Function at 0x417c16
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x2b79dc86
mov dword [ebp - 0x14], 0x4656e2e3
mov dword [ebp - 0x1c], 5
push ebx
mov dword [ebp - 0x18], 0xffffffff
push esi
mov dword [ebp - 0xc], eax
jmp 0x417c55
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x50], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x417c47
push 3
pop ebx
push 1
mov dword [ebp - 0xc], eax
pop esi
jmp 0x417d47
mov dword [ebp - 8], 0xa772304b
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x417d02
push 2
lea ecx, [ebp - 0x40]
call fcn.00416ef7
mov dword [ebp - 0x18], 0xcedb7758
mov dword [ebp - 0x10], 0
jmp 0x417ca6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov dword [eax + ecx*4], 0xc0272a72
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x417c96
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 4], ebx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x50]
cmp dword [ecx + 4], 0
jne 0x417cc9
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x48]
dec dword [ecx + 4]
mov dword [ebp - 0x18], esi
jns 0x417cb2
mov dword [ebp - 0x10], 0xfffffff9
lea ecx, [ebp - 0x40]
call fcn.00417267
dec dword [ebp - 8]
jns 0x417c7c
xor eax, eax
cmp dword [ebp - 8], eax
je 0x417d14
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x417d44
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x417d42
mov dword [ebp - 0x18], 5
cmp dword [ebp - 0x18], eax
je 0x417d28
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
jmp 0x417d44
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x417d44
push 0x2230
push 0x12a3
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x417c69
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x20]
movdqa xmm0, xmmword [0xaaf850]
sub edx, ecx
mov ecx, dword [ebp - 0x48]
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
sete bl
xor edx, edx
cmp ebx, ecx
sete dl
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
dec ecx
cmp ecx, 6
sbb ecx, ecx
xor ebx, ebx
inc ecx
imul edx, ecx, 0xffff
mov ecx, dword [ebp - 0x1c]
movdqu xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
cmp edx, ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x50]
push ecx
setge bl
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x18], ebx
push ecx
mov dword [ebp - 8], 0xb1891f78
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x10], 0x6ccb0362
mov dword [ebp - 0xc], eax
push eax
call fcn.0041793d
mov dword [ebp - 0x10], 0x1c443818
xor eax, eax
mov dword [ebp - 0x10], 0xbf7a
mov dword [ebp - 0xc], 0xe8236511
mov dword [ebp - 0x14], 0xa4045238
mov dword [ebp - 0x18], esi
cmp dword [ebp - 8], eax
je 0x417e30
mov ecx, dword [ebp - 8]
mov edx, 0xa2ff3e14
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 4], edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
je 0x417e2d
cmp dword [ebp - 8], eax
je 0x417e2d
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
imul edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
neg edx
neg edx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
sub edx, dword [ebp - 8]
imul ecx, edx, 0xfffd
test ecx, ecx
je 0x417e67
mov ecx, esi
cmp dword [ebp - 8], eax
jne 0x417e69
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, edx
setle bl
imul ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, 0x2502870b
add ecx, ebx
je 0x417e8d
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
cmp edx, ecx
setle bl
imul ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x417ead
cmp dword [ebp - 0x14], eax
jne 0x417eaf
mov esi, eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
sub ecx, esi
imul ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x14]
je 0x417f09
mov dword [ebp - 0x10], 0xe
jmp 0x417f01
mov dword [ebp - 0xc], eax
jmp 0x417ee6
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jne 0x417eec
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x417ed7
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x417efe
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jg 0x417ed2
jmp 0x417f67
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x10], eax
jmp 0x417f23
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x28], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x417f15
cmp dword [ebp - 0x14], 0x36352b72
jle 0x417f35
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor edx, edx
test ecx, ecx
setns dl
sub edx, dword [ebp - 0x14]
sub edx, 0x5f26
neg edx
sbb edx, edx
add edx, 0xffff8f4a
neg edx
sbb edx, edx
add edx, 0xffff6a31
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
dec dword [ebp - 0x18]
mov dword [ebp - 8], eax
jmp 0x417f8e
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x417f8b
push 0x196e
push eax
push eax
push eax
push eax
push 0xef
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x417f6c
lea ecx, [ebp - 0x34]
call fcn.00417267
mov eax, dword [ebp - 0x20]
pop esi
pop ebx
mov dword [eax], 0xfffffff9
mov esp, ebp
pop ebp
ret