Function at 0x415781
Capabilities:
Create process on windows

Disassembly:
jmp 0x415781
push ebp
lea ebp, [esp - 0x384]
sub esp, 0x404
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x380], eax
mov eax, dword [ebp + 0x390]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x394]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x398]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x3a4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x3b0]
push esi
mov esi, dword [ebp + 0x38c]
push edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x80], ebx
call fcn.00508d00
mov edi, 0x103
push edi
lea eax, [ebp + 0x27d]
push ebx
push eax
mov byte [ebp + 0x27c], bl
call fcn.00508d00
push edi
lea eax, [ebp + 0x179]
push ebx
push eax
mov byte [ebp + 0x178], bl
call fcn.00508d00
push esi
call fcn.004010dc
add esp, 0x28
test eax, eax
je 0x415844
xor eax, eax
jmp 0x415aeb
cmp dword [ebp - 0x18], ebx
jne 0x415861
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], bx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], ebx
jne 0x41586c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov esi, 0x104
push esi
push dword [ebp - 0x10]
lea eax, [ebp + 0x27c]
push eax
call fcn.00402abd
lea eax, [ebp + 0x27c]
push eax
call fcn.00508320
add esp, 0x10
cmp byte [ebp + eax + 0x27b], 0x2e
push esi
lea eax, [ebp + 0x27c]
jne 0x4158a8
push 0x589aec
jmp 0x4158ad
push str..exe
push eax
call fcn.00402365
lea eax, [ebp + 0x27c]
add esp, 0xc
push eax
call fcn.00402b5d
test eax, eax
pop ecx
je 0x4159af
push 0x7f
lea eax, [ebp + 0xf9]
push ebx
push eax
mov byte [ebp + 0xf8], bl
call fcn.00508d00
lea eax, [ebp + 0x27c]
push eax
lea eax, [ebp + 0x178]
push eax
call fcn.0050d660
lea eax, [ebp + 0x178]
push eax
call fcn.00402a1d
add esp, 0x18
lea eax, [ebp + 0xf8]
push 0xa
push eax
call fcn.0050ea90
cdq
mov ecx, 0x8ae
idiv ecx
add edx, ecx
push edx
call fcn.0050f640
push ebx
lea eax, [ebp + 0xf8]
push eax
push str..exe
lea eax, [ebp + 0x178]
push esi
push eax
mov byte [ebp + 0xfd], bl
call fcn.0040167c
push 1
lea eax, [ebp + 0x178]
push eax
lea eax, [ebp + 0x27c]
push eax
call fcn.00402298
add esp, 0x2c
test eax, eax
jne 0x4159af
push 0x4b0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp + 0x178]
push eax
lea eax, [ebp + 0x27c]
push eax
call fcn.00402298
add esp, 0xc
test eax, eax
jne 0x4159af
push str._GetLastError_
lea eax, [ebp + 0x178]
push eax
lea eax, [ebp + 0x27c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push str.:8:CreateProcessExe___s_____s___will_FAIL:_An_alternate_version_of_the_EXE_will_be_run:_The_file___s__could_not_be_renamed_to___s_:__s
call fcn.004020c2
add esp, 0x18
mov byte [ebp + 0x178], bl
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp + 0x3a0]
push dword [ebp + 0x39c]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp + 0x178]
push eax
call fcn.004010dc
test eax, eax
pop ecx
jne 0x415ab1
push edi
lea eax, [ebp - 0xb]
push ebx
push eax
mov byte [ebp - 0xc], bl
call fcn.00508d00
lea eax, [ebp + 0x27c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0050d660
lea eax, [ebp - 0xc]
push eax
call fcn.00403224
lea eax, [ebp + 0x27c]
push eax
call fcn.00402a1d
lea eax, [ebp + 0x178]
push eax
call fcn.00402a1d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x178]
push eax
call fcn.00401758
push 1
lea eax, [ebp + 0x27c]
push eax
lea eax, [ebp + 0x178]
push eax
call fcn.00402298
add esp, 0x34
test eax, eax
jne 0x415ab1
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp + 0x27c]
push eax
lea eax, [ebp + 0x178]
push eax
call fcn.00402298
add esp, 0xc
test eax, eax
jne 0x415ab1
push str._GetLastError_
lea eax, [ebp + 0x27c]
push eax
lea eax, [ebp + 0x178]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push str.:8:CreateProcessExe___s_____s___encountered_a_problem:_The_file___s__could_not_be_reverse_renamed_back_to___s_:__s
call fcn.004020c2
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x14], eax
jne 0x415ae8
push 0x1a66
mov ebx, str..Console.c
push ebx
mov edi, str.CreateProcessExe
push edi
push dword [ebp - 0x38]
call fcn.00403134
push 0x1a67
push ebx
push edi
push dword [ebp - 0x3c]
call fcn.00403134
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x380]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x384
leave
ret