Function at 0x41eb0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x757d2c]
test eax, eax
jne 0x41eb40
mov edx, dword [0x6f6a90]
test edx, edx
jne 0x41eb38
mov ecx, dword [0x6f6a94]
test ecx, ecx
je 0x41eb4f
mov eax, dword [0x6f6a98]
dec eax
jne 0x41eb4f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0042c184
jmp 0x41ef7b
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x318]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
call fcn.0065ccf0
test eax, eax
je 0x41ef7b
mov edx, dword [0x6e7628]
test edx, edx
je 0x41ef7b
mov eax, dword [ebp - 0xc]
call fcn.0065ccf0
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x10], edx
call fcn.00404a38
xor ecx, ecx
mov dword [0x6f6920], ecx
mov eax, dword [ebp - 0x10]
mov dl, byte [eax + 0x121]
test dl, dl
je 0x41ec6e
mov eax, dword [0x6e7628]
call fcn.00653afc
test eax, eax
jle 0x41ebf2
mov eax, dword [ebp - 0xc]
call fcn.0065ccf0
add eax, 0x24
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx]
test ecx, ecx
je 0x41ebd1
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
jmp 0x41ebd6
mov edx, 0x6eb33e
push edx
push 0x82617c
push 0x6eb338
lea eax, [ebp - 0x424]
push eax
call fcn.00670e94
add esp, 0x10
jmp 0x41ec2a
mov eax, dword [ebp - 0xc]
call fcn.0065ccf0
add eax, 0x24
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
test ecx, ecx
je 0x41ec10
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
jmp 0x41ec15
mov edx, 0x6eb343
push edx
push 0x6eb33f
lea eax, [ebp - 0x424]
push eax
call fcn.00670e94
add esp, 0xc
lea edx, [ebp - 0x424]
mov eax, dword [ebp - 4]
call fcn.004195d8
mov ecx, dword [0x6e7668]
test ecx, ecx
je 0x41ef6e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
call fcn.0065961c
test eax, eax
je 0x41ef6e
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x41ef6e
mov edx, dword [ebp - 0x10]
mov al, byte [edx + 0x122]
test al, al
je 0x41ec91
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x140]
mov eax, dword [ebp - 4]
call fcn.004194c4
jmp 0x41ef6e
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx + 0x120]
test al, al
je 0x41eecf
mov edx, dword [0x6e75f0]
test edx, edx
jne 0x41ecb6
call fcn.00404a4c
jmp 0x41ef7b
push 0x82554e
call fcn.0045d620
pop ecx
test eax, eax
jge 0x41ed05
call fcn.00404a4c
push 0x82554e
push 0x59f5
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0xc
push 0x9f2fb4
mov eax, dword [sym.UltraISO.exe__frmMain]
call fcn.00640730
push eax
call fcn.0046279c
add esp, 8
jmp 0x41ef7b
mov eax, dword [ebp - 0xc]
call fcn.0065ccf0
add eax, 0x24
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx]
test ecx, ecx
je 0x41ed23
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
jmp 0x41ed28
mov edx, 0x6eb34a
push edx
push 0x8243fb
push 0x6eb344
lea eax, [ebp - 0x424]
push eax
call fcn.00670e94
add esp, 0x10
push 0
lea ecx, [ebp - 0x424]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x41ed78
push 0x80
lea eax, [ebp - 0x424]
push eax
call fcn.0066e8e4
add esp, 8
lea edx, [ebp - 0x424]
push edx
call fcn.00671420
pop ecx
push 1
call fcn.00450ef4
pop ecx
push 0x2e
lea ecx, [ebp - 0x424]
push ecx
call fcn.0066cb35
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x118]
mov dword [0x82657c], edx
mov edx, dword [eax + 0x11c]
mov dword [0x826580], edx
mov dword [0x826584], 0
mov dword [0x826588], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41eec5
push dword [ebp - 0x14]
call fcn.0041a898
pop ecx
test eax, eax
je 0x41ee64
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x11c], 0
jne 0x41edf9
cmp dword [eax + 0x118], 0x80000
jbe 0x41ee00
jmp 0x41edfb
jle 0x41ee00
call fcn.00441118
push 0x8243fb
push dword [ebp - 0x10]
call fcn.00451490
add esp, 8
test eax, eax
je 0x41ee5d
call fcn.00441200
mov edx, dword [0x6e7638]
test edx, edx
je 0x41ee45
push 0x5a5f
call fcn.00402a64
pop ecx
push eax
push dword [0x6e716c]
call fcn.00462810
add esp, 8
test eax, eax
je 0x41eec5
xor ecx, ecx
mov dword [0x6e7380], ecx
lea edx, [ebp - 0x424]
mov eax, dword [ebp - 4]
call fcn.00407060
jmp 0x41eec5
call fcn.00441200
jmp 0x41eec5
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x11c], 0
jne 0x41ee7e
cmp dword [ecx + 0x118], 0x80000
jbe 0x41ee85
jmp 0x41ee80
jle 0x41ee85
call fcn.00441118
push 0x8243fb
push dword [ebp - 0x10]
call fcn.00451490
add esp, 8
test eax, eax
je 0x41eec0
call fcn.00441200
push 5
push 0x8243fb
push 0
lea eax, [ebp - 0x424]
push eax
push 0x6eb34b
push dword [0x6e716c]
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x41eec5
call fcn.00441200
call fcn.0045d7c0
jmp 0x41ef6e
mov edx, dword [ebp - 0x10]
push dword [edx + 0x134]
lea ecx, [ebp - 0x424]
push ecx
call fcn.0066c9ec
add esp, 8
push 0x2e
lea eax, [ebp - 0x424]
push eax
call fcn.0066cb35
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x41ef6e
push dword [ebp - 0x14]
call fcn.0041a898
pop ecx
test eax, eax
je 0x41ef4e
mov ecx, dword [0x6e7638]
test ecx, ecx
je 0x41ef37
push 0x5a5f
call fcn.00402a64
pop ecx
push eax
push dword [0x6e716c]
call fcn.00462810
add esp, 8
test eax, eax
je 0x41ef6e
xor eax, eax
mov dword [0x6e7380], eax
lea edx, [ebp - 0x424]
mov eax, dword [ebp - 4]
call fcn.00407060
jmp 0x41ef6e
push 5
push 0x8243fb
push 0
lea edx, [ebp - 0x424]
push edx
push 0x6eb350
push dword [0x6e716c]
call sub.SHELL32.DLL_ShellExecuteA
call fcn.00404a4c
xor ecx, ecx
mov dword [0x6f6920], ecx
mov esp, ebp
pop ebp
ret