Function at 0x41a9f0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x41a9f9
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
mov eax, dword [ebp - 8]
call fcn.0040461c
mov eax, dword [ebp - 0xc]
call fcn.0040461c
mov eax, dword [ebp + 0xc]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41ad8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov bl, 1
mov edx, 0x41ada4
mov eax, dword [0x4218c4]
call fcn.004165ec
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00404220
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041a61c
test al, al
jne 0x41aa7c
call fcn.00416848
test al, al
je 0x41aa7c
lea eax, [ebp - 4]
call fcn.004167a8
cmp byte [ebp + 8], 0
je 0x41aa8f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041a6c0
mov ebx, eax
test bl, bl
je 0x41ad49
cmp byte [ebp + 8], 0
je 0x41aaaa
push 5
mov eax, dword [0x4218bc]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x3e8
call fcn.0040b958
lea eax, [ebp - 0x29]
push eax
push 0x41a40c
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00415ff8
mov eax, 0x3e8
call fcn.0040b958
cmp dword [ebp - 0x18], 0
je 0x41ad2b
call fcn.004115ec
test al, al
jne 0x41ad2b
cmp byte [ebp - 0x29], 0
je 0x41ad2b
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00404220
mov edx, dword [ebp - 0x18]
mov eax, 0x41adc0
call fcn.00404770
mov ebx, eax
test ebx, ebx
jle 0x41ab89
lea eax, [ebp - 0x34]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.0040468c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x1c]
call fcn.00406b64
push dword [ebp + 0xc]
push 0x41adcc
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040442c
mov ecx, eax
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x18]
call fcn.0040468c
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00406b64
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00406b64
mov edx, dword [ebp - 0x38]
lea eax, [ebp + 0xc]
call fcn.00404220
lea ecx, [ebp - 0x48]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0040c1f0
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.00404478
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404220
cmp dword [ebp + 0xc], 0
je 0x41abcd
push dword [ebp - 0x14]
push 0x41adcc
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004044ec
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00406cec
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x30]
mov edx, 0x41add8
call fcn.00404478
push dword [ebp - 0x14]
push 0x41ade4
push dword [ebp - 0x30]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004044ec
lea eax, [ebp - 0x24]
call fcn.0041703c
lea eax, [ebp - 0x28]
call fcn.004170b8
lea eax, [ebp - 0x50]
mov ecx, dword [ebp - 0x30]
mov edx, 0x41adf8
call fcn.00404478
mov eax, dword [ebp - 0x50]
call fcn.0040462c
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalAddAtomA
cmp byte [ebp + 8], 0
je 0x41ac4e
push 5
mov eax, dword [ebp - 0x14]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
jmp 0x41ac5e
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
cmp byte [0x420c18], 0
jne 0x41ac74
push 0
mov eax, dword [0x4218bc]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x4218bc]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x3e8
call fcn.0040b958
mov eax, dword [ebp - 0x18]
call fcn.00419e30
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 0x30]
mov edx, 0x41ae1c
call fcn.00404478
mov eax, dword [ebp - 0x54]
call fcn.0040462c
xor edx, edx
call fcn.00419ef0
mov eax, 0x3e8
call fcn.0040b958
mov edx, 0x41adf8
lea eax, [ebp - 0x58]
mov ecx, dword [ebp - 0x30]
call fcn.00404478
push ebx
call sub.kernel32.dll_GlobalFindAtomA
test ax, ax
sete byte [ebp - 0xd]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
cmp byte [ebp - 0xd], 0
je 0x41ad2b
call fcn.004183a8
test al, al
je 0x41ad08
cmp dword [ebp - 0x24], 0
je 0x41ad08
mov eax, dword [ebp - 0x24]
call fcn.00406ec8
test al, al
je 0x41ad08
mov eax, dword [ebp - 0x24]
call fcn.00407130
call fcn.00418468
test al, al
je 0x41ad2b
cmp dword [ebp - 0x28], 0
je 0x41ad2b
mov eax, dword [ebp - 0x28]
call fcn.00406ec8
test al, al
je 0x41ad2b
mov eax, dword [ebp - 0x28]
call fcn.00407130
cmp byte [ebp - 0x29], 0
jne 0x41ad49
push 0x41ae3c
push 0
mov ecx, 0x41ae74
mov edx, 0x41ae84
xor eax, eax
call fcn.0040bbcc
call fcn.00416a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ad92
lea eax, [ebp - 0x58]
mov edx, 0xb
call fcn.004041ac
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.004041ac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041ac
lea eax, [ebp + 0xc]
call fcn.00404188
ret