Function at 0x41cb50
Capabilities:
Create process on windows
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41f8a8
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebp
mov ebp, dword [esp + 0x68]
push esi
xor esi, esi
cmp ebp, esi
jne 0x41cb87
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
push ebx
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [0x424038]
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], si
mov dword [esp + 0x74], eax
mov ecx, str.cmd.exe__c___
mov dword [esp + 0x6c], esi
test ecx, ecx
jne 0x41cbcb
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor eax, eax
jmp 0x41cbd8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.cmd.exe__c___
call ebx
push str.cmd.exe__c___
push eax
lea ecx, [esp + 0x7c]
call fcn.004102b0
push ebp
push ebp
call ebx
push eax
lea ecx, [esp + 0x7c]
call fcn.004102b0
mov edx, 0x42476c
test edx, edx
jne 0x41cc02
xor eax, eax
jmp 0x41cc09
push 0x42476c
call ebx
push 0x42476c
push eax
lea ecx, [esp + 0x7c]
call fcn.004102b0
mov ebp, dword [esp + 0x78]
cmp ebp, esi
je 0x41cc5b
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41cc5b
mov eax, 0x424774
test eax, eax
je 0x41cc3e
push 0x424774
call ebx
push 0x424774
push eax
lea ecx, [esp + 0x7c]
call fcn.004102b0
push ebp
push ebp
call ebx
push eax
lea ecx, [esp + 0x7c]
call fcn.004102b0
mov ecx, 0x42476c
test ecx, ecx
jne 0x41cc68
xor eax, eax
jmp 0x41cc6f
push 0x42476c
call ebx
push 0x42476c
push eax
lea ecx, [esp + 0x7c]
call fcn.004102b0
mov eax, dword [esp + 0x74]
xor ecx, ecx
mov edx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp edx, 1
jg 0x41cc94
cmp dword [eax - 4], esi
jge 0x41cceb
mov ebx, dword [eax - 8]
cmp ebx, esi
jle 0x41cc9d
mov ecx, ebx
push ecx
lea ecx, [esp + 0x78]
call fcn.00410180
test eax, eax
je 0x41cceb
mov edi, dword [esp + 0x74]
lea ecx, [ebx + 1]
mov edx, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x74]
mov dword [eax - 8], ebx
mov eax, dword [0x42403c]
cmp ebp, eax
je 0x41cce7
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41cce7
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x74]
mov eax, dword [ecx - 0xc]
lea esi, [ecx - 0xc]
cmp eax, 1
jle 0x41cd34
lea ecx, [esp + 0x74]
call fcn.004105b0
mov edx, dword [esi + 4]
lea ecx, [esp + 0x74]
push edx
call fcn.00410180
test eax, eax
je 0x41cd34
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x74]
inc ecx
add esi, 0xc
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x74]
mov dword [edx - 8], eax
mov ecx, dword [esp + 0x74]
xor edx, edx
mov byte [eax + ecx], 0
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], edx
xor ecx, ecx
mov dword [esp + 0x18], edx
lea ebp, [eax - 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
cmp dword [ebp], 1
jg 0x41cd74
cmp dword [eax - 4], ecx
jge 0x41cdb4
mov ebx, dword [eax - 8]
test ebx, ebx
jle 0x41cd7d
mov ecx, ebx
push ecx
lea ecx, [esp + 0x78]
call fcn.00410180
test eax, eax
je 0x41cdb4
mov edi, dword [esp + 0x74]
lea ecx, [ebx + 1]
mov eax, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x78]
mov dword [ecx - 8], ebx
call fcn.004101e0
mov eax, dword [esp + 0x74]
lea edx, [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x74]
mov esi, eax
call fcn.00410210
mov edx, dword [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x74]
pop edi
mov dword [esp + 0x68], 0xffffffff
pop ebx
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x6c]
mov byte [eax + edx], 0
mov eax, dword [esp + 0x6c]
mov edx, dword [0x42403c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41ce31
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41ce31
mov edx, dword [esp + 0x6c]
add edx, 0xfffffff4
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x60
ret