Function at 0x406094
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8dc
mov eax, 0x4866e0
push ebx
push esi
push edi
mov esi, 0x4844a0
lea ebx, [ebp - 0xd8]
call fcn.00463a70
push esi
lea edi, [ebp - 0x2d4]
mov esi, 0x4842dc
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
lea edi, [ebp - 0x594]
mov dword [ebp - 0xdc], 0xf8
push esi
add esi, 0x104a
mov eax, edi
lea edx, [ebp - 0xdc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
push edx
lea ecx, [ebp - 0x594]
push ecx
lea eax, [esi + 0x1082]
push eax
lea edx, [esi + 0x1051]
push edx
push SysReAllocStringLen
call fcn.0040756c
add esp, 0x14
lea ecx, [esi + 0x1087]
push ecx
lea eax, [ebp - 0x594]
push eax
call fcn.00463948
add esp, 8
test eax, eax
jne 0x40613c
mov edx, dword [ebx]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4069fa
lea ecx, [esi + 0x108e]
push ecx
lea eax, [ebp - 0x594]
push eax
call fcn.00463778
add esp, 8
lea edi, [ebp - 0x1d8]
mov eax, edi
lea edx, [ebp - 0xdc]
push esi
add esi, 0x1093
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0xdc], 0xf8
push edx
push ecx
lea eax, [esi + 0x10c9]
lea edx, [esi + 0x1098]
push eax
push edx
push SysReAllocStringLen
call fcn.0040756c
add esp, 0x14
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0xf8
push ecx
lea eax, [ebp - 0x2d4]
push eax
lea edx, [esi + 0x1106]
push edx
lea ecx, [esi + 0x10d5]
push ecx
push SysReAllocStringLen
call fcn.0040756c
add esp, 0x14
cmp byte [ebp - 0x1d8], 0
jne 0x4061e0
mov eax, dword [ebx]
mov dword fs:[0], eax
jmp 0x4069fa
xor eax, eax
push esi
lea edi, [ebp - 0x1d8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x3d0]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2d4], 0
pop esi
je 0x406429
lea eax, [ebp - 0x2d4]
push eax
lea edx, [ebp - 0x3d0]
push edx
call fcn.00463778
add esp, 8
cmp byte [ebp + 0xc], 0
je 0x40630c
push 1
lea edx, [esi + 0x110e]
mov word [ebx + 0x10], 8
lea eax, [ebp - 8]
call fcn.00481c08
inc dword [ebx + 0x1c]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x3d0]
lea eax, [ebp - 4]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
inc dword [ebx + 0x1c]
pop edx
call fcn.00481d18
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x10]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x14]
pop eax
call fcn.00481d18
cmp dword [ebp - 0x14], 0
je 0x4062ab
mov edx, dword [ebp - 0x14]
jmp 0x4062b1
lea edx, [esi + 0x1119]
push edx
call sub.KERNEL32.DLL_WinExec
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00481cc0
jmp 0x4069f1
push 1
lea edx, [esi + 0x111a]
mov word [ebx + 0x10], 0x14
lea eax, [ebp - 0x1c]
call fcn.00481c08
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3d0]
lea eax, [ebp - 0x18]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
inc dword [ebx + 0x1c]
pop edx
call fcn.00481d18
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x24]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x24]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x28]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x28]
push edx
lea edx, [esi + 0x1125]
lea eax, [ebp - 0x2c]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x2c]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x30]
pop eax
call fcn.00481d18
cmp dword [ebp - 0x30], 0
je 0x4063a8
mov edx, dword [ebp - 0x30]
jmp 0x4063ae
lea edx, [esi + 0x112b]
push edx
call sub.KERNEL32.DLL_WinExec
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00481cc0
jmp 0x4069f1
mov dword [ebp - 0xdc], 0xc6
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea eax, [esi + 0x112c]
push eax
lea edx, [ebp - 0x724]
push edx
push SysReAllocStringLen
call fcn.0040756c
mov word [ebx + 0x10], 0x20
add esp, 0x14
lea edx, [esi + 0x1143]
lea eax, [ebp - 0x38]
call fcn.00481c08
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x34]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x3c]
inc dword [ebx + 0x1c]
pop edx
call fcn.00481d18
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x65c]
lea eax, [ebp - 0x40]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x40]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x44]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x44]
push edx
lea edx, [esi + 0x1145]
lea eax, [ebp - 0x48]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x4c], eax
lea edx, [ebp - 0x48]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x4c]
pop eax
call fcn.00481d18
lea eax, [ebp - 0x4c]
mov eax, dword [eax]
call fcn.004507b0
mov edi, eax
lea eax, [ebp - 0x4c]
and edi, 0xff
mov edx, 2
dec dword [ebx + 0x1c]
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00481cc0
test edi, edi
je 0x40676d
push 1
lea edx, [ebp - 0x594]
mov word [ebx + 0x10], 0x2c
lea eax, [ebp - 0x54]
call fcn.00481c08
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x54]
push ecx
lea edx, [esi + 0x114a]
lea eax, [ebp - 0x50]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x58]
inc dword [ebx + 0x1c]
pop edx
call fcn.00481d18
lea eax, [ebp - 0x58]
push eax
lea edx, [esi + 0x115e]
lea eax, [ebp - 0x5c]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x5c]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x60]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0x65c]
lea eax, [ebp - 0x64]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x68], eax
lea edx, [ebp - 0x64]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x68]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x68]
push edx
lea edx, [esi + 0x1160]
lea eax, [ebp - 0x6c]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x70], eax
lea edx, [ebp - 0x6c]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x70]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x70]
push edx
lea edx, [ebp - 0x65c]
lea eax, [ebp - 0x74]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x78], eax
lea edx, [ebp - 0x74]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x78]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x78]
push edx
lea edx, [esi + 0x116b]
lea eax, [ebp - 0x7c]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x80], eax
lea edx, [ebp - 0x7c]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x80]
pop eax
call fcn.00481d18
cmp dword [ebp - 0x80], 0
je 0x40668c
mov edx, dword [ebp - 0x80]
jmp 0x406692
lea edx, [esi + 0x1170]
push edx
call sub.KERNEL32.DLL_WinExec
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00481cc0
jmp 0x4069e7
push 1
lea edx, [ebp - 0x594]
mov word [ebx + 0x10], 0x38
lea eax, [ebp - 0x88]
call fcn.00481c08
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x88]
push ecx
lea edx, [esi + 0x1171]
lea eax, [ebp - 0x84]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
lea ecx, [ebp - 0x8c]
inc dword [ebx + 0x1c]
pop edx
call fcn.00481d18
lea eax, [ebp - 0x8c]
push eax
lea edx, [esi + 0x1185]
lea eax, [ebp - 0x90]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x94], eax
lea edx, [ebp - 0x90]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x94]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x94]
push edx
lea edx, [ebp - 0x65c]
lea eax, [ebp - 0x98]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0x98]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x9c]
pop eax
call fcn.00481d18
lea edx, [ebp - 0x9c]
push edx
lea edx, [esi + 0x1187]
lea eax, [ebp - 0xa0]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0xa4], eax
lea edx, [ebp - 0xa0]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0xa4]
pop eax
call fcn.00481d18
lea edx, [ebp - 0xa4]
push edx
lea edx, [ebp - 0x65c]
lea eax, [ebp - 0xa8]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0xac], eax
lea edx, [ebp - 0xa8]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0xac]
pop eax
call fcn.00481d18
lea edx, [ebp - 0xac]
push edx
lea edx, [esi + 0x1194]
lea eax, [ebp - 0xb0]
call fcn.00481c08
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0xb4], eax
lea edx, [ebp - 0xb0]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0xb4]
pop eax
call fcn.00481d18
cmp dword [ebp - 0xb4], 0
je 0x4068e4
mov edx, dword [ebp - 0xb4]
jmp 0x4068ea
lea edx, [esi + 0x1199]
push edx
call sub.KERNEL32.DLL_WinExec
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xb4]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xac]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xa4]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x98]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x90]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.00481cc0
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.00481cc0
mov eax, dword [ebx]
mov dword fs:[0], eax
jmp 0x4069fa
mov ecx, dword [ebx]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret