Function at 0x40ca09
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x42229c
call fcn.0041410c
sub esp, 0x140
push ebx
push ebp
push esi
push edi
xor eax, eax
lea edi, [esp + 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop esi
xor ebp, ebp
push esi
stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push ebp
push eax
mov dword [esp + 0x20], ebp
call fcn.00414e20
mov edx, dword [0x42e194]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
mov dword [esp + 0x10c], esi
test edx, edx
jne 0x40ca6e
push 0x2c7
mov eax, 0x42f720
push eax
push eax
push ebp
call ebx
mov edx, dword [0x42e194]
mov ecx, dword [0x42e190]
mov eax, ecx
not eax
mov edi, 0x177
and eax, edi
neg eax
sbb eax, eax
shr ecx, 1
mov esi, 0x80000000
and eax, esi
add eax, esi
or ecx, eax
mov eax, ecx
not eax
and eax, edi
neg eax
sbb eax, eax
neg eax
or edx, 6
add ecx, ecx
or ecx, eax
inc edx
lea eax, [edi + 0x37]
cmove edx, eax
or edx, 0xd0
inc edx
mov eax, 0x3e4
cmove edx, eax
or edx, 0x294
mov dword [0x42e190], ecx
mov dword [0x42e194], edx
jne 0x40cae5
push 0x78
mov eax, 0x42f724
push eax
push eax
push ebp
call ebx
mov edx, dword [0x42e194]
mov ecx, dword [0x42e190]
mov esi, dword [esp + 0x164]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
mov dword [esp + 0x10], 0x20
mov eax, dword [eax]
and eax, 0xf000
cmp eax, 0x2000
je 0x40cbad
cmp eax, 0x8000
jne 0x40cbb5
mov eax, ecx
not eax
and eax, 0x177
or edx, 0x25b
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
or ecx, eax
mov dword [esp + 0x10], 0x80
mov dword [0x42e194], edx
mov dword [0x42e190], ecx
test edx, edx
jne 0x40cb67
push 0x335
mov eax, 0x42f728
push eax
push eax
push ebp
call ebx
mov edx, dword [0x42e194]
or edx, 0x3ce
inc edx
mov eax, 0x2f5
cmove edx, eax
or edx, 0x142
mov dword [0x42e194], edx
jne 0x40cb8d
push ebp
call edi
mov edx, dword [0x42e194]
inc edx
mov eax, 0x185
cmove edx, eax
inc edx
mov eax, 0x358
cmove edx, eax
or edx, 0x13a
mov dword [0x42e194], edx
jmp 0x40cbb5
mov dword [esp + 0x10], 0x40
call fcn.0040d21b
mov dword [esi + 0x14], edx
mov edx, dword [0x42e194]
or edx, 0x28a
mov dword [esi + 0x10], eax
mov dword [0x42e194], edx
jne 0x40cbe6
push 0x4c
mov eax, 0x42f72c
push eax
push eax
push ebp
call ebx
mov edx, dword [0x42e194]
xor eax, eax
shl edx, 0x1a
inc eax
or edx, eax
mov dword [0x42e194], edx
jne 0x40cc18
push 0x310
mov eax, 0x42f730
push eax
push eax
push ebp
call ebx
mov edx, dword [0x42e194]
test edx, edx
jne 0x40cc18
push ebp
call edi
mov edx, dword [0x42e194]
mov eax, dword [0x42e190]
mov ecx, eax
not ecx
and ecx, 0x177
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
mov dword [0x42e190], eax
test edx, edx
jne 0x40cc43
push ebp
call edi
mov edx, dword [0x42e194]
mov eax, 0x2a4
cmp edx, eax
cmove edx, eax
mov eax, 0x1ca
cmp edx, eax
cmove edx, eax
push 0x6f
pop eax
inc edx
lea ebp, [esi + 0x1c]
cmove edx, eax
push ebp
lea eax, [esp + 0x64]
push 0x42f738
push eax
mov dword [0x42e194], edx
call fcn.0040acdd
and dword [esp + 0x164], 0
push 0x42f734
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0040ac96
mov ecx, eax
mov byte [esp + 0x170], 1
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [esp + 0xfc]
push eax
call fcn.0040ac55
add esp, 0x24
mov byte [esp + 0x158], 3
lea ecx, [esp + 0x48]
call fcn.004016a6
mov byte [esp + 0x158], 4
lea ecx, [esp + 0x60]
call fcn.004016a6
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.0040afe0
mov byte [esp + 0x160], 5
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0040afe0
add esp, 0x10
mov byte [esp + 0x158], 6
cmp dword [ebp + 0x14], 0x10
jb 0x40cd0b
mov eax, dword [ebp]
jmp 0x40cd0d
mov eax, ebp
push 0
push eax
call fcn.00411434
pop ecx
pop ecx
test al, al
jne 0x40cf5f
mov eax, dword [0x42e190]
mov ecx, eax
not ecx
and ecx, 0x177
neg ecx
sbb ecx, ecx
add eax, eax
neg ecx
or eax, ecx
mov dword [0x42e190], eax
mov eax, dword [0x42e194]
test eax, eax
jne 0x40cd4e
push eax
call edi
mov eax, dword [0x42e194]
inc eax
push 1
pop ecx
push dword [0x42e1f8]
cmove eax, ecx
shl eax, 0x14
or eax, ecx
mov ecx, 0x1de
cmp eax, ecx
cmove eax, ecx
or eax, 0xf7
cmp dword [0x42e1fc], 0x10
mov dword [0x42e194], eax
mov eax, 0x42e1e8
cmovae eax, dword [0x42e1e8]
push 0
push eax
mov ecx, ebp
call fcn.0040d1b3
cmp eax, 0xffffffff
jne 0x40cf5f
mov ecx, dword [0x42e190]
mov eax, ecx
not eax
and eax, 0x177
neg eax
sbb eax, eax
mov edx, 0x80000000
and eax, edx
add eax, edx
shr ecx, 1
or ecx, eax
mov eax, ecx
not eax
and eax, 0x177
neg eax
sbb eax, eax
and eax, edx
add eax, edx
shr ecx, 1
or ecx, eax
mov eax, dword [0x42e194]
mov dword [0x42e190], ecx
test eax, eax
jne 0x40ce0b
push 0x2d6
mov eax, 0x42f73c
push eax
push eax
push 0
call ebx
mov eax, dword [0x42e194]
test eax, eax
jne 0x40ce0b
push eax
call edi
mov eax, dword [0x42e194]
test eax, eax
jne 0x40ce0b
push eax
call edi
mov eax, dword [0x42e194]
or eax, 0x252
mov dword [0x42e194], eax
lea eax, [esp + 0x88]
push 0x42f740
push eax
call fcn.00411b6a
mov byte [esp + 0x160], 7
xor ebx, ebx
inc ebx
push ebx
push 0x3b
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00413096
add esp, 0x18
mov byte [esp + 0x158], 9
lea ecx, [esp + 0x88]
call fcn.004016a6
lea eax, [esp + 0x48]
push 0x42f748
push eax
call fcn.00411b6a
mov byte [esp + 0x160], 0xa
cmp dword [esp + 0x64], 0x10
lea eax, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
push eax
lea eax, [esp + 0x94]
push 0x42f754
push eax
call fcn.00407cf8
add esp, 0x14
mov byte [esp + 0x158], 0xb
push eax
lea ecx, [esp + 0x64]
call fcn.0040d55e
mov byte [esp + 0x158], 0xa
lea ecx, [esp + 0x88]
call fcn.004016a6
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x64]
call fcn.0040d5cb
cmp dword [ebp + 0x14], 0x10
jb 0x40cecf
mov ebp, dword [ebp]
lea eax, [esp + 0x60]
push eax
push 0
lea eax, [esp + 0xfc]
push ebp
push eax
call fcn.00412480
mov byte [esp + 0x168], 0xc
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.0040afe0
add esp, 0x18
mov byte [esp + 0x158], 0xd
push eax
lea ecx, [esp + 0x1c]
call fcn.0040b29e
mov byte [esp + 0x158], 0xc
xor ebp, ebp
push ebp
push ebx
lea ecx, [esp + 0x90]
call fcn.00401c39
mov byte [esp + 0x158], 0xa
lea ecx, [esp + 0xf4]
call fcn.004016a6
mov byte [esp + 0x158], 9
lea ecx, [esp + 0x48]
call fcn.004016a6
mov byte [esp + 0x158], 6
lea ecx, [esp + 0x60]
call fcn.0040b6be
jmp 0x40cf61
xor ebp, ebp
mov eax, dword [esi]
test dword [eax], 0x600
je 0x40d0f4
call fcn.0041221e
test al, al
jne 0x40d0f4
push 0x3c
pop ebx
push ebx
lea eax, [esp + 0xa4]
push ebp
push eax
call fcn.00414e20
mov edx, dword [0x42e190]
add esp, 0xc
cmp dword [esp + 0x2c], 8
mov dword [esp + 0xa0], ebx
mov ebx, dword [0x42e194]
inc ebx
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0xb0], eax
mov eax, 0x1c0
cmove ebx, eax
mov eax, edx
not eax
and eax, 0x177
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
xor eax, eax
inc eax
shl ebx, 0xe
or ebx, eax
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
mov dword [esp + 0xb4], eax
xor eax, eax
inc eax
mov dword [esp + 0xbc], eax
mov eax, edx
not eax
and eax, 0x177
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov dword [esp + 0xa4], 0x4140
mov dword [esp + 0xac], 0x42f760
mov dword [0x42e194], ebx
mov dword [0x42e190], edx
test ebx, ebx
jne 0x40d052
push ebp
call edi
mov ebx, dword [0x42e194]
mov edx, dword [0x42e190]
mov ecx, 0x80000000
mov eax, edx
not eax
and eax, 0x177
neg eax
sbb eax, eax
neg eax
add edx, edx
or edx, eax
mov eax, edx
not eax
and eax, 0x177
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
xor eax, eax
inc eax
mov ecx, edx
not ecx
shl ebx, 0x1a
or ebx, eax
and ecx, 0x177
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
mov dword [0x42e194], ebx
mov dword [0x42e190], eax
test ebx, ebx
jne 0x40d0b4
push ebp
call edi
cmp dword [0x42e194], ebx
jne 0x40d0b4
push ebp
call edi
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d0ea
cmp dword [esp + 0xc0], 0x20
jbe 0x40d0ea
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40d0e1
push ebp
push dword [esp + 0xdc]
jmp 0x40d155
mov eax, dword [esp + 0xd8]
jmp 0x40d144
mov eax, dword [esi]
test dword [eax], 0x400
jne 0x40d15e
cmp dword [esp + 0x44], 8
lea edx, [esp + 0x78]
push edx
lea edx, [esp + 0x110]
push edx
push ebp
push ebp
push dword [esp + 0x20]
lea ecx, [esp + 0x44]
cmovae ecx, dword [esp + 0x44]
cmp dword [esp + 0x40], 8
push ebp
push ebp
push ebp
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40d149
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40d140
push ebp
push dword [esp + 0x7c]
jmp 0x40d155
mov eax, dword [esp + 0x78]
mov dword [esi + 8], eax
jmp 0x40d15e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esp + 0x18], eax
push ebp
push esi
call fcn.0040bcb7
add esp, 0xc
mov byte [esp + 0x158], 5
xor ebx, ebx
push ebp
inc ebx
push ebx
lea ecx, [esp + 0x38]
call fcn.00401c39
mov byte [esp + 0x158], 4
push ebp
push ebx
lea ecx, [esp + 0x20]
call fcn.00401c39
or dword [esp + 0x158], 0xffffffff
lea ecx, [esp + 0xdc]
call fcn.004016a6
mov ecx, dword [esp + 0x150]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret