Function at 0x41abc9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43a790
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x44e278]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x44e278]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], ecx
cmp eax, 0x401
jne 0x41ac1f
mov ecx, edi
call fcn.00419b70
jmp 0x41ae5e
cmp eax, 0x402
jne 0x41ac36
push dword [ebp + 0x10]
push ecx
mov ecx, edi
call fcn.0041bc01
jmp 0x41ae5e
cmp eax, 0x403
jne 0x41acb5
mov ecx, dword [edi + 0x48]
push 0x441a24
test ecx, ecx
je 0x41ac73
mov eax, dword [ecx]
lea edx, [esp + 0x4c]
push 0xa10005
push edx
call dword [eax + 0x2c]
add edi, 0x884
lea eax, [esp + 0x48]
xor ebx, ebx
mov ecx, edi
push eax
mov dword [esp + 0x74], ebx
call fcn.00423bb5
push ebx
jmp 0x41ac98
lea ecx, [esp + 0x4c]
call fcn.00401590
add edi, 0x884
mov dword [esp + 0x70], 1
lea eax, [esp + 0x48]
mov ecx, edi
push eax
call fcn.00423bb5
push 0
or dword [esp + 0x74], 0xffffffff
lea ecx, [esp + 0x4c]
push 1
call fcn.004017dc
push ecx
mov ecx, edi
call fcn.0042314f
jmp 0x41ae5e
cmp eax, 0x404
jne 0x41acfb
lea esi, [edi + 0x884]
push ecx
mov ecx, esi
call fcn.004239d0
mov ecx, dword [edi + 0x48]
test ecx, ecx
je 0x41acee
mov eax, dword [ecx]
xor ebx, ebx
push ebx
push ebx
push 0xa10001
call dword [eax + 0x24]
mov ecx, dword [edi + 0x48]
push ebx
push ebx
push 0xa10002
mov eax, dword [ecx]
call dword [eax + 0x24]
push ecx
mov ecx, esi
call fcn.0042314f
jmp 0x41ae57
cmp eax, 0x405
jne 0x41ae5e
mov al, byte [edi + 0x9bc]
test al, al
je 0x41ae57
push ecx
lea ecx, [edi + 0x884]
call fcn.00423db7
mov esi, eax
test esi, esi
je 0x41ae57
mov ecx, dword [ebp + 0x10]
sub ecx, 0x460
je 0x41add9
dec ecx
jne 0x41ae57
mov ecx, dword [esi + 0xc]
xor ebx, ebx
test ecx, ecx
je 0x41ad5a
push 0x100
push 0x461
call fcn.004150a2
jmp 0x41ad5c
mov al, bl
test al, al
je 0x41ae57
push ebx
push 0x100
push 0x461
mov ecx, esi
call fcn.00423ff3
mov ecx, dword [edi + 0x1120]
call fcn.004202e5
push 0x442e6c
lea ecx, [esp + 0x1c]
call fcn.00401590
lea eax, [esp + 0x18]
mov dword [esp + 0x70], 3
push eax
mov ecx, esi
call fcn.0040c2d4
or dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x18]
push ebx
push 1
call fcn.004017dc
mov dword [esi + 0x10], 4
mov ecx, dword [edi + 0x1120]
call fcn.004202f3
push 1
push dword [esp + 0x18]
lea ecx, [edi + 0x884]
call fcn.00423115
jmp 0x41ae57
push str._select__
lea ecx, [esp + 0x34]
call fcn.00401590
mov ecx, esi
mov dword [esp + 0x70], 2
call fcn.0040c279
mov esi, eax
mov ecx, esi
call fcn.00402286
push eax
push esi
lea ecx, [esp + 0x38]
call fcn.00405183
mov esi, 0x443fc8
mov ecx, esi
call fcn.00402286
push eax
push esi
lea ecx, [esp + 0x38]
call fcn.00405183
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
push 1
cmovae eax, dword [esp + 0x34]
xor ebx, ebx
push ebx
push eax
push str.explorer.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x30]
push ebx
push 1
call fcn.004017dc
mov ecx, edi
call fcn.0041b609
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00424209
mov esp, ebp
pop ebp
ret 0xc