Function at 0x41ac3a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.0041ac3a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
xor eax, eax
add eax, dword [0x42e40c]
mov edx, dword [eax]
call fcn.00427847
mov edx, 0x42ec58
call fcn.0042785b
call fcn.00427102
je 0x41ac7b
push dword [0x428f6c]
call fcn.0041c798
xor eax, eax
movsx ecx, word [0x42b17c]
cmp ecx, eax
jle 0x41ada0
mov eax, 4
add eax, dword [0x42e40c]
mov edx, dword [eax]
call fcn.00427847
mov edx, 0x42ec58
call fcn.0042785b
call fcn.00427102
jne 0x41ad29
push 0
push 0
push 0
mov edx, 0x4302a8
call fcn.0042785b
mov ebx, esp
add ebx, 8
push ebx
call fcn.00426ed5
mov edx, 0x430304
call fcn.0042785b
mov ebx, esp
add ebx, 8
push ebx
call fcn.00426ed5
mov ebx, 0x42ae58
push ebx
mov edx, 0x4302f4
call fcn.0042785b
mov ebx, esp
add ebx, 0xc
push ebx
call fcn.00426ed5
push dword [0x428f6c]
call fcn.0041b7bc
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00425928
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00425928
mov ebx, esp
mov eax, dword [ebx]
call fcn.00425928
add esp, 0xc
mov eax, 4
add eax, dword [0x42e40c]
mov edx, dword [eax]
call fcn.00427847
mov edx, 0x42ec58
call fcn.0042785b
call fcn.00427102
je 0x41ada0
push 0
mov eax, 8
add eax, dword [0x42e40c]
mov ebx, eax
push ebx
mov edx, 0x430304
call fcn.0042785b
mov ebx, esp
add ebx, 4
push ebx
call fcn.00426ed5
mov ebx, 0x42ae58
push ebx
mov eax, 4
add eax, dword [0x42e40c]
mov ebx, eax
push ebx
push dword [0x428f6c]
call fcn.0041b7bc
mov ebx, esp
mov eax, dword [ebx]
call fcn.00425928
add esp, 4
mov eax, 1
movsx ecx, word [0x42b180]
cmp ecx, eax
je 0x41b1ea
mov edx, dword [0x42b178]
call fcn.00427847
mov edx, dword [0x42ae88]
call fcn.00427847
call fcn.00427091
mov edx, 0x42ed74
call fcn.0042785b
call fcn.00427091
fild word [0x42b17c]
call fcn.00425f8e
call fcn.00427091
mov ebx, 0x4290bc
mov ecx, 0xfd0
call fcn.00427727
call fcn.004277f0
call fcn.00424f7c
fstp qword [0x42ac98]
mov ebx, 0x4290bc
call fcn.004276e1
xor ebx, ebx
fld qword [0x42ac98]
fistp word [ebp - 0x36]
mov ecx, pe_nt_image_headers32
mov eax, 1
mov dx, 0x261
call fcn.00424303
fld qword [0x42ac98]
fistp word [ebp - 0x36]
mov edx, 0x4302f4
call fcn.0042785b
call fcn.00425058
call fcn.00424623
xor ecx, ecx
fld qword [0x42ac98]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
call fcn.00425999
fldz
mov edx, dword [0x42ae7c]
call fcn.00427847
call fcn.0042615a
fcompp
fnstsw ax
sahf
jbe 0x41af3e
mov eax, 0x10
add eax, dword [0x42e40c]
mov edx, dword [eax]
call fcn.00427847
mov edx, 0x42ec58
call fcn.0042785b
call fcn.00427102
mov eax, 0xffffffff
je 0x41aeab
inc eax
xor ecx, ecx
add ecx, dword [0x42e40c]
mov edx, dword [ecx]
call fcn.00427847
mov edx, 0x42ec58
call fcn.0042785b
call fcn.00427102
mov ecx, 0xffffffff
je 0x41aed1
inc ecx
or eax, ecx
test eax, eax
je 0x41af3e
mov edx, dword [0x42ae7c]
call fcn.00427847
mov ecx, 0xf
mov eax, 1
call fcn.004248ec
mov edx, 0x42efa4
call fcn.0042785b
call fcn.00427102
je 0x41af3e
xor eax, eax
movsx ecx, word [0x42ba00]
cmp ecx, eax
jne 0x41af3e
push 1
mov edx, dword [0x42ae7c]
call fcn.00427847
call fcn.0042615a
call fcn.00424fa0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
call fcn.004271a4
xor eax, eax
add eax, dword [0x42e40c]
mov edx, dword [eax]
call fcn.00427847
mov edx, 0x42ec58
call fcn.0042785b
call fcn.00427102
je 0x41b1a5
mov edx, dword [0x42b178]
call fcn.00427847
mov edx, dword [0x42ae88]
call fcn.00427847
call fcn.00427091
mov edx, 0x42ef78
call fcn.0042785b
call fcn.00427091
fild word [0x42b17c]
call fcn.00425f8e
call fcn.00427091
mov ebx, 0x4290bc
mov ecx, 0xfd0
call fcn.00427727
call fcn.004277f0
call fcn.00424f7c
fstp qword [0x42ac98]
mov ebx, 0x4290bc
call fcn.004276e1
xor ebx, ebx
fld qword [0x42ac98]
fistp word [ebp - 0x36]
mov ecx, pe_nt_image_headers32
mov eax, 1
mov dx, 0x261
call fcn.00424303
fld qword [0x42ac98]
fistp word [ebp - 0x36]
push 0
mov eax, 0x22
call fcn.0042301b
call fcn.00422fb4
call fcn.00425058
xor eax, eax
mov ebx, dword [0x42e40c]
mov edx, dword [ebx + eax*4]
call fcn.00427847
call fcn.00425058
push 0
mov eax, 0x22
call fcn.0042301b
call fcn.00422fb4
call fcn.00425058
call fcn.00424623
fld qword [0x42ac98]
fistp word [ebp - 0x36]
push 0
mov eax, 0x22
call fcn.0042301b
call fcn.00422fb4
call fcn.00425058
mov eax, 3
mov ebx, dword [0x42e40c]
mov edx, dword [ebx + eax*4]
call fcn.00427847
call fcn.00425058
push 0
mov eax, 0x22
call fcn.0042301b
call fcn.00422fb4
call fcn.00425058
call fcn.00424623
fld qword [0x42ac98]
fistp word [ebp - 0x36]
push 0
mov eax, 0x22
call fcn.0042301b
call fcn.00422fb4
call fcn.00425058
mov eax, 4
mov ebx, dword [0x42e40c]
mov edx, dword [ebx + eax*4]
call fcn.00427847
call fcn.00425058
push 0
mov eax, 0x22
call fcn.0042301b
call fcn.00422fb4
call fcn.00425058
call fcn.00424623
xor ecx, ecx
fld qword [0x42ac98]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
call fcn.00425999
mov edx, dword [0x42b178]
call fcn.00427847
mov edx, dword [0x42ae88]
call fcn.00427847
call fcn.00427091
mov eax, 0x10
add eax, dword [0x42e40c]
mov edx, dword [eax]
call fcn.00427847
call fcn.00427091
mov ebx, 0x4290bc
mov ecx, 0xfd0
call fcn.00427727
push 0
push 1
mov ebx, 0x4290bc
call fcn.004276e1
mov edx, 0x42ec48
call fcn.0042785b
call fcn.00427091
mov edx, dword [0x42ae58]
call fcn.00427847
call fcn.00427091
mov edx, 0x42ec48
call fcn.0042785b
call fcn.00427091
fild word [0x42b17c]
call fcn.00425f8e
call fcn.00427091
mov ebx, esp
add ebx, 4
call fcn.00426f14
call dword [sym.imp.KERNEL32.DLL_WinExec]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00425928
pop eax
add esp, 4
call fcn.004271a4
call fcn.00424f7c
fstp qword [ebp - 0x8c]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.DLL_DestroyWindow]
call fcn.004271a4
push 0
mov edx, 0x430310
call fcn.0042785b
mov ebx, esp
push ebx
call fcn.00426ed5
call fcn.00404138
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00425928
pop eax
add esp, 4
push 0
call dword [sym.imp.USER32.DLL_PostQuitMessage]
call fcn.004271a4
call fcn.0041c16c
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4