Function at 0x4038aa
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4169b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
push ebx
push esi
push edi
push 0x10
xor edi, edi
lea eax, [esp + 0x8c]
push edi
push eax
call fcn.0040aa50
add esp, 0xc
push 0x44
pop esi
push esi
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.0040aa50
mov dword [esp + 0x134], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax]
and eax, 0xf000
add esp, 0xc
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x20
cmp eax, 0x2000
je 0x403931
cmp eax, 0x8000
jne 0x403939
mov dword [esp + 0x10], 0x80
jmp 0x403939
mov dword [esp + 0x10], 0x40
call fcn.00403508
mov dword [esi + 0x10], eax
lea ebx, [esi + 0x1c]
lea eax, [esp + 0x6c]
push ebx
push eax
mov dword [esi + 0x14], edx
call fcn.00405ac6
push eax
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x18c], edi
call fcn.00405b1c
lea ecx, [esi + 0x38]
push ecx
push eax
lea eax, [esp + 0x108]
push eax
mov byte [esp + 0x198], 1
call fcn.00405b7b
add esp, 0x1c
push edi
push 1
lea ecx, [esp + 0x58]
call fcn.00403082
push edi
push 1
lea ecx, [esp + 0x74]
mov byte [esp + 0x184], 4
call fcn.00403082
mov ecx, ebx
lea edi, [esp + 0x18]
call fcn.00405bcf
lea ecx, [esp + 0xf0]
lea edi, [esp + 0x34]
mov byte [esp + 0x17c], 5
call fcn.00405bcf
mov byte [esp + 0x17c], 6
cmp dword [ebx + 0x18], 0x10
jb 0x4039d7
mov eax, dword [ebx + 4]
jmp 0x4039da
lea eax, [ebx + 4]
xor edi, edi
push edi
push eax
call fcn.00407150
pop ecx
pop ecx
test al, al
jne 0x403b41
call fcn.004046ad
cmp eax, 0xffffffff
jne 0x403b3f
push str.PATH
lea ecx, [esp + 0xd8]
call fcn.00406d6b
pop ecx
push eax
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x184], 7
call fcn.00406c4a
pop ecx
pop ecx
push edi
push 1
lea ecx, [esp + 0xdc]
mov byte [esp + 0x184], 9
call fcn.00403082
push str.SYSTEMROOT
lea ecx, [esp + 0x54]
call fcn.00406d6b
pop ecx
mov byte [esp + 0x17c], 0xa
cmp dword [esp + 0x68], 0x10
mov eax, dword [esp + 0x54]
jae 0x403a5f
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0xd8]
push str._sSYSTEM32
push eax
call fcn.00406f28
add esp, 0xc
push eax
lea eax, [esp + 0x70]
mov byte [esp + 0x180], 0xb
call fcn.004047ce
push 0
push 1
lea ecx, [esp + 0xdc]
mov byte [esp + 0x184], 0xa
call fcn.00403082
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x70]
call fcn.004047ce
cmp dword [ebx + 0x18], 0x10
jb 0x403ab8
mov ebx, dword [ebx + 4]
jmp 0x403abb
add ebx, 4
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x110]
push ebx
push eax
call fcn.00407439
add esp, 0xc
mov ecx, eax
lea edi, [esp + 0xd4]
mov byte [esp + 0x17c], 0xc
call fcn.00405bcf
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
mov byte [esp + 0x184], 0xd
call fcn.00404c3b
push 1
mov esi, edi
call fcn.004049a3
push ebx
push 1
lea ecx, [esp + 0x114]
call fcn.00403082
push ebx
push 1
lea ecx, [esp + 0x58]
call fcn.00403082
lea esi, [esp + 0x6c]
mov byte [esp + 0x17c], 6
call fcn.00404ac0
push dword [esp + 0x6c]
call fcn.0040afa1
mov esi, dword [ebp + 8]
pop ecx
xor edi, edi
mov eax, dword [esi]
test dword [eax], 0x600
je 0x403c08
call fcn.004077ec
test al, al
jne 0x403c08
push 0x3c
pop ebx
push ebx
lea eax, [esp + 0x9c]
push edi
push eax
call fcn.0040aa50
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], 8
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], 0x4140
mov dword [esp + 0xa4], str.runas
jae 0x403b9d
lea eax, [esp + 0x1c]
cmp dword [esp + 0x4c], 8
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x38]
jae 0x403bb3
lea eax, [esp + 0x38]
mov dword [esp + 0xac], eax
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0xb8], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x403bfe
cmp dword [esp + 0xb8], 0x20
jbe 0x403bfe
mov eax, dword [esi]
test byte [eax], 0x44
je 0x403bf5
push edi
mov edi, dword [esp + 0xd4]
jmp 0x403c75
mov eax, dword [esp + 0xd0]
jmp 0x403c63
mov eax, dword [esi]
test dword [eax], 0x400
jne 0x403c7b
cmp dword [esp + 0x4c], 8
mov ecx, dword [esp + 0x38]
jae 0x403c17
lea ecx, [esp + 0x38]
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x403c26
lea eax, [esp + 0x1c]
lea edx, [esp + 0x88]
push edx
lea edx, [esp + 0x12c]
push edx
push edi
push edi
push dword [esp + 0x20]
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403c68
mov eax, dword [esi]
test byte [eax], 0x44
je 0x403c5c
push edi
mov edi, dword [esp + 0x8c]
jmp 0x403c75
mov eax, dword [esp + 0x88]
mov dword [esi + 8], eax
jmp 0x403c7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
push eax
xor edi, edi
call fcn.004037f2
pop ecx
push 1
xor ebx, ebx
lea esi, [esp + 0x38]
call fcn.004049a3
push 1
lea esi, [esp + 0x1c]
call fcn.004049a3
push ebx
push 1
lea ecx, [esp + 0xf8]
call fcn.00403082
mov ecx, dword [esp + 0x174]
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret