Function at 0x606890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x606898
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x606bcc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4946e0]
call fcn.00495798
mov esi, eax
cmp byte [ebp - 1], 0
jne 0x606930
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x6e6660]
mov eax, dword [eax]
call fcn.005d1e94
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x6e60d0]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [0x6e386c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x20]
mov ecx, 1
pop eax
call fcn.0040bc78
push dword [ebp - 0xc]
push 0x606be0
push 0x606be0
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040561c
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x606968
push 0x606be0
lea edx, [ebp - 0x28]
mov eax, dword [0x6e639c]
mov eax, dword [eax]
call fcn.005d1e94
push dword [ebp - 0x28]
push 0x606be0
push 0x606be0
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040561c
mov edx, dword [ebp - 0x24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, edi
and eax, 1
dec eax
jne 0x60698a
lea eax, [ebp - 0x2c]
mov edx, dword [0x6e3620]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x2c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, edi
and eax, 0x10
cmp eax, 0x10
jne 0x6069ae
lea eax, [ebp - 0x30]
mov edx, dword [0x6e588c]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, edi
and eax, 4
cmp eax, 4
jne 0x6069d2
lea eax, [ebp - 0x34]
mov edx, dword [0x6e43d8]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x34]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
and edi, 8
cmp edi, 8
jne 0x6069f4
lea eax, [ebp - 0x38]
mov edx, dword [0x6e62c8]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x38]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [ebp - 1], 0
jne 0x606b6f
mov ecx, dword [0x6e3f1c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5d5910]
call fcn.00486bf4
mov edx, dword [0x6e3294]
mov dword [edx], eax
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048be30
mov ebx, eax
mov eax, dword [0x6e3294]
mov eax, dword [eax]
sub ebx, dword [eax + 0x48]
sar ebx, 1
jns 0x606a3e
adc ebx, 0
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048bde4
add ebx, eax
mov edx, ebx
mov eax, dword [0x6e3294]
mov eax, dword [eax]
call fcn.0046cb04
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048bdfc
mov ebx, eax
mov eax, dword [0x6e3294]
mov eax, dword [eax]
sub ebx, dword [eax + 0x4c]
sar ebx, 1
jns 0x606a83
adc ebx, 0
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048be18
add ebx, eax
mov edx, ebx
mov eax, dword [0x6e3294]
mov eax, dword [eax]
call fcn.0046cb28
lea eax, [ebp - 0x3c]
mov edx, dword [0x6e3e34]
mov edx, dword [edx]
mov ecx, dword [0x6e64a0]
mov edx, dword [ecx + edx*4]
call fcn.00404e54
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
call fcn.0046d3c4
lea edx, [ebp - 0x40]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x40]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov eax, dword [eax + 0x2fc]
call fcn.004a1eb8
lea edx, [ebp - 0x44]
mov eax, dword [0x6e43a4]
mov eax, dword [eax]
call fcn.005d1e94
mov edx, dword [ebp - 0x44]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov eax, dword [eax + 0x304]
call fcn.004a20c0
mov eax, dword [0x6e6230]
mov eax, dword [eax]
mov edx, dword [0x6e403c]
mov edx, dword [edx + eax*4]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
call fcn.004a20c0
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
dec eax
jne 0x606b88
push 0
push 0
push 0
mov eax, dword [0x6e5570]
mov eax, dword [eax]
call fcn.0040508c
push eax
push 0x606be8
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00473d08
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x606b88
lea edx, [ebp - 0x48]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x48]
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00675eb4
mov eax, esi
call fcn.00403c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x606bd3
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.004052f0
lea eax, [ebp - 0x3c]
call fcn.00404ba0
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.004052f0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004052f0
ret