Function at 0x415a10
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496d29
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4ba088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x415a4b
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x415ab7
push 0x4b0a30
lea edx, [ebp - 0xf0]
push edx
call fcn.0040a850
add esp, 8
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 4], 0
push 0
push 0x4b0a24
mov ecx, dword [ebp - 0xc8]
call fcn.00409140
push eax
call fcn.00403810
mov ecx, eax
call fcn.00403480
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00407770
xor al, al
jmp 0x415d51
push 0x44
push 0
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00475230
add esp, 0xc
xor edx, edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x9c], 0x44
mov dword [ebp - 0x70], 1
mov eax, 5
mov word [ebp - 0x6c], ax
lea ecx, [ebp - 0x58]
push ecx
call fcn.004158d0
add esp, 4
mov dword [ebp - 4], 1
push 0x4b0a60
lea ecx, [ebp - 0x28]
call fcn.0040bc50
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.00409460
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d2c0
push 0x4b0a64
lea ecx, [ebp - 0x28]
call fcn.0040d2c0
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0x58]
call fcn.00409140
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00409140
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
je 0x415ba7
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415d05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb8], eax
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push 0x400
mov eax, dword [ebp - 0xb8]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, dword [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040bc50
mov byte [ebp - 4], 3
push 0x4b0a68
lea ecx, [ebp - 0x40]
call fcn.0040d2c0
mov edx, dword [ebp - 0xb8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.004114f0
add esp, 8
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xd0]
push edx
lea ecx, [ebp - 0x40]
call fcn.00409460
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x108]
call fcn.00407770
push 0x4b0a78
lea ecx, [ebp - 0x40]
call fcn.0040d2c0
lea ecx, [ebp - 0x28]
call fcn.00409140
push eax
lea ecx, [ebp - 0x40]
call fcn.0040d2c0
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x4b0a88
lea ecx, [ebp - 0x120]
push ecx
call fcn.0040a850
add esp, 8
mov dword [ebp - 0xd4], eax
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0xd8], edx
mov byte [ebp - 4], 5
push 0
mov ecx, dword [ebp - 0xd8]
call fcn.00409140
push eax
lea ecx, [ebp - 0x40]
call fcn.00409140
push eax
call fcn.00403810
mov ecx, eax
call fcn.00403480
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x120]
call fcn.00407770
mov byte [ebp - 0xb1], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00407770
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00407770
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407770
mov al, byte [ebp - 0xb1]
jmp 0x415d51
cmp dword [ebp - 0xbc], 0
je 0x415d1a
mov dword [ebp - 0xc0], 1
jmp 0x415d24
mov dword [ebp - 0xc0], 0
mov al, byte [ebp - 0xc0]
mov byte [ebp - 0xb2], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00407770
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407770
mov al, byte [ebp - 0xb2]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045dc13
mov esp, ebp
pop ebp
ret