Function at 0x4087f7
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push 0x6a8
mov eax, 0x42886f
call fcn.0041788c
mov ebx, ecx
mov dword [ebp - 0x65c], ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x42c]
push 0x43363c
push eax
call fcn.00413fcb
lea edi, [ebx + 0x868]
lea eax, [ebp - 0x42c]
push edi
push eax
call fcn.00413f9c
lea eax, [ebp - 0x42c]
push 0x433640
push eax
call fcn.00413f9c
lea eax, [ebp - 0x42c]
push esi
push eax
call fcn.00413f9c
lea eax, [ebp - 0x42c]
push 0x43363c
push eax
call fcn.00413f9c
xor eax, eax
mov dword [ebp - 0x658], 4
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], eax
push 0x44
pop esi
push esi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6b4]
push eax
call fcn.004158b0
xor eax, eax
mov dword [ebp - 0x6b4], esi
add esp, 0x34
mov word [ebp - 0x684], ax
lea eax, [ebp - 0x648]
mov dword [ebp - 0x688], 0x101
lea ecx, [ebp - 0x658]
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.0040d62a
push 2
pop ecx
test eax, eax
jne 0x408920
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x64c]
push eax
push 0xfffffffffffffff5
push ecx
lea ecx, [ebp - 0x658]
call fcn.0040d491
mov dword [ebp - 0x678], eax
lea ecx, [ebp - 0x658]
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x644]
push eax
call fcn.0040d62a
test eax, eax
jne 0x40896e
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x644]
push eax
push 0xfffffffffffffff4
push 4
lea ecx, [ebp - 0x658]
call fcn.0040d491
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x63c]
push eax
push ecx
push ecx
lea ecx, [ebp - 0x658]
call fcn.0040d55f
mov dword [ebp - 0x67c], eax
xor ecx, ecx
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x6b4]
push eax
push edi
push ecx
push ecx
push 1
push ecx
push ecx
lea eax, [ebp - 0x42c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4089d2
push 0xa03d
mov ecx, ebx
call fcn.004040a5
or esi, 0xffffffff
jmp 0x408b18
push dword [ebp - 0x668]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea ecx, [ebp - 0x63c]
call fcn.0040d3b8
lea ecx, [ebp - 0x64c]
call fcn.0040d3b8
lea ecx, [ebp - 0x644]
call fcn.0040d3b8
lea ecx, [ebp - 0x658]
call fcn.0040d417
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x408a1c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x630]
push eax
push dword [ebp - 0x66c]
call edi
cmp dword [ebp - 0x630], 0x103
je 0x408a14
push dword [ebp - 0x66c]
call esi
cmp dword [ebp - 0x630], 0
je 0x408b12
mov ecx, dword [ebp - 0x634]
test ecx, ecx
je 0x408a61
push 0
call fcn.0040d714
mov esi, eax
jmp 0x408a63
xor esi, esi
test esi, esi
je 0x408b06
xor ecx, ecx
lea eax, [esi + 0x100]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411fc9
pop ecx
lea ecx, [esi + 1]
mov ebx, eax
push ecx
call fcn.00411fc9
mov edi, eax
mov dword [esp], pe_nt_image_headers32
lea eax, [ebp - 0x62c]
push eax
push 0xa03a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp - 0x634]
test ecx, ecx
je 0x408ac5
push edi
call fcn.0040d714
mov ecx, edi
mov byte [edi + esi], 0
call fcn.0040f07d
mov esi, eax
lea eax, [ebp - 0x62c]
push esi
push eax
push ebx
call fcn.00415df4
mov ecx, dword [ebp - 0x65c]
add esp, 0xc
push ebx
call fcn.0040403e
push edi
call fcn.00415940
pop ecx
push ebx
call fcn.00415940
pop ecx
push esi
call fcn.00415940
pop ecx
jmp 0x408b12
push 0xa03e
mov ecx, ebx
call fcn.004040a5
mov esi, dword [ebp - 0x630]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x63c]
call fcn.0040d3b8
lea ecx, [ebp - 0x64c]
call fcn.0040d3b8
lea ecx, [ebp - 0x644]
call fcn.0040d3b8
lea ecx, [ebp - 0x650]
call fcn.0040d3b8
lea ecx, [ebp - 0x648]
call fcn.0040d3b8
lea ecx, [ebp - 0x640]
call fcn.0040d3b8
and dword [ebp - 0x654], 0
mov ecx, dword [ebp - 0x638]
test ecx, ecx
je 0x408b7e
dec dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x408b7e
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x634]
test ecx, ecx
je 0x408b97
dec dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x408b97
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
call fcn.0041784a
ret 4