Function at 0x412d41
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 8], eax
cmp byte [0x4802ec], bl
je 0x412dc8
call fcn.004242c6
call fcn.00424343
call fcn.00424401
call fcn.00424431
call fcn.00424461
call fcn.00424491
call fcn.0042454e
call fcn.00424711
call fcn.0042482b
call fcn.00424945
call fcn.00424a03
mov ecx, 0x47f028
call fcn.00419d4f
cmp byte [0x4802ec], bl
je 0x412dc8
mov eax, dword [0x47f6c4]
cmp eax, dword [0x47f6bc]
jb 0x412dc8
ja 0x412e50
mov eax, dword [0x47f6c0]
cmp eax, dword [0x47f6b8]
ja 0x412e50
push 3
pop edi
cmp dword [0x47f3a8], edi
jbe 0x412dea
push ebx
mov ecx, 0x47f3a8
call fcn.0041d704
push eax
call fcn.0040e4b7
pop ecx
test al, al
pop ecx
je 0x412e50
mov ecx, 0x47f028
call fcn.0041b0a0
push ebx
push ebx
mov ecx, esi
mov dword [0x47f6c8], 1
call fcn.00415658
mov ecx, esi
call fcn.004126cc
test al, al
je 0x412e50
push 2
pop eax
test byte [0x47f1fc], al
je 0x412e2d
mov ecx, esi
mov dword [0x47f6c8], eax
call fcn.00410ea8
test al, al
je 0x412e50
test byte [0x47f1fc], 4
je 0x412e57
push ebx
push ebx
mov ecx, esi
mov dword [0x47f6c8], edi
call fcn.00415658
mov ecx, esi
call fcn.00410bd4
test al, al
jne 0x412e57
xor al, al
jmp 0x413128
cmp byte [0x4802ec], bl
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [0x47f6c8], 4
jne 0x412e8a
mov ecx, 0x47ff40
call fcn.0041d704
push eax
push 0x14
push dword [esi + 8]
call ebp
push eax
call edi
push ebx
push ebx
mov ecx, 0x47f8f0
call fcn.00415658
push ebx
push ebx
mov ecx, esi
call fcn.00415658
lea ecx, [esp + 0x1c]
mov byte [0x47f889], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0041c7ab
mov dword [esp + 0x2c], 0x47f3f0
mov eax, dword [esp + 0x2c]
sub esp, 0xc
mov ecx, esp
mov eax, dword [eax]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
call fcn.0041c87f
lea eax, [esp + 0x20]
mov ecx, esi
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x40]
push dword [esp + 0x30]
call fcn.00413da8
add dword [esp + 0x2c], 0x44
cmp dword [esp + 0x2c], 0x47f500
jl 0x412ebf
cmp dword [esp + 0x10], ebx
jle 0x412f24
push ebx
mov ecx, 0x47ff4c
call fcn.0041d704
push eax
mov ecx, 0x47f028
push dword [esi + 8]
call fcn.0041bc87
jmp 0x41311d
cmp byte [0x4802ec], bl
mov dword [0x47f6c8], 5
jne 0x412f4b
mov ecx, 0x47ff58
call fcn.0041d704
push eax
push 0x14
push dword [esi + 8]
call ebp
push eax
call edi
push ebx
push ebx
mov ecx, esi
call fcn.00415658
mov ecx, esi
call fcn.00413c20
test al, al
jne 0x412f78
push ebx
mov ecx, 0x47ff64
call fcn.0041d704
push eax
mov ecx, 0x47f028
push dword [esi + 8]
call fcn.0041bc87
cmp byte [0x4802ec], bl
mov dword [0x47f6c8], 6
jne 0x412f9f
mov ecx, 0x47ff70
call fcn.0041d704
push eax
push 0x14
push dword [esi + 8]
call ebp
push eax
call edi
push ebx
push ebx
mov ecx, esi
call fcn.00415658
mov ecx, esi
call fcn.00413867
cmp byte [0x4802ec], bl
mov dword [0x47f6c8], 7
jne 0x412fd6
mov ecx, 0x47ff7c
call fcn.0041d704
push eax
push 0x14
push dword [esi + 8]
call ebp
push eax
call edi
push ebx
push ebx
mov ecx, esi
call fcn.00415658
mov ecx, esi
call fcn.0041116f
test al, al
jne 0x413003
push ebx
mov ecx, 0x47ff88
call fcn.0041d704
push eax
mov ecx, 0x47f028
push dword [esi + 8]
call fcn.0041bc87
cmp byte [0x4802ec], bl
mov dword [0x47f6c8], 8
jne 0x41302a
mov ecx, 0x47ff94
call fcn.0041d704
push eax
push 0x14
push dword [esi + 8]
call ebp
push eax
call edi
push ebx
push ebx
mov ecx, esi
call fcn.00415658
push 0x47f5b8
mov ecx, esi
call fcn.0041471d
push dword [esi + 8]
mov ecx, 0x47f7f8
call fcn.00423999
test al, al
je 0x41311d
push ebx
push 0x64
mov ecx, esi
call fcn.00415658
cmp dword [0x47f680], ebx
jne 0x4130a5
cmp dword [0x47f510], ebx
mov eax, dword [0x47f200]
jg 0x41307a
test eax, 0x20000
jne 0x4130a5
cmp byte [0x4802ec], bl
jne 0x4130f6
test eax, 0x10000
je 0x4130ad
push 1
push 0x42f138
push ebx
mov ecx, esi
call fcn.004120f2
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x4802ec], bl
jne 0x4130f6
mov ecx, 0x480278
call fcn.004104f0
push dword [0x47f1e8]
call dword [sym.imp.USER32.dll_GetDC]
push 0xcc0020
push ebx
push ebx
mov esi, eax
push dword [0x47f1f4]
push dword [0x47f1e4]
push dword [0x47f1e0]
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push dword [0x47f1e8]
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x413105
call fcn.00424a33
call fcn.00424a63
call fcn.00424b14
cmp dword [0x47f680], ebx
jne 0x41311b
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov bl, 1
lea ecx, [esp + 0x1c]
call fcn.0041c8e1
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4