Function at 0x401aaf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4323ff
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20b0
call fcn.00415790
mov eax, dword [0x44d07c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [0x44f383], 0
lea ecx, [ebp - 0x2030]
jne 0x401b34
push str.The_application_is_non_interactive._Security_Alert_is_not_shown.
call fcn.004027e8
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2030]
call fcn.00401ed4
lea ecx, [ebp - 0x2030]
call fcn.00402f5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414893
mov esp, ebp
pop ebp
ret
push str.cmd.exe__c__
mov dword [ebp - 4], 1
call fcn.004027e8
mov esi, str.ECHO_SECURITY_ALERT_
mov byte [ebp - 4], 2
push esi
call fcn.0041e0a7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2030]
call fcn.00402702
mov esi, str.ECHO_One_or_more_DLLs_are_loaded_from_the_application_startup_folder._
push esi
call fcn.0041e0a7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2030]
call fcn.00402702
mov esi, str.ECHO_It_could_be_a_sign_of_a_DLL_preloading_attack._
push esi
call fcn.0041e0a7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2030]
call fcn.00402702
mov esi, str.ECHO_For_security_reasons_the_application_is_emergently_terminated._
push esi
call fcn.0041e0a7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2030]
call fcn.00402702
mov esi, str.ECHO_Please_contact_JetBrains_support_or_your_system_administrator._
push esi
call fcn.0041e0a7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2030]
call fcn.00402702
cmp dword [0x44db14], 0
je 0x401c33
push ecx
lea ecx, [ebp - 0x2060]
call fcn.00402995
pop ecx
mov esi, eax
mov edi, str._in_the_TEMP_folder._
mov byte [ebp - 4], 3
push edi
call fcn.0041e0a7
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00402702
push eax
lea ecx, [ebp - 0x2048]
call fcn.00402ccf
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x2030]
call fcn.004027a0
lea ecx, [ebp - 0x2048]
call fcn.00402f5c
lea ecx, [ebp - 0x2060]
mov byte [ebp - 4], 2
call fcn.00402f5c
mov esi, str.PAUSE_
push esi
call fcn.0041e0a7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2030]
call fcn.00402702
cmp dword [ebp - 0x201c], 8
lea esi, [ebp - 0x2030]
lea ecx, [ebp - 0x2018]
mov edx, 0x1000
cmovae esi, dword [ebp - 0x2030]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7fffeffe]
test eax, eax
je 0x401c8d
movzx eax, word [esi + ecx]
test ax, ax
je 0x401c8d
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x401c6f
lea eax, [ecx - 2]
test edx, edx
push 0x44
cmovne eax, ecx
xor ecx, ecx
pop esi
push esi
xor edi, edi
mov word [eax], cx
lea eax, [ebp - 0x20c0]
push edi
push eax
call fcn.004160f0
add esp, 0xc
mov dword [ebp - 0x20c0], esi
lea ecx, [ebp - 0x2068]
push 0x441c80
call fcn.00403276
lea eax, [ebp - 0x2068]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x2064]
mov ecx, 0x44f3e8
push eax
call fcn.00402fba
mov eax, dword [eax]
test eax, eax
je 0x401cf2
mov eax, dword [eax]
mov dword [ebp - 0x20b4], eax
jmp 0x401cf8
mov dword [ebp - 0x20b4], edi
mov ecx, dword [ebp - 0x2064]
test ecx, ecx
je 0x401d0d
call fcn.004031e4
mov dword [ebp - 0x2064], edi
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2068]
test ecx, ecx
je 0x401d20
call fcn.004031e4
lea eax, [ebp - 0x2078]
push eax
lea eax, [ebp - 0x20c0]
push eax
push 0x441ca4
push edi
push 0x410
push 1
push edi
push edi
lea eax, [ebp - 0x2018]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401d96
push dword [ebp - 0x2078]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2074]
call esi
lea eax, [ebp - 0x2018]
push eax
lea ecx, [ebp - 0x2048]
call fcn.004027e8
lea ecx, [ebp - 0x2048]
mov byte [ebp - 4], 6
call fcn.00401ed4
lea ecx, [ebp - 0x2048]
call fcn.00402f5c
jmp 0x401b0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_show_Security_Alert._Error_code:__d
call fcn.00401e18
pop ecx
pop ecx
jmp 0x401b0d