Function at 0x614f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
mov dword [ebp - 4], ecx
push edi
mov edi, 0x7c1a4c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp ebx, 0x12
rep movsb byte es:[edi], byte [esi]
je 0x614f6b
call fcn.00419180
mov ecx, eax
call fcn.00418880
cmp ebx, 0x63
jg 0x6151d2
je 0x6151c8
cmp ebx, 0x1e
ja case.0x615285.5022
jmp dword [ebx*4 + 0x6154f4]
push 6
jmp 0x615410
mov eax, dword [0x81424c]
test eax, eax
jne 0x615048
mov al, byte [0x814243]
inc al
cmp al, 3
mov byte [0x814243], al
jl 0x615048
mov edi, 0x78f3f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x76aed0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 1
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x104]
push 0
push ecx
mov ecx, 0x7dabc0
call fcn.00509380
cmp eax, 0x7a
jne 0x61519a
mov eax, dword [0x83e55c]
push 1
cmp eax, 1
push 0
push 0
jne 0x61502d
mov edx, dword [0x83ec88]
push 0x78f3d8
push 0x76b258
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x615190
mov eax, dword [0x83ec88]
push 0x78f3c0
push 0x76b258
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x615190
push 0x10b
jmp 0x615410
push 8
jmp 0x615410
push 0x10a
jmp 0x615410
push 0x136
jmp 0x615410
mov ecx, dword [ebp + 8]
push ecx
push 0x1c1
jmp 0x615229
push 0x1b7
jmp 0x615410
push 0x2a9
jmp 0x615410
push 0x2bf
jmp 0x615410
push 0x2c0
jmp 0x615410
push 0x2c1
jmp 0x615410
push 0x2c2
jmp 0x615410
push 0x2c3
jmp 0x615410
push 0x2c4
jmp 0x615410
push 0x2c5
jmp 0x615410
mov eax, dword [0x81424c]
test eax, eax
jne 0x61543d
mov edi, 0x78f390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x76aed0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 1
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x104]
push 0
push ecx
mov ecx, 0x7dabc0
call fcn.00509380
cmp eax, 0x7a
jne 0x61519a
mov edx, dword [0x83ec88]
push 1
push 0
push 0
push 0x78f34c
push 0x76b258
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x615190
mov ecx, dword [ebp + 8]
push ecx
push 0x564
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
push eax
push edx
call fcn.00711e28
add esp, 0xc
lea eax, [ebp - 0x104]
mov ecx, 0x7dabc0
push 0x76aed0
push 0
push 1
push 1
push 2
push eax
call fcn.00509380
cmp eax, 0x7d
jne 0x61519a
mov ecx, 0x814260
call fcn.00533740
lea edx, [ebp - 0x104]
mov edi, 0x7c1a4c
jmp 0x615420
push 0x565
jmp 0x615410
push 0x6d7
jmp 0x615410
push 0x6d8
jmp 0x615410
push 0x170
jmp 0x615410
cmp ebx, 0x1393
jg 0x61526e
je case.0x615285.5016
lea eax, [ebx - 0x64]
cmp eax, 9
ja case.0x615285.5022
jmp dword [eax*4 + 0x615570]
mov ecx, dword [ebp + 8]
push ecx
push 0x32a
jmp 0x615229
push 0x32b
jmp 0x615410
push 0x35b
jmp 0x615410
push 0x35c
jmp 0x615410
mov ecx, dword [ebp + 8]
push ecx
push 0x329
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
push eax
push edx
call fcn.00711e28
add esp, 0xc
jmp 0x61543d
push 0x50d
jmp 0x615410
push 0x55c
jmp 0x615410
push 0x571
jmp 0x615410
push 0x572
jmp 0x615410
lea eax, [ebx - 0x1394]
cmp eax, 0x34
ja case.0x615285.5022
xor ecx, ecx
mov cl, byte [eax + 0x6155c4]
jmp dword [ecx*4 + 0x615598]
push ebx
push 9
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
push eax
push 0x78f344
push edx
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
mov eax, dword [ebp + 8]
push eax
push 0x337
call fcn.00581bb0
add esp, 4
lea ecx, [ebp - 0x104]
push eax
push ecx
call fcn.00711e28
add esp, 0xc
jmp 0x61543d
push ebx
push 0x6fd
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
push eax
push 0x78f344
push edx
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x6fe
call fcn.00581bb0
add esp, 4
push eax
lea eax, [ebp - 0x104]
push 0x78f344
push eax
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x6ff
call fcn.00581bb0
add esp, 4
lea ecx, [ebp - 0x104]
push eax
push 0x78f344
push ecx
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x700
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
push eax
push 0x78f344
push edx
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x6fa
call fcn.00581bb0
add esp, 4
push eax
lea eax, [ebp - 0x104]
push 0x78f344
push eax
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x10a
call fcn.00581bb0
add esp, 4
lea ecx, [ebp - 0x104]
push eax
push 0x78f344
push ecx
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x701
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
push eax
push 0x78f344
push edx
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push ebx
push 0x702
call fcn.00581bb0
add esp, 4
push eax
lea eax, [ebp - 0x104]
push 0x78f344
push eax
call fcn.00711e28
add esp, 0x10
jmp 0x61543d
push 9
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x6154d4
lea ecx, [ebp - 0x104]
push ebx
push ecx
lea edx, [ebp - 0x204]
push 0x78f344
push edx
call fcn.00711e28
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x204]
mov ecx, 0x7dabc0
push 0x76aed0
push edi
push edi
push 1
push edi
push eax
call fcn.00509380
cmp ebx, 5
je 0x615496
cmp ebx, 0x63
jne 0x6154bb
mov esi, dword [ebp - 4]
push edi
push edi
push edi
mov edx, dword [esi]
push 2
mov ecx, esi
call dword [edx + 0x18]
mov dword [0x8142c0], edi
mov dword [esi + 0xc], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [0x8142c0], edi
pop edi
pop esi
mov dword [eax + 0xc], 3
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x8142c0], 0
pop esi
mov dword [ecx + 0xc], 3
pop ebx
mov esp, ebp
pop ebp
ret 8