Function at 0x409119
Capabilities:
Create process on windows

Disassembly:
push 0x3fc
mov eax, 0x41f75c
call fcn.0040dc60
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1ac]
push eax
mov ecx, esi
call fcn.0040d384
and dword [ebp - 4], 0
lea eax, [ebp - 0x174]
push eax
mov ecx, esi
call fcn.0040d384
xor ecx, ecx
mov dword [ebp - 0x38c], ecx
mov dword [ebp - 0x3a0], ecx
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x398], ecx
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x1d0], edx
mov dword [ebp - 0x1d4], ecx
mov word [ebp - 0x1e4], ax
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1f0], ecx
mov word [ebp - 0x200], ax
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b8], ecx
mov word [ebp - 0x1c8], ax
mov ecx, dword [ebx + 0x10]
mov byte [ebp - 4], 5
call fcn.00406fd7
test al, al
je 0x4093be
push 1
lea eax, [ebp - 0x158]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 6
jb 0x4091d3
mov eax, dword [eax]
lea ecx, [ebp - 0x300]
push 3
mov dword [ebp - 0x304], ecx
push eax
lea ecx, [ebp - 0x304]
call fcn.0040d384
push dword [ebp - 0x304]
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 7
call fcn.0040d384
lea eax, [ebp - 0x300]
cmp dword [ebp - 0x304], eax
je 0x40921c
push dword [ebp - 0x304]
call fcn.0040d384
pop ecx
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
push edi
push 0x529
lea eax, [ebp - 0x158]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 8
jb 0x40924e
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
cmp dword [ebp - 0x1d0], 8
mov eax, dword [ebp - 0x1e4]
jae 0x409280
lea eax, [ebp - 0x1e4]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 0x52a
lea eax, [ebp - 0x158]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 9
jb 0x4092a9
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
cmp dword [ebp - 0x198], 8
mov eax, dword [ebp - 0x1ac]
jae 0x4092db
lea eax, [ebp - 0x1ac]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 0x52b
lea eax, [ebp - 0x158]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xa
jb 0x409304
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
cmp dword [ebp - 0x160], 8
mov eax, dword [ebp - 0x174]
jae 0x409336
lea eax, [ebp - 0x174]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
mov ecx, esi
call fcn.0040b595
test al, al
je 0x4093be
push edi
push 0x530
lea eax, [ebp - 0x158]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xb
jb 0x40936a
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
lea eax, [ebp - 0x158]
push eax
mov ecx, esi
call fcn.0040b519
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xc
jb 0x4093a1
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
push 0x10b
lea eax, [ebp - 0x13b]
push 0
push eax
mov byte [ebp - 0x13c], 0
call fcn.0040f99c
mov ecx, dword [ebx + 0x10]
add esp, 0xc
call fcn.00406fd7
test al, al
je 0x4094f0
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x190]
push eax
mov ecx, ebx
call fcn.00409a05
mov ecx, dword [ebx + 0x10]
push eax
lea eax, [ebp - 0x158]
push eax
mov byte [ebp - 4], 0xd
call fcn.0040d384
push 0
push 1
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0xf
call fcn.0040d384
cmp dword [ebp - 0x144], 0x10
mov eax, dword [ebp - 0x158]
jae 0x40943c
lea eax, [ebp - 0x158]
lea ecx, [ebp - 0x300]
push 3
mov dword [ebp - 0x304], ecx
push eax
lea ecx, [ebp - 0x304]
call fcn.0040d384
push dword [ebp - 0x304]
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x10
call fcn.0040d384
lea eax, [ebp - 0x300]
cmp dword [ebp - 0x304], eax
je 0x409485
push dword [ebp - 0x304]
call fcn.0040d384
pop ecx
push 0xffffffffffffffff
push 0x401730
mov esi, 0x10c
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.0040d384
mov eax, dword [ebp - 0x158]
add esp, 0x10
cmp dword [ebp - 0x144], 0x10
jae 0x4094b6
lea eax, [ebp - 0x158]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.0040d384
push 0xffffffffffffffff
push 0x401738
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.0040d384
add esp, 0x20
push 0
push 1
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.0040d384
lea edx, [ebp - 0x13c]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4094f9
mov edi, dword [ebp - 0x164]
sub edx, ecx
mov ecx, dword [ebp - 0x19c]
add ecx, 0x5e
add edi, ecx
add edi, edx
push edi
call fcn.0040d384
mov esi, eax
pop ecx
mov dword [ebp - 0x3b8], esi
cmp dword [ebp - 0x160], 8
mov eax, dword [ebp - 0x174]
mov byte [ebp - 4], 0x11
jae 0x40953d
lea eax, [ebp - 0x174]
lea ecx, [ebp - 0x280]
push 3
mov dword [ebp - 0x284], ecx
push eax
lea ecx, [ebp - 0x284]
call fcn.0040d384
cmp dword [ebp - 0x198], 8
mov eax, dword [ebp - 0x1ac]
mov byte [ebp - 4], 0x12
jae 0x409570
lea eax, [ebp - 0x1ac]
lea ecx, [ebp - 0x384]
push 3
mov dword [ebp - 0x388], ecx
push eax
lea ecx, [ebp - 0x388]
call fcn.0040d384
push dword [ebp - 0x284]
lea eax, [ebp - 0x13c]
push dword [ebp - 0x388]
push eax
push 0x4016d0
push edi
push esi
call fcn.0040d384
add esp, 0x18
cmp eax, 0xffffffff
lea eax, [ebp - 0x384]
sete byte [ebp - 0x38d]
cmp dword [ebp - 0x388], eax
je 0x4095d0
push dword [ebp - 0x388]
call fcn.0040d384
pop ecx
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x284], eax
je 0x4095ee
push dword [ebp - 0x284]
call fcn.0040d384
pop ecx
cmp byte [ebp - 0x38d], 0
je 0x40962e
lea eax, [ebp - 0x3b4]
push eax
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x3b4], 0x4012ec
call fcn.0040d384
push 0x42046c
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 0x3c4], 0x4011e8
call fcn.0040d384
push 0x44
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.0040f99c
xor eax, eax
lea edi, [ebp - 0x3b0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x408]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x409680
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x38c], eax
jmp 0x409809
push 0xffffffffffffffff
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4096a4
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x38c], eax
jmp 0x4097e1
lea eax, [ebp - 0x38c]
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x409693
mov ecx, dword [ebx + 0x10]
call fcn.00406fd7
test al, al
je 0x4097e1
push dword [ebp - 0x38c]
lea eax, [ebp - 0x30]
push 0x4012e8
push eax
call fcn.0040d384
add esp, 0xc
xor edi, edi
cmp eax, 0xffffffff
je 0x409732
push edi
push 0x52f
lea eax, [ebp - 0x190]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x13
jb 0x409707
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x11
call fcn.0040d384
mov ecx, dword [ebx + 0x10]
push 2
lea eax, [ebp - 0x30]
push eax
call fcn.00407159
cmp dword [ebp - 0x38c], 0
je 0x409751
xor eax, eax
cmp dword [ebp - 0x38c], 0xbc2
setne al
add eax, 0x53c
jmp 0x409756
mov eax, 0x53e
push edi
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.0040d384
push eax
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x14
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x11
call fcn.0040d384
push edi
push 0x52c
lea eax, [ebp - 0x190]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x15
jb 0x4097a4
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x11
call fcn.0040d384
cmp dword [ebp - 0x1b4], 8
mov eax, dword [ebp - 0x1c8]
jae 0x4097d6
lea eax, [ebp - 0x1c8]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
cmp dword [ebp - 0x3b0], 0
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
je 0x4097f8
push dword [ebp - 0x3b0]
call edi
cmp dword [ebp - 0x3ac], 0
je 0x409809
push dword [ebp - 0x3ac]
call edi
mov ecx, dword [ebx + 0x10]
call fcn.00406fd7
test al, al
je 0x409999
push 1
lea eax, [ebp - 0x190]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x16
jb 0x409833
mov eax, dword [eax]
lea ecx, [ebp - 0x300]
push 3
mov dword [ebp - 0x304], ecx
push eax
lea ecx, [ebp - 0x304]
call fcn.0040d384
push dword [ebp - 0x304]
xor eax, eax
xor edi, edi
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x144], 7
mov dword [ebp - 0x148], edi
mov word [ebp - 0x158], ax
call fcn.0040d384
lea eax, [ebp - 0x300]
cmp dword [ebp - 0x304], eax
je 0x409897
push dword [ebp - 0x304]
call fcn.0040d384
pop ecx
push edi
push 1
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x1a
call fcn.0040d384
push edi
push 0x52e
lea eax, [ebp - 0x2c]
push eax
call fcn.0040d384
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x1b
jb 0x4098c4
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1a
call fcn.0040d384
cmp dword [ebp - 0x144], 8
mov eax, dword [ebp - 0x158]
jae 0x4098f3
lea eax, [ebp - 0x158]
mov ecx, dword [ebx + 0x10]
push 2
push eax
call fcn.0040d384
mov ecx, dword [ebx + 0x10]
push 2
call fcn.0040d384
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x409987
lea eax, [ebp - 0x3a0]
push eax
call fcn.0040b8c1
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x158]
call fcn.0040d384
jmp 0x40999b
xor ebx, ebx
mov edi, dword [ebp - 0x38c]
test esi, esi
je 0x4099ac
push esi
call fcn.0040d384
pop ecx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x1c8]
call fcn.0040d384
push ebx
push esi
lea ecx, [ebp - 0x200]
call fcn.0040d384
push ebx
push esi
lea ecx, [ebp - 0x1e4]
call fcn.0040d384
lea ecx, [ebp - 0x3a0]
call fcn.0040d384
push ebx
push esi
lea ecx, [ebp - 0x174]
call fcn.0040d384
push ebx
push esi
lea ecx, [ebp - 0x1ac]
call fcn.0040d384
mov eax, edi
call fcn.0040dce3
ret 4