Function at 0x412b00
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x455b99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
lea eax, [esp + 0x78]
push 0x4653b4
lea ecx, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x7c], 1
call sub.MFC42.DLL_operator_2
mov edx, dword [sym.imp.MSVCIRT.dll_int_const_filebuf::openprot]
mov ecx, dword [esp + 8]
push 1
mov byte [esp + 0x74], 2
mov eax, dword [edx]
push eax
push 0x40
push ecx
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::constructor_char_const___int__int_]
mov edx, dword [esp + 0x10]
mov byte [esp + 0x70], 3
mov eax, dword [edx + 4]
test byte [esp + eax + 0x18], 6
je 0x412bc9
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::close_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x70], 2
call dword [sym.imp.MSVCIRT.dll_public_virtual:_void___thiscall_ofstream::destructor_void_]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCIRT.dll_public_virtual:_void___thiscall_ios::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x70], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x78]
mov byte [esp + 0x70], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x7c]
mov dword [esp + 0x70], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret
push esi
mov esi, dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push str._.ShellClassInfo__n
lea ecx, [esp + 0x18]
call esi
mov ecx, dword [esp + 0x80]
push 0x465648
push ecx
lea ecx, [esp + 0x1c]
call esi
mov ecx, eax
call esi
mov edx, dword [esp + 0x80]
push str.InfoTip
push edx
lea ecx, [esp + 0x1c]
call esi
mov ecx, eax
call esi
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::close_void_]
mov eax, dword [esp + 0xc]
push 3
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.attrib_s
lea ecx, [esp + 0xc]
call fcn.004149aa
lea ecx, [esp + 4]
mov byte [esp + 0x74], 4
call sub.MFC42.DLL_CString::CString_2
push 0x465358
lea ecx, [esp + 8]
mov byte [esp + 0x78], 5
call fcn.004149ce
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push 0x465358
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x78], 6
call fcn.004149b6
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], 5
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 4]
mov byte [esp + 0x74], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x74], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x74], 2
call dword [sym.imp.MSVCIRT.dll_public_virtual:_void___thiscall_ofstream::destructor_void_]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCIRT.dll_public_virtual:_void___thiscall_ios::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x7c]
mov byte [esp + 0x74], 0
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x74], 0xffffffff
lea ecx, [esp + 0x80]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x6c]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x74
ret