Function at 0x414940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov ebx, edx
mov edx, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x40]
mov ecx, edi
call fcn.004159c0
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0x14]
cmp edx, eax
je 0x414fdb
mov dword [ebp - 0xbc], ebx
lea ecx, [eax + 1]
mov dword [ebp - 0x30], ecx
cmp edx, 8
mov ecx, dword [ebp - 0x40]
cmovae edi, ecx
xor esi, esi
inc esi
cmp edi, 0x42dcba
jae 0x4149b2
lea ebx, [edi + eax*2]
cmp ebx, 0x42dcb8
jb 0x4149b2
xor esi, esi
cmp edi, 0x42dcb8
jbe 0x4149b2
mov ebx, 0x42dcb8
mov esi, edi
sub esi, ebx
sar esi, 1
cmp edx, 8
lea edx, [ebp - 0x40]
cmovb ecx, edx
add ecx, 2
add eax, eax
add eax, 2
push eax
push edi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ebx, [esi + esi]
push ebx
push 0x42dcb8
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esi + esi]
add eax, 0x42dcba
lea ecx, [edi + esi*2]
mov edx, 2
sub edx, ebx
push edx
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ebx, dword [ebp - 0xbc]
movsd xmm0, qword [ebp - 0x30]
movsd qword [ebp - 0xa4], xmm0
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], 0
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa0]
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x414fe8
lea esi, [ecx + 2]
lea eax, [ebp - 0xb4]
mov dword [eax + 0x10], esi
mov esi, eax
cmp edx, 8
jb 0x414a61
mov esi, dword [ebp - 0xb4]
mov dword [esi + ecx*2], 0x200022
mov word [esi + ecx*2 + 4], 0
movsd xmm0, qword [eax + 0x10]
movsd qword [ebp - 0x18], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], 0
mov eax, dword [ebp - 0xa0]
cmp eax, 8
jb 0x414ad6
mov ecx, dword [ebp - 0xb4]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x414acc
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 7
mov word [ebp - 0xb4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x414b30
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x414b26
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0xc4], ecx
cmp eax, ecx
je 0x414ef0
xor ecx, ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
cmp dword [eax + 0x14], 0x10
mov ebx, eax
jb 0x414b61
mov ebx, dword [eax]
mov esi, dword [eax + 0x10]
cmp esi, 0xf
mov dword [ebp - 0xbc], eax
ja 0x414b80
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0xb4], xmm0
mov edi, 0xf
jmp 0x414bd0
mov edi, esi
or edi, 0xf
mov eax, 0x7fffffff
cmp edi, eax
cmovae edi, eax
cmp edi, 0xfff
jb 0x414bb0
lea eax, [edi + 0x24]
push eax
call fcn.0041c59c
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x414bbc
lea eax, [edi + 1]
push eax
call fcn.0041c59c
add esp, 4
mov dword [ebp - 0xb4], eax
lea ecx, [esi + 1]
push ecx
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], edi
lea ebx, [ebp - 0x70]
mov ecx, ebx
lea edx, [ebp - 0xb4]
call fcn.004159c0
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
cmp edx, eax
je 0x414e94
lea ecx, [eax + 1]
mov dword [ebp - 0x60], ecx
cmp edx, 8
mov ecx, dword [ebp - 0x70]
mov esi, ebx
cmovae esi, ecx
xor edi, edi
inc edi
cmp esi, 0x42dcba
jae 0x414c48
lea ebx, [esi + eax*2]
xor edi, edi
inc edi
cmp ebx, 0x42dcb8
lea ebx, [ebp - 0x70]
jb 0x414c48
xor edi, edi
cmp esi, 0x42dcb8
jbe 0x414c48
mov edi, esi
mov dword [ebp - 0xc0], edx
mov edx, 0x42dcb8
sub edi, edx
mov edx, dword [ebp - 0xc0]
sar edi, 1
cmp edx, 8
cmovb ecx, ebx
add ecx, 2
add eax, eax
add eax, 2
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ebx, [edi + edi]
push ebx
push 0x42dcb8
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [edi + edi]
add eax, 0x42dcba
lea ecx, [esi + edi*2]
mov edx, 2
sub edx, ebx
push edx
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm0, qword [ebp - 0x60]
movsd qword [ebp - 0x48], xmm0
movups xmm0, xmmword [ebp - 0x70]
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov edx, ecx
sub edx, eax
cmp edx, 2
lea esi, [ebp - 0x40]
jb 0x414ea0
lea edx, [eax + 2]
mov dword [ebp - 0x48], edx
lea edx, [ebp - 0x58]
cmp ecx, 8
jb 0x414cdd
mov edx, dword [ebp - 0x58]
mov dword [edx + eax*2], 0x200022
mov word [edx + eax*2 + 4], 0
lea eax, [ebp - 0x58]
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
movsd xmm0, qword [eax + 0x10]
movsd qword [ebp - 0x30], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2c], 8
mov ecx, esi
jb 0x414d27
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esi, ebx
sub esi, edx
cmp esi, eax
jb 0x414ecb
lea esi, [edx + eax]
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x28]
cmp ebx, 8
jb 0x414d4a
mov edi, dword [ebp - 0x28]
lea edx, [edi + edx*2]
add eax, eax
push eax
push ecx
push edx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + esi*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x414d9d
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x414d93
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x414dee
mov ecx, dword [ebp - 0x58]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x414de4
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], 0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x414e3f
mov ecx, dword [ebp - 0x70]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x414e35
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov eax, dword [ebp - 0xa0]
cmp eax, 0x10
jb 0x414e7d
mov ecx, dword [ebp - 0xb4]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x414e73
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov eax, dword [ebp - 0xbc]
add eax, 0x18
cmp eax, dword [ebp - 0xc4]
jne 0x414b43
jmp 0x414ef0
mov ecx, ebx
call fcn.004224d0
jmp 0x414c90
sub esp, 0x10
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov eax, 2
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], 0x42dcc2
lea ecx, [ebp - 0x58]
call fcn.0041ffd0
jmp 0x414cee
sub esp, 0x10
mov dl, byte [ebp - 0xb8]
mov byte [esp + 4], dl
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.0041ffd0
jmp 0x414d60
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
movups xmmword [ebp - 0x90], xmm0
movups xmmword [ebp - 0xa0], xmm0
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0xb4], 0x44
movups xmmword [ebp - 0x40], xmm0
cmp dword [ebp - 0x14], 8
jb 0x414f25
mov eax, dword [ebp - 0x28]
jmp 0x414f28
lea eax, [ebp - 0x28]
sub esp, 0x28
lea ecx, [ebp - 0x40]
mov dword [esp + 0x24], ecx
lea ecx, [ebp - 0xb4]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x42b270]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x414f86
cmp byte [ebp + 8], 0
je 0x414f76
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x40]
call edi
push dword [ebp - 0x3c]
call edi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x414fbf
mov ecx, dword [ebp - 0x28]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x414fb5
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415016
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.0041c5cc
add esp, 8
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x40]
call fcn.004224d0
jmp 0x414a03
sub esp, 0x10
mov al, byte [ebp - 0x28]
mov byte [esp + 4], al
mov eax, 2
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], 0x42dcc2
lea ecx, [ebp - 0xb4]
call fcn.0041ffd0
jmp 0x414a6f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3