Function at 0x41ea10
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ebx, dword [0x4b2e3a]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
push dword [ebx]
call fcn.0041ee9b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41ee57
mov ebx, dword [0x4b2e32]
add ebx, 0x10
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 1
jne 0x41ea87
mov eax, 0x4b1540
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41ea83
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [0x4b2e32]
add ebx, 0x10
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 2
jne 0x41eab9
mov eax, str.npfg.600st.com
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41eab5
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [0x4b2e32]
add ebx, 0x10
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 3
jne 0x41eaeb
mov eax, str.npjf.600st.com
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41eae7
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
push str.main.exe
push dword [0x4b2e36]
mov ecx, 2
call fcn.00402ed1
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.0041a7c9
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41eb2e
push ebx
call fcn.0044b409
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41eb42
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 8], eax
push str.__p44405
push dword [ebp - 4]
push str.main.exe_connect__u
push dword [0x4b2e36]
mov ecx, 4
call fcn.00402ed1
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.0041a7c9
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41eb91
push ebx
call fcn.0044b409
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41eba5
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
push 0x4b2e36
call fcn.0041a7c9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41ebd6
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
call fcn.0041960a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041960a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041960a
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
push dword [0x4b2e3a]
mov eax, dword [0x4b2e3e]
push eax
push 0x44
call fcn.0044b40f
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push dword [ebp - 0x1c]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x41ed22
push 0x30e
push 0x4011d2f
push 6
call fcn.0044b415
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x24]
push ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.0041e9d9
call fcn.0041e9d9
call fcn.0041e9d9
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.0044b409
add esp, 4
pop eax
mov ebx, dword [0x4b2e3a]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 0
jne 0x41edf4
jmp 0x41ee57
mov ebx, dword [0x4b2e32]
add ebx, 0x1c
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 0
je 0x41ee20
push 0x1f40
call fcn.0041ef7d
call fcn.0041f0ce
jmp 0x41ee57
push 0x1f40
call fcn.0041ef7d
call fcn.0041f0ce
push 0x14
push dword [0x4b2e02]
call fcn.0041e996
mov ebx, dword [0x4b2e3a]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
push dword [ebx]
call fcn.0041f0f5
mov dword [0x4b2e42], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41ee67
push ebx
call fcn.0044b409
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41ee77
push ebx
call fcn.0044b409
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41ee87
push ebx
call fcn.0044b409
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41ee97
push ebx
call fcn.0044b409
add esp, 4
mov esp, ebp
pop ebp
ret