Function at 0x6f61a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
call fcn.00404c60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041fb9c
mov edi, eax
cmp dword [edi + 0x65], 0
jne 0x6f61e8
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.006f5664
cmp byte [edi + 0x1f], 0
je 0x6f6218
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x3ff00000
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x3ff00000
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
jmp 0x6f6272
lea eax, [edi + 0x30]
lea edx, [edi + 0x20]
mov ecx, dword [edx]
mov ebx, ecx
add ebx, dword [edx + 8]
mov esi, dword [eax + 0x28]
sub esi, ebx
mov dword [ebp - 0x34], esi
fild dword [ebp - 0x34]
fild dword [eax + 8]
fdivp st(1)
fstp qword [ebp - 0x18]
wait
mov ebx, dword [edx + 4]
add ebx, dword [edx + 0xc]
mov esi, dword [eax + 0x2c]
sub esi, ebx
mov dword [ebp - 0x34], esi
fild dword [ebp - 0x34]
fild dword [eax + 0xc]
fdivp st(1)
fstp qword [ebp - 0x20]
wait
mov ebx, dword [eax + 0x18]
add ebx, ecx
mov dword [ebp - 0x34], ebx
fild dword [ebp - 0x34]
fstp qword [ebp - 0x28]
wait
mov eax, dword [eax + 0x1c]
add eax, dword [edx + 4]
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fstp qword [ebp - 0x30]
wait
mov eax, dword [edi + 0x65]
mov eax, dword [eax + 0xfc]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x6f640b
mov eax, dword [edi + 0x65]
mov eax, dword [eax + 0xfc]
mov edx, esi
call fcn.0041fb9c
mov ebx, eax
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebx + 0x98]
add eax, dword [ebx + 0xa0]
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fmul qword [ebp - 0x20]
fadd qword [ebp - 0x30]
call fcn.00402e18
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebx + 0x94]
add eax, dword [ebx + 0x9c]
mov dword [ebp - 0x48], eax
fild dword [ebp - 0x48]
fmul qword [ebp - 0x18]
fadd qword [ebp - 0x28]
call fcn.00402e18
push eax
fild dword [ebx + 0x98]
fmul qword [ebp - 0x20]
fadd qword [ebp - 0x30]
call fcn.00402e18
push eax
fild dword [ebx + 0x94]
fmul qword [ebp - 0x18]
fadd qword [ebp - 0x28]
call fcn.00402e18
pop edx
pop ecx
call fcn.0041e41c
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x6f6401
cmp byte [ebp + 0x10], 0
je 0x6f63ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0xc2], 0
je 0x6f6349
mov edi, eax
mov edx, ebx
mov eax, dword [edi + 0xc4]
call dword [edi + 0xc0]
mov byte [ebp - 0xd], 1
mov edx, dword [ebx + 0x54]
mov eax, 0x6f6420
call fcn.00405264
dec eax
jne 0x6f640b
mov edx, dword [ebx + 0xd0]
mov eax, 0x6f642c
call fcn.00405264
test eax, eax
jle 0x6f6381
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0xd0]
call fcn.00404cb4
jmp 0x6f63a8
mov eax, dword [ebp + 8]
call fcn.00404c60
push 1
push 0
push 0
mov eax, dword [ebx + 0xd0]
call fcn.00405120
push eax
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov byte [ebp - 0xd], 1
jmp 0x6f640b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0xca], 0
je 0x6f63d5
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov eax, dword [edi + 0xcc]
call dword [edi + 0xc8]
mov byte [ebp - 0xd], 1
mov edx, dword [ebx + 0x54]
mov eax, 0x6f6420
call fcn.00405264
dec eax
jne 0x6f640b
mov eax, dword [ebp + 0xc]
mov word [eax], 0xffeb
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0xd0]
call fcn.00404cb4
mov byte [ebp - 0xd], 1
jmp 0x6f640b
dec esi
cmp esi, 0xffffffff
jne 0x6f6288
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc