Function at 0x41b7ae
Capabilities:
Create process on windows

Disassembly:
push 0x368
mov eax, 0x44b201
call fcn.00447ac5
mov ebx, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x35c], eax
xor eax, eax
push 0x208
push eax
mov byte [ebp - 0x355], al
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x47be60]
add esp, 0xc
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
mov ecx, esi
call dword [0x4529ac]
mov ecx, 0x47be60
call esi
push edi
mov edx, str._client
lea ecx, [ebp - 0x248]
call fcn.00415f6b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
push ebx
call fcn.0040a7be
push ecx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0041ebbb
mov esi, 0x45a634
cmp eax, 0xffffffff
jne 0x41b8a6
push esi
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x354]
call fcn.0040c557
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00416426
push eax
lea ecx, [ebp - 0x374]
call fcn.00416444
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040a898
lea ecx, [ebp - 0x374]
call fcn.0040521a
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 1
call fcn.0040521a
call fcn.0041d540
xor ebx, ebx
test al, al
je 0x41b9cc
push 0xb0
lea eax, [ebp - 0x33c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea ecx, [ebp - 0x33c]
call fcn.0041e990
lea edx, [ebp - 0x218]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x32c]
call fcn.0041f170
mov edx, esi
mov ecx, eax
call fcn.0041f170
lea edx, [ebp - 0x230]
mov ecx, eax
call fcn.0041f3f8
xor eax, eax
lea edi, [ebp - 0x34c]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x28c], esi
lea eax, [ebp - 0x374]
lea ecx, [ebp - 0x324]
push eax
call fcn.0041ef40
cmp dword [ebp - 0x360], 8
lea ecx, [ebp - 0x34c]
push ecx
lea ecx, [ebp - 0x28c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x374]
cmovae eax, dword [ebp - 0x374]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x374]
mov esi, eax
call fcn.0040521a
test esi, esi
je 0x41b9a3
cmp dword [ebp - 0x348], ebx
je 0x41b98c
push dword [ebp - 0x348]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34c], 0
je 0x41b9aa
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41b9aa
mov byte [ebp - 0x355], 1
lea ecx, [ebp - 0x2d4]
call fcn.0041e95e
lea ecx, [ebp - 0x2d4]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov al, byte [ebp - 0x355]
jmp 0x41ba56
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x284]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x284], esi
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x218]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
mov dword [ebp - 0x270], eax
mov eax, dword [0x47be60]
mov dword [ebp - 0x280], 0x8000
mov dword [ebp - 0x278], str.open
mov dword [ebp - 0x268], 5
mov esi, dword [eax + 0x15c]
lea eax, [ebp - 0x284]
push eax
mov ecx, esi
call dword [0x4529ac]
mov ecx, 0x47be60
call esi
test eax, eax
setne al
mov byte [ebp - 0x355], al
test al, al
jne 0x41ba62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x35c]
lea ecx, [ebp - 0x230]
mov dword [eax], ebx
call fcn.0040521a
lea ecx, [ebp - 0x248]
call fcn.0040521a
mov al, byte [ebp - 0x355]
call fcn.00447a6f
ret 4