmp cl, bl
je 0x41d6ce
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41d6d2
add eax, 2
add esi, 2
cmp cl, bl
jne 0x41d6ae
xor eax, eax
jmp 0x41d6d7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x41d97f
mov eax, dword [esp + 0xe70]
push eax
call fcn.0041d520
lea ecx, [esp + 0x268]
push 0x482f54
push ecx
mov edi, eax
call fcn.00436ea0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x41d716
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe54
ret
mov edx, dword [0x47c36c]
push edx
push 0x483a9c
push esi
call fcn.004373a6
mov eax, dword [0x47bc54]
push eax
push 0x483a9c
push esi
call fcn.004373a6
mov ecx, dword [0x47c438]
push ecx
push 0x483a9c
push esi
call fcn.004373a6
mov edx, dword [0x47c43c]
push edx
push 0x483a9c
push esi
call fcn.004373a6
push 0x110
push 0x483a9c
push esi
call fcn.004373a6
push 0x6c
push 0x483a9c
push esi
call fcn.004373a6
add esp, 0x48
and edi, 0xffff
push edi
push 0x483a9c
push esi
call fcn.004373a6
mov eax, dword [esp + 0xe74]
push eax
push 0x482c78
push esi
call fcn.004373a6
push ebp
push 0x482c78
push esi
call fcn.004373a6
push 2
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
add esp, 0x48
push ebx
push 0x483a9c
push esi
call fcn.004373a6
mov ecx, dword [0x477168]
push ecx
push 0x483a9c
push esi
call fcn.004373a6
mov edx, dword [0x477168]
push edx
push 0x483a9c
push esi
call fcn.004373a6
mov eax, dword [0x477168]
push eax
push 0x483a9c
push esi
call fcn.004373a6
mov ecx, dword [0x477180]
push ecx
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
add esp, 0x48
push 0x3e8
push 0x483a9c
push esi
call fcn.004373a6
push 0x1e
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push 1
push 0x483a9c
push esi
call fcn.004373a6
add esp, 0x48
push str..COM1
push 0x482c78
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push str.38400
push 0x482c78
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push str.1500
push 0x482c78
push esi
call fcn.004373a6
push str._KE_WR_6_1
push 0x482c78
push esi
call fcn.004373a6
add esp, 0x48
push str._KE_WR_6_0
push 0x482c78
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push ebx
push 0x483a9c
push esi
call fcn.004373a6
push 0x483a64
push 0x482c78
push esi
call fcn.004373a6
push 0x482958
push 0x482c78
push esi
call fcn.004373a6
mov edx, dword [0x47c438]
push edx
push 0x483a9c
push esi
call fcn.004373a6
mov eax, dword [0x47c438]
add esp, 0x48
push eax
push 0x483a9c
push esi
call fcn.004373a6
mov ecx, dword [0x47c438]
push ecx
push 0x483a9c
push esi
call fcn.004373a6
mov edx, dword [0x47c438]
push edx
push 0x483a9c
push esi
call fcn.004373a6
push esi
call fcn.00436d20
add esp, 0x28
mov eax, 0xa
push 0x483a58
mov dword [esp + 0x24], eax
mov word [esp + 0x44], ax
push 0x495568
lea eax, [esp + 0xa6c]
push 0x48299c
push eax
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov word [esp + 0x52], bx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x34], 0x173
mov dword [esp + 0x4c], 4
call fcn.00436cce
lea ecx, [esp + 0x274]
lea edx, [esp + 0x674]
push ecx
push 0x483a58
push 0x495568
push str.__s_s___s
push edx
call fcn.00436cce
add esp, 0x24
lea eax, [esp + 0x54]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x664]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xa84]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xe54
ret