Function at 0x41d2a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4895f6
mov eax, dword fs:[0]
push eax
sub esp, 0x4cc
mov eax, dword [0x4c3cb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x4ac], ebx
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x1f4]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x4d8], edi
mov dword [ebp - 0x4a0], eax
call dword [0x4ca19c]
mov ecx, esi
mov dword [ebp - 4], 0
call dword [0x4ca1ac]
lea ecx, [ebp - 0x4a4]
call dword [0x4ca2c4]
lea eax, [ebp - 0x4a4]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00405450
test eax, eax
je 0x41dbf4
mov eax, dword [0x4c7bd0]
mov esi, dword [ebp - 0x4a0]
test eax, eax
je 0x41d35e
push esi
push edi
push dword [ebp - 0x4a4]
push str.To_display_the_system_status_site___s___error_message___s__SID___s___n
push eax
call fcn.00402960
add esp, 0x14
lea ecx, [ebp - 0x498]
call dword [0x4ca2c4]
lea ecx, [ebp - 0x4b0]
call dword [0x4ca2c4]
mov byte [ebp - 4], 3
test edi, edi
je 0x41d454
push edi
lea ecx, [ebp - 0x498]
call dword [0x4ca2b4]
push str.____________DetailedError____________
lea ecx, [ebp - 0x49c]
call dword [0x4ca2bc]
push 0
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 4
call dword [0x4ca184]
mov edi, eax
test edi, edi
jle 0x41d433
mov ecx, dword [ebp - 0x49c]
lea eax, [ebp - 0x4a0]
mov ecx, dword [ecx - 0xc]
add ecx, edi
push ecx
push eax
lea ecx, [ebp - 0x498]
call dword [0x4ca178]
push eax
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 5
call dword [0x4ca198]
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 4
call dword [0x4ca2b8]
push edi
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x498]
call dword [0x4ca170]
push eax
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 6
call dword [0x4ca198]
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 4
call dword [0x4ca2b8]
push 0x498310
lea ecx, [ebp - 0x498]
call dword [0x4ca2ac]
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 3
call dword [0x4ca2b8]
push dword [ebp - 0x4a4]
mov edi, dword [ebp - 0x4ac]
mov bl, 1
mov ecx, edi
call fcn.00403a40
test eax, eax
je 0x41d87a
push esi
lea ecx, [ebp - 0x494]
call dword [0x4ca2bc]
push 0xa
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 7
call fcn.0048196e
mov eax, dword [ebp - 0x494]
mov byte [ebp - 4], 8
cmp dword [eax - 0xc], 0
jne 0x41d723
mov esi, dword [ebp - 0x4b8]
test esi, esi
je 0x41d723
push 0x400
lea eax, [ebp - 0x490]
push 0
push eax
call fcn.00486538
push 0x400
lea eax, [ebp - 0x490]
push eax
push 6
push esi
call dword [0x4caa94]
add esp, 0x1c
test eax, eax
je 0x41d509
mov ecx, dword [0x4c7bd0]
test ecx, ecx
je 0x41d4f9
push eax
push str.Failed_to_get_property_FEWGUI_PROP_DESCRIPTION_rc_d_n
push ecx
call fcn.00404bb0
add esp, 0xc
lea ecx, [ebp - 0x4d4]
call fcn.00481980
jmp 0x41dbd0
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41d527
lea ecx, [ebp - 0x490]
push ecx
push str.Got_description___s__from_GUI_n
push eax
call fcn.00402960
add esp, 0xc
cmp byte [ebp - 0x490], 0
je 0x41d723
cmp dword [edi + 0x1dc], 0
je 0x41d5d8
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x4a8]
call dword [0x4ca2bc]
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 9
push str.PROP_NAME
call fcn.0048197a
mov ecx, eax
call dword [0x4ca2b4]
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.0046d4e6
add esp, 8
lea eax, [ebp - 0x494]
lea ecx, [ebp - 0x4d4]
push eax
push str.SystemID
call fcn.00481974
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41d5c7
lea ecx, [ebp - 0x490]
push ecx
push dword [ebp - 0x494]
push str.Got_system_ID___s__according_to_service_name___s__n
push eax
call fcn.00402960
add esp, 0x10
lea ecx, [ebp - 0x4a8]
call dword [0x4ca2b8]
jmp 0x41d723
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00486538
mov edi, dword [edi + 0x12c]
lea eax, [ebp - 0x90]
add esp, 0xc
mov esi, dword [edi]
push 0x80
push eax
lea eax, [ebp - 0x490]
mov esi, dword [esi + 0x170]
mov ecx, esi
push eax
call dword [section..00cfg]
mov ecx, edi
call esi
cmp byte [ebp - 0x90], 0
je 0x41d664
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x494]
call dword [0x4ca2b4]
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41d723
lea ecx, [ebp - 0x490]
push ecx
push dword [ebp - 0x494]
push str.Got_system_ID___s__according_to_description___s__n
push eax
call fcn.00402960
add esp, 0x10
jmp 0x41d723
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], 0
push 1
push eax
call fcn.0046d4da
mov edi, dword [ebp - 0x4a8]
add esp, 8
test edi, edi
je 0x41d6f2
mov esi, dword [edi]
lea eax, [ebp - 0x90]
push 0x80
push eax
lea eax, [ebp - 0x490]
mov esi, dword [esi + 0x170]
mov ecx, esi
push eax
call dword [section..00cfg]
mov ecx, edi
call esi
cmp byte [ebp - 0x90], 0
je 0x41d6f2
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x494]
call dword [0x4ca2b4]
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41d723
lea ecx, [ebp - 0x490]
push ecx
push dword [ebp - 0x494]
push str.Got_system_ID___s__according_to_description___s__n
push eax
call fcn.00402960
add esp, 0x10
jmp 0x41d723
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x494]
call dword [0x4ca2b4]
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41d723
lea ecx, [ebp - 0x490]
push ecx
push str.Set_system_ID_to_description___s__n
push eax
call fcn.00402960
add esp, 0xc
lea ecx, [ebp - 0x49c]
call dword [0x4ca2c4]
lea ecx, [ebp - 0x4a0]
call dword [0x4ca2c4]
push dword [ebp - 0x4a4]
mov ecx, dword [ebp - 0x4ac]
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 0xb
push eax
call fcn.00406d50
mov eax, dword [ebp - 0x494]
cmp dword [eax - 0xc], 0
jne 0x41d782
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x4a4]
call dword [0x4ca198]
jmp 0x41d843
lea ecx, [ebp - 0x49c]
call dword [0x4ca3b4]
push eax
lea ecx, [ebp - 0x4ac]
call dword [0x4ca19c]
push 0
push str.uuid
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 0xc
call dword [0x4ca184]
cmp eax, 0xffffffff
je 0x41d80d
mov eax, dword [ebp - 0x4b4]
cmp dword [eax - 0xc], 0
jne 0x41d80a
cmp dword [ebp - 0x4c8], 0
je 0x41d7e9
lea eax, [ebp - 0x4b4]
push eax
push str.MsgServerUUID
lea ecx, [ebp - 0x4d4]
call fcn.00481974
mov eax, dword [ebp - 0x4b4]
cmp dword [eax - 0xc], 0
jne 0x41d80a
mov eax, dword [0x4c7bd0]
xor bl, bl
test eax, eax
je 0x41d824
push str.system_URL_with_uuid:_tag_msid_is_not_filled__user_defined_application_server_connection_
push eax
call fcn.00404bb0
add esp, 8
jmp 0x41d824
push eax
jmp 0x41d813
push dword [ebp - 0x494]
push 0x498bec
lea ecx, [ebp - 0x49c]
call dword [0x4ca18c]
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x4a4]
call dword [0x4ca198]
lea ecx, [ebp - 0x4ac]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4a0]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x49c]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4d4]
call fcn.00481980
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 3
call dword [0x4ca2b8]
test bl, bl
je 0x41d894
push 0x1f5
call fcn.004053f0
add esp, 4
lea ecx, [ebp - 0x498]
push eax
call dword [0x4ca2ac]
cmp dword [ebp - 0x4b8], 0
je 0x41dae7
cmp dword [ebp - 0x4d8], 0
je 0x41dae7
test bl, bl
je 0x41d912
push 0x49830c
lea ecx, [ebp - 0x498]
call dword [0x4ca2ac]
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x498]
call dword [0x4ca2b0]
push 0x498310
lea ecx, [ebp - 0x498]
call dword [0x4ca2ac]
push 0x1f6
call fcn.004053f0
add esp, 4
lea ecx, [ebp - 0x498]
push eax
call dword [0x4ca2ac]
push 0x498310
lea ecx, [ebp - 0x498]
call dword [0x4ca2ac]
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41d92f
push dword [ebp - 0x498]
push str.Show_message_box_with_text___s__n
push eax
call fcn.00402960
add esp, 0xc
mov edi, dword [0x4c7c08]
test edi, edi
je 0x41d93e
mov edi, dword [edi + 0x20]
jmp 0x41d940
xor edi, edi
mov eax, dword [ebp - 0x4b0]
cmp dword [eax - 0xc], 0
je 0x41dac4
push 0xa
lea ecx, [ebp - 0x4d4]
call fcn.0048196e
push 0xb2
mov byte [ebp - 4], 0xd
call fcn.004053f0
add esp, 4
lea ecx, [ebp - 0x4a0]
push eax
call dword [0x4ca2bc]
push 0x1f9
mov byte [ebp - 4], 0xe
call fcn.004053f0
add esp, 4
lea ecx, [ebp - 0x494]
push eax
call dword [0x4ca2bc]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4d4]
test bl, bl
je 0x41d9d7
push dword [ebp - 0x4a0]
mov esi, 0x33
push str.IDCANCEL
call fcn.0048197a
mov ecx, eax
call dword [0x4ca2b4]
push dword [ebp - 0x494]
lea ecx, [ebp - 0x4d4]
push str.IDNO
jmp 0x41d9e7
push dword [ebp - 0x494]
mov esi, 0x31
push str.IDCANCEL
call fcn.0048197a
mov ecx, eax
call dword [0x4ca2b4]
lea ecx, [ebp - 0x49c]
call dword [0x4ca2c4]
push 0x498ab4
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0x10
call dword [0x4ca2b4]
lea eax, [ebp - 0x4d4]
push eax
push esi
push dword [ebp - 0x49c]
push dword [ebp - 0x498]
push edi
call fcn.004072c0
mov esi, eax
add esp, 0x14
cmp esi, 7
je 0x41da77
test bl, bl
jne 0x41da42
cmp esi, 2
je 0x41da77
lea ecx, [ebp - 0x49c]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x494]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4a0]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 3
call fcn.00481980
jmp 0x41dade
push 0
push 0x30
push dword [ebp - 0x49c]
push dword [ebp - 0x4b0]
push edi
call fcn.004072c0
add esp, 0x14
lea ecx, [ebp - 0x49c]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x494]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4a0]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4d4]
call fcn.00481980
jmp case.default.0x41db47
push 0
push 0x24
push 0x49a1b8
push dword [ebp - 0x498]
push edi
call fcn.004072c0
add esp, 0x14
mov esi, eax
cmp esi, 6
jne case.default.0x41db47
test bl, bl
je case.default.0x41db47
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41db0c
push dword [ebp - 0x4a4]
push str.Showing_the_system_status_site___s__n
push eax
call fcn.00402960
add esp, 0xc
push 1
push 0
push 0
push dword [ebp - 0x4a4]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
jae case.default.0x41db47
lea ecx, [ebp - 0x494]
call dword [0x4ca2c4]
movzx eax, byte [esi + 0x41dc64]
mov byte [ebp - 4], 0x11
jmp dword [eax*4 + 0x41dc2c]
push str.The_operating_system_is_out_of_memory_or_resources
jmp 0x41dba7
push str.The_specified_file_was_not_found.
jmp 0x41dba7
push str.The_specified_path_was_not_found.
jmp 0x41dba7
push str.The_.exe_file_is_invalid__non_Microsoft_Win32_.exe_or_error_in_.exe_image_.
jmp 0x41dba7
push str.The_operating_system_denied_access_to_the_specified_file.
jmp 0x41dba7
push str.The_file_name_association_is_incomplete_or_invalid.
jmp 0x41dba7
push str.The_Dynamic_Data_Exchange__DDE__transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
jmp 0x41dba7
push str.The_DDE_transaction_failed.
jmp 0x41dba7
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
jmp 0x41dba7
push str.The_specified_dynamic_link_library__DLL__was_not_found.
jmp 0x41dba7
push str.There_is_no_application_associated_with_the_given_file_name_extension._This_error_will_also_be_returned_if_you_attempt_to_print_a_file_that_is_not_printable.
jmp 0x41dba7
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x41dba7
push str.A_sharing_violation_occurred.
lea ecx, [ebp - 0x494]
call dword [0x4ca2b4]
mov eax, dword [0x4c7bd0]
test eax, eax
je 0x41dbd0
push dword [ebp - 0x494]
push 0x49a5f0
push eax
call fcn.00404bb0
add esp, 0xc
lea ecx, [ebp - 0x494]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4b0]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x498]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4a4]
call dword [0x4ca2b8]
lea ecx, [ebp - 0x4b4]
call dword [0x4ca2b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004038f0
mov esp, ebp
pop ebp
ret 0xc