Function at 0x409ef8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
push 2
lea eax, [ebp - 0x58]
push ebx
push eax
mov ecx, edi
call fcn.00408280
push 2
lea eax, [ebp - 0x48]
push 2
push eax
mov ecx, edi
call fcn.00408280
push 1
lea eax, [ebp - 0x28]
push 4
push eax
mov ecx, edi
call fcn.00408280
push 1
lea eax, [ebp - 0x38]
push 5
push eax
mov ecx, edi
call fcn.00408280
push esi
lea ecx, [ebp - 0x10]
call fcn.0040235b
cmp word [0x425770], bx
mov eax, 0x425770
mov dword [ebp - 0x10], 0x422424
mov ecx, eax
je 0x409f6d
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x409f66
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402a9c
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004059e6
cmp word [0x425768], bx
mov ecx, 0x425768
mov eax, ecx
je 0x409f9d
inc eax
inc eax
cmp word [eax], bx
jne 0x409f96
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
mov ecx, dword [ebp - 0x4c]
mov eax, ecx
cmp word [ecx], bx
je 0x409fbc
inc eax
inc eax
cmp word [eax], bx
jne 0x409fb5
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
cmp word [0x425764], bx
mov ecx, 0x425764
mov eax, ecx
je 0x409fe1
inc eax
inc eax
cmp word [eax], bx
jne 0x409fda
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
push dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 0x17]
mov byte [ebp - 0x18], bl
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push 0x425760
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402baa
cmp dword [ebp - 0x3c], ebx
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
je 0x40a096
push dword [ebp - 0x3c]
call esi
test eax, eax
je 0x40a096
cmp word [0x425750], bx
mov ecx, 0x425750
mov eax, ecx
je 0x40a044
inc eax
inc eax
cmp word [eax], bx
jne 0x40a03d
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
mov ecx, dword [ebp - 0x3c]
mov eax, ecx
cmp word [ecx], bx
je 0x40a063
inc eax
inc eax
cmp word [eax], bx
jne 0x40a05c
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
cmp word [0x425748], bx
mov ecx, 0x425748
mov eax, ecx
je 0x40a088
inc eax
inc eax
cmp word [eax], bx
jne 0x40a081
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
cmp dword [ebp - 0x1c], ebx
je 0x40a0e8
push dword [ebp - 0x1c]
call esi
test eax, eax
je 0x40a0e8
cmp word [0x425738], bx
mov ecx, 0x425738
mov eax, ecx
je 0x40a0bb
inc eax
inc eax
cmp word [eax], bx
jne 0x40a0b4
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
cmp word [ecx], bx
je 0x40a0da
inc eax
inc eax
cmp word [eax], bx
jne 0x40a0d3
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
cmp dword [ebp - 0x2c], ebx
je 0x40a13a
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x40a13a
cmp word [0x425728], bx
mov ecx, 0x425728
mov eax, ecx
je 0x40a10d
inc eax
inc eax
cmp word [eax], bx
jne 0x40a106
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp word [ecx], bx
je 0x40a12c
inc eax
inc eax
cmp word [eax], bx
jne 0x40a125
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a9c
push 0x44
lea eax, [ebp - 0xac]
pop esi
push esi
push ebx
push eax
call fcn.0041cd10
push 0x10
lea eax, [ebp - 0x68]
push ebx
push eax
mov dword [ebp - 0xac], esi
call fcn.0041cd10
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.00401876
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xac]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x10]
call fcn.0040166e
lea ecx, [ebp - 0x38]
call fcn.004016fd
lea ecx, [ebp - 0x28]
call fcn.004016fd
lea ecx, [ebp - 0x48]
call fcn.004016fd
lea ecx, [ebp - 0x58]
call fcn.004016fd
pop edi
pop esi
pop ebx
leave
ret 0xc