Function at 0x41f5e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6189c4
mov eax, dword fs:[0]
push eax
sub esp, 0xd2c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x7f8], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xce4], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xce8], eax
mov ecx, dword [ebp - 0xce8]
sub ecx, 0x7e8
mov dword [ebp - 0xce8], ecx
cmp dword [ebp - 0xce8], 6
ja case.default.0x41f642
mov edx, dword [ebp - 0xce8]
jmp dword [edx*4 + 0x41fda8]
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x121a8
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x16348
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x133d0
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0xa03dc
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x2510
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x43c8
call fcn.005cb0bc
push ecx
mov ecx, esp
mov dword [ebp - 0xcbc], esp
push 0x643fa0
call fcn.004015a0
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xcc0]
push ecx
call fcn.005acd80
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.005adbf0
mov dword [ebp - 0xcf4], eax
mov edx, dword [ebp - 0xcf4]
mov dword [ebp - 0xcf8], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xcf8]
push eax
push 1
mov ecx, dword [ebp - 0xce4]
add ecx, 0x22a8
call fcn.004c5860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc0]
call fcn.00401620
jmp case.default.0x41f642
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x121a8
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x133d0
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x16348
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0xa03dc
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x2510
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x43c8
call fcn.005cb0bc
jmp case.default.0x41f642
mov ecx, dword [ebp - 0xce4]
add ecx, 0x121a8
call fcn.00414710
test eax, eax
jne 0x41f7ff
mov ecx, dword [ebp - 0xce4]
add ecx, 0x133d0
call fcn.00414710
test eax, eax
jne 0x41f7ff
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x133d0
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x16348
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0xa03dc
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x2510
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x43c8
call fcn.005cb0bc
jmp case.default.0x41f642
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x121a8
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x133d0
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x16348
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0xa03dc
call fcn.005cb0bc
jmp case.default.0x41f642
call fcn.00442630
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41f975
push 0
push 0xffffffffffffffff
push 0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00442f90
test eax, eax
jg 0x41f975
push 0
lea ecx, [ebp - 0xa4]
call fcn.00508f20
mov dword [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0xcc4], esp
push 0x643fb4
call fcn.004015a0
mov dword [ebp - 0xcfc], eax
mov ecx, dword [ebp - 0xcfc]
mov dword [ebp - 0xd00], ecx
mov byte [ebp - 4], 3
lea edx, [ebp - 0xcc8]
push edx
call fcn.005acd80
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.005adbf0
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xd08], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xd08]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040bb70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc8]
call fcn.00401620
lea ecx, [ebp - 0xa4]
call fcn.005c4f21
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.00508ff0
jmp case.default.0x41f642
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0x80350
call fcn.005cb0bc
jmp case.default.0x41f642
push 0
lea ecx, [ebp - 0x7dc]
call fcn.00508f20
mov dword [ebp - 4], 5
mov dword [ebp - 0x764], 1
push ecx
mov ecx, esp
mov dword [ebp - 0xccc], esp
push 0x643fc4
call fcn.004015a0
mov dword [ebp - 0xd0c], eax
mov edx, dword [ebp - 0xd0c]
mov dword [ebp - 0xd10], edx
mov byte [ebp - 4], 6
lea eax, [ebp - 0xcd0]
push eax
call fcn.005acd80
mov byte [ebp - 4], 5
mov ecx, eax
call fcn.005adbf0
mov dword [ebp - 0xd14], eax
mov ecx, dword [ebp - 0xd14]
mov dword [ebp - 0xd18], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0xd18]
push edx
lea ecx, [ebp - 0x768]
call fcn.0040bb70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcd0]
call fcn.00401620
push 0
lea ecx, [ebp - 0x74c]
call fcn.00422960
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0xcd4], esp
push 0x643fd8
call fcn.004015a0
mov dword [ebp - 0xd1c], eax
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0xd20], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xcd8]
push ecx
call fcn.005acd80
mov byte [ebp - 4], 8
mov ecx, eax
call fcn.005adbf0
mov dword [ebp - 0xd24], eax
mov edx, dword [ebp - 0xd24]
mov dword [ebp - 0xd28], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xd28]
push eax
lea ecx, [ebp - 0x74c]
call fcn.00423940
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xcd8]
call fcn.00401620
mov dword [ebp - 0x7e0], 0
lea ecx, [ebp - 0x7ec]
call fcn.00514f40
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x7ec]
call fcn.00517f50
movzx ecx, al
test ecx, ecx
je 0x41fae3
lea edx, [ebp - 0x74c]
mov dword [ebp - 0x7e0], edx
jmp 0x41faef
lea eax, [ebp - 0x7dc]
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x41fd09
mov ecx, dword [ebp - 0x7e0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7e0]
mov eax, dword [edx + 0x144]
call eax
cmp eax, 1
jne 0x41fd09
mov ecx, dword [ebp - 0xce4]
mov byte [ecx + 0x2124], 1
push 0x2b0
push 0
lea edx, [ebp - 0xcb4]
push edx
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0xcb4], 1
mov dword [ebp - 0xcb0], 8
mov dword [ebp - 0xc94], 0
lea eax, [ebp - 0xcac]
push eax
call fcn.005b4000
add esp, 4
call fcn.00442630
add eax, 0x7e8
push eax
lea ecx, [ebp - 0x7f0]
call fcn.00401580
mov byte [ebp - 4], 0xc
push 0x3f
push 0
lea ecx, [ebp - 0x7f0]
call fcn.00401880
push eax
lea ecx, [ebp - 0xc50]
push ecx
call fcn.005e58c0
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x7f0]
call fcn.0040cfa0
push ecx
mov ecx, esp
mov dword [ebp - 0xcdc], esp
push str.Log.CloseCMS
call fcn.004015a0
mov dword [ebp - 0xd2c], eax
mov edx, dword [ebp - 0xd2c]
mov dword [ebp - 0xd30], edx
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0xce0]
push eax
call fcn.005acd80
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.005adbf0
mov dword [ebp - 0xd34], eax
mov ecx, dword [ebp - 0xd34]
mov dword [ebp - 0xd38], ecx
mov ecx, dword [ebp - 0xd38]
call fcn.00587e90
push eax
lea edx, [ebp - 0xc04]
push edx
call fcn.005e5a78
add esp, 8
lea ecx, [ebp - 0xce0]
call fcn.00401620
lea eax, [ebp - 0xcb4]
push eax
call fcn.004f6820
mov ecx, eax
call fcn.004f8ac0
mov ecx, 0x6d7f48
call fcn.0041b8d0
lea ecx, [ebp - 0xa00]
call fcn.00514f40
mov byte [ebp - 4], 0xe
push 0
lea ecx, [ebp - 0xa00]
call fcn.00516620
mov dword [ebp - 0x9f4], 0x1f8
mov ecx, dword [ebp - 0xce4]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0x9ec], 0x80
lea eax, [ebp - 0x9f4]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ecx, dword [0x6d7f98]
push ecx
call fcn.0041b910
add eax, 4
push eax
lea edx, [ebp - 0x7f4]
push edx
call fcn.00404260
add esp, 0xc
push 1
push 0
push 0
lea ecx, [ebp - 0x7f4]
call fcn.00587e90
push eax
push 0x643ffc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0xcb8], eax
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x7f4]
call fcn.00401620
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa00]
call fcn.00515010
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x7f0]
call fcn.00401620
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7ec]
call fcn.00515010
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x74c]
call fcn.00422a70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.00508ff0
jmp case.default.0x41f642
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x133d0
call fcn.005cb0bc
push 5
mov ecx, dword [ebp - 0xce4]
add ecx, 0xa03dc
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x121a8
call fcn.005cb0bc
push 0
mov ecx, dword [ebp - 0xce4]
add ecx, 0x16348
call fcn.005cb0bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x7f8]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4