Function at 0x416f24
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 4]
or dword [ebp - 4], 0xffffffff
mov edx, eax
push 2
push 1
mov ecx, dword [esi]
xor ebx, ebx
mov eax, ecx
mov dword [ebp - 0xc], ebx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push edi
mov eax, dword [eax*4 + 0x47a1b8]
push edx
push dword [eax + ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x417185
push dword [esi]
call fcn.0040362f
push dword [ebp + 0xc]
or dword [esi], 0xffffffff
push dword [esi + 4]
call fcn.0040100a
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x14], edi
test edi, edi
je 0x417185
push ebx
call fcn.00417efd
mov esi, eax
pop ecx
test esi, esi
jne 0x416fb2
push edi
call fcn.00401f0a
pop ecx
jmp 0x417185
push 0x46e270
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ebx
push eax
call fcn.0040361b
add esp, 0xc
test eax, eax
je 0x416fd6
cmp eax, 0x16
je 0x4171e4
jmp 0x416fe0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x416fe7
mov dword [ebp - 8], str.cmd.exe
xor eax, eax
push 0x44
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00402365
mov ecx, dword [0x47a1b8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x44], 0x100
jne 0x41701a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
jmp 0x417029
cmp dword [ebp + 0x10], 1
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
je 0x41702c
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0x88]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x30], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc]
jne 0x41703e
sub ecx, edx
mov edx, str.__c
sar ecx, 1
lea eax, [edx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0xc]
jne 0x417059
mov edi, dword [ebp + 8]
sub edx, dword [ebp - 0x10]
sar edx, 1
lea eax, [edi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 0xc]
jne 0x417073
mov eax, edi
mov dword [ebp - 0x10], edi
sub eax, dword [ebp - 0x1c]
inc edx
sar eax, 1
add eax, ecx
add eax, edx
push 2
push eax
mov dword [ebp - 0x10], eax
call fcn.0040353f
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
jne 0x4170c8
xor eax, eax
push eax
call fcn.00403fd0
push ebx
call fcn.00403fd0
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi], eax
call fcn.00401f0a
add esp, 0xc
jmp 0x417185
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.004027f2
add esp, 0xc
test eax, eax
jne 0x4171db
push str.__c
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00402022
add esp, 0xc
test eax, eax
jne 0x4171db
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00402022
add esp, 0xc
test eax, eax
jne 0x4171db
push dword [ebp - 8]
call fcn.00417668
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x417127
push dword [ebp - 0xc]
jmp 0x4170a8
mov eax, ecx
lea edi, [ebp - 0x2c]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41719b
push dword [ebp - 0x10]
call fcn.00403fd0
push edi
call fcn.00403fd0
push ebx
call fcn.00403fd0
mov edi, dword [ebp - 0x14]
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi], eax
call fcn.00401f0a
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x417194
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
call fcn.00403fd0
push dword [ebp - 0xc]
call fcn.00403fd0
push ebx
call fcn.00403fd0
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
je 0x4171d7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x417196
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4171e9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402635
int3