Function at 0x41466c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x794
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jae 0x4146a8
push 0x20a
lea eax, [ebp - 0x284]
push dword [ebp + 0x10]
push eax
call fcn.005984a7
add esp, 0xc
and byte [ebp - 0x7b], 0
push ebx
push esi
push edi
push 0x49
call fcn.0045d9d1
pop ecx
push 1
pop ebx
cmp ax, bx
je 0x414707
lea eax, [ebp - 0x484]
push 0x200
push eax
push 0x17a
call fcn.0045cfa6
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push 0x30f
push eax
call fcn.00598768
lea eax, [ebp - 0x794]
push eax
call fcn.004817c3
add esp, 0x14
jmp 0x414923
push 0x54
call fcn.0045d9d1
cmp ax, bx
pop ecx
jne 0x414754
lea eax, [ebp - 0x484]
push 0x200
push eax
push 0x17b
call fcn.0045cfa6
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push 0x30f
push eax
call fcn.00598768
lea eax, [ebp - 0x484]
jmp 0x4146f9
xor edi, edi
cmp word [0x6b5484], di
jne 0x41491a
push 0x3c
lea eax, [ebp - 0x3c]
pop esi
push esi
push edi
push eax
call fcn.005a0083
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 2
mov word [ebp - 0x28], bx
mov word [ebp - 0x24], bx
call fcn.004e6f41
push 0x17e
push eax
mov dword [ebp - 0x20], eax
call fcn.0045d16c
mov word [ebp - 0x1c], bx
call fcn.004e6f41
push 0x17f
push eax
mov dword [ebp - 0x18], eax
call fcn.0045d16c
mov word [ebp - 0x14], di
mov word [ebp - 0xc], bx
call fcn.004e6f41
push 0x17d
push eax
mov dword [ebp - 8], eax
call fcn.0045d16c
mov ax, word [0x6b5484]
mov esi, 0x1ff
mov word [ebp - 4], ax
lea eax, [ebp - 0x484]
push esi
push eax
push 0x179
call fcn.0045cfa6
add esp, 0x30
lea eax, [ebp - 0x284]
mov edi, 0x30f
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push edi
push eax
call fcn.00598768
call fcn.00469766
push eax
lea eax, [ebp - 0x794]
push eax
call fcn.004e73d7
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
test eax, eax
je 0x414885
cmp byte [eax], 0
je 0x414885
lea eax, [ebp - 0x284]
push eax
call fcn.00598476
push dword [ebp + 0x14]
mov ebx, 0x209
sub ebx, eax
call fcn.00598476
inc eax
pop ecx
cmp ebx, eax
pop ecx
jbe 0x414882
mov ebx, 0x20a
lea eax, [ebp - 0x284]
push ebx
push 0x67438c
push eax
call fcn.005986ef
push ebx
lea eax, [ebp - 0x284]
push dword [ebp + 0x14]
push eax
call fcn.005986ef
add esp, 0x18
push 1
pop ebx
lea eax, [ebp - 0x484]
push esi
push eax
push 0x17c
call fcn.0045cfa6
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x794]
push edi
push eax
call fcn.00598768
call fcn.00469766
push eax
lea eax, [ebp - 0x794]
push eax
call fcn.004e73d7
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00481d19
push dword [ebp - 0x34]
mov esi, eax
call fcn.004e6f4d
push dword [ebp - 0x2c]
call fcn.004e6f4d
push dword [ebp - 0x20]
call fcn.004e6f4d
push dword [ebp - 0x18]
call fcn.004e6f4d
push dword [ebp - 8]
call fcn.004e6f4d
mov ax, word [ebp - 4]
add esp, 0x30
mov word [0x6b5484], ax
xor eax, eax
cmp si, bx
sete al
mov word [0x6b5486], ax
xor edi, edi
cmp word [0x6b5486], di
jne 0x414928
mov ax, bx
jmp 0x41496a
push 0x3c
lea eax, [ebp - 0x78]
pop esi
push esi
push edi
push eax
call fcn.0044cbc0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
pop ebx
leave
ret