Function at 0x416e40
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x435cfc
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x443284]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x443284]
xor eax, esp
push eax
lea eax, [esp + 0x2f0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x304]
mov ebp, dword [esp + 0x300]
xor edi, edi
push edi
mov esi, ecx
lea ecx, [esp + 0xe8]
push ecx
push 0x104
push edi
push esi
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x4170e6
push 0x40
lea edx, [esp + 0x84]
push edi
push edx
call fcn.00424a50
add esp, 0xc
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ax, word [esp + 0x308]
mov word [esp + 0xac], ax
mov ebx, 1
mov eax, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x7c], 0x44
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xe0], 7
mov dword [esp + 0xdc], edi
mov word [esp + 0xcc], di
lea ecx, [eax + 2]
jmp 0x416f20
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x416f20
sub eax, ecx
sar eax, 1
push eax
push esi
lea esi, [esp + 0xd0]
call fcn.00401d80
mov ecx, esi
mov dword [esp + 0x2f8], edi
push ecx
mov edx, 0x43a59c
lea edi, [esp + 0x64]
call fcn.00411620
add esp, 4
mov byte [esp + 0x2f8], bl
push eax
mov ebx, 0x43bf4c
lea esi, [esp + 0x48]
call fcn.00402310
add esp, 4
push eax
mov ebx, ebp
lea esi, [esp + 0x2c]
mov byte [esp + 0x2fc], 2
call fcn.00402310
add esp, 4
push 0xffffffffffffffff
xor ebx, ebx
push ebx
lea ecx, [esp + 0xd0]
mov byte [esp + 0x300], 3
call fcn.00401a50
mov ebp, 8
cmp dword [esp + 0x40], ebp
jb 0x416fb9
mov edx, dword [esp + 0x2c]
push edx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x5c], ebp
mov esi, 7
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
jb 0x416fde
mov eax, dword [esp + 0x48]
push eax
call fcn.0041f829
add esp, 4
mov byte [esp + 0x2f8], bl
cmp dword [esp + 0x78], ebp
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], bx
jb 0x417005
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0xe0], ebp
mov eax, dword [esp + 0xcc]
jae 0x41701c
lea eax, [esp + 0xcc]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x80]
push ecx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x417072
cmp dword [esp + 0x30c], ebx
je 0x417052
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0xe0], ebp
jb 0x41706b
mov eax, dword [esp + 0xcc]
push eax
call fcn.0041f829
add esp, 4
mov eax, 1
jmp 0x4170e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x14]
cmp edi, ebx
mov esi, eax
je 0x4170cd
call fcn.00414fa0
push eax
push str.___s__
push 0x104
push 0x104
push 0x445be0
call fcn.0041f84a
mov eax, dword [esp + 0xe0]
add esp, 0x14
cmp dword [esp + 0xe0], ebp
jae 0x4170bb
lea eax, [esp + 0xcc]
push eax
push esi
push edi
push str._s.err__d_.__s_
push 2
call fcn.004154c0
add esp, 0x14
cmp dword [esp + 0xe0], ebp
jb 0x4170e6
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.0041f829
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x2f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.0041f134
add esp, 0x2e8
ret