Function at 0x403f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x64], 0
mov eax, dword [ebp + 8]
cmp eax, 4
jbe 0x403f5d
mov dword [0x40b544], 0x16
or eax, 0xffffffff
jmp 0x40415e
mov dword [ebp - 0x68], ebx
jmp 0x403f74
inc ebx
cmp byte [ebx], 0
jne 0x403f62
cmp byte [ebx + 1], 0
je 0x403f74
mov eax, ebx
inc ebx
mov byte [eax], 0x20
cmp byte [ebx], 0
jne 0x403f63
lea edx, [ebp - 0x50]
mov ecx, 0x44
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [ebp - 0x50], 0x44
mov esi, dword [0x40bef4]
jmp 0x403f9b
dec esi
test esi, esi
je 0x403fb8
lea eax, [esi - 1]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x40bdf4]
cmp byte [eax + edx*8 + 4], 0
je 0x403f9a
mov eax, esi
lea eax, [eax + eax*4]
add eax, 4
mov word [ebp - 0x1e], ax
push 1
movzx eax, word [ebp - 0x1e]
push eax
call fcn.004073a0
add esp, 8
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [edx], esi
xor edi, edi
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [ebp - 0x1c]
lea eax, [edx + eax + 4]
mov dword [ebp - 8], eax
jmp 0x404043
mov eax, edi
and eax, 0x1f
mov edx, edi
sar edx, 5
mov edx, dword [edx*4 + 0x40bdf4]
lea eax, [edx + eax*8]
mov dword [ebp - 0xc], eax
test byte [eax + 4], 0x10
jne 0x404028
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 4]
mov byte [edx], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [edx], eax
jmp 0x404036
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov edx, dword [ebp - 8]
or eax, 0xffffffff
mov dword [edx], eax
inc edi
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp edi, esi
jl 0x403ff4
cmp dword [ebp + 8], 4
jne 0x404096
xor edi, edi
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [ebp - 0x1c]
lea eax, [edx + eax + 4]
mov dword [ebp - 8], eax
jmp 0x404081
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov edx, dword [ebp - 8]
or eax, 0xffffffff
mov dword [edx], eax
inc edi
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
mov eax, esi
mov edx, 3
cmp eax, edx
jle 0x40408e
mov eax, edx
cmp edi, eax
jl 0x404066
or dword [ebp - 0x64], 8
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x64]
push eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4040e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004044f0
pop ecx
mov eax, dword [ebp - 0x70]
push eax
call fcn.00403b60
pop ecx
or eax, 0xffffffff
jmp 0x40415e
mov dword [0x40b544], 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004044f0
pop ecx
cmp dword [ebp + 8], 2
jne 0x404106
push 0
call fcn.00402180
pop ecx
jmp 0x404151
cmp dword [ebp + 8], 0
jne 0x404132
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404151
cmp dword [ebp + 8], 4
jne 0x40414b
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6c], 0
jmp 0x404151
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret