Function at 0x4086e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x164
mov eax, dword [0x4772c4]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x174]
push edi
mov ecx, esi
xor edi, edi
call fcn.00407ef0
test eax, eax
jbe 0x4089af
xor ebx, ebx
jmp 0x408720
cmp dword [0x47880c], 0
mov eax, dword [esi + 4]
jne 0x40883b
test eax, eax
je 0x408750
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408755
call fcn.004402b5
mov eax, dword [esi + 4]
test eax, eax
lea ecx, [ebx + eax]
mov dword [esp + 0x24], ecx
je 0x40877f
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408784
call fcn.004402b5
mov eax, dword [esi + 4]
mov ebp, 0x10
cmp dword [ebx + eax + 0x50], ebp
jb 0x40879c
mov edx, dword [ebx + eax + 0x3c]
mov dword [esp + 0x10], edx
jmp 0x4087a4
lea ecx, [ebx + eax + 0x3c]
mov dword [esp + 0x10], ecx
test eax, eax
je 0x4087c4
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4087c9
call fcn.004402b5
mov eax, dword [esi + 4]
cmp dword [ebx + eax + 0x34], ebp
jb 0x4087d8
mov ebp, dword [ebx + eax + 0x20]
jmp 0x4087dc
lea ebp, [ebx + eax + 0x20]
test eax, eax
je 0x4087fc
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408801
call fcn.004402b5
mov eax, dword [esi + 4]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x408811
mov eax, dword [eax + 4]
jmp 0x408814
add eax, 4
mov edx, dword [esp + 0x24]
movzx ecx, byte [edx + 0x70]
mov edx, dword [esp + 0x10]
push ecx
push edx
push ebp
push eax
call fcn.0042d560
add esp, 0x10
test al, al
jne 0x40891f
xor al, al
jmp 0x4089b1
test eax, eax
je 0x40885b
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408860
call fcn.004402b5
mov eax, dword [esi + 4]
cmp dword [eax + ebx + 0x50], 0x10
lea eax, [eax + ebx + 0x38]
jb 0x408873
mov eax, dword [eax + 4]
jmp 0x408876
add eax, 4
push str._install
push eax
lea ecx, [esp + 0x74]
push str._s__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.004063b0
test eax, eax
je 0x40891f
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call fcn.00440530
add esp, 0xc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push edx
push 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x408834
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call ebp
call fcn.004063d0
mov eax, dword [esi + 4]
test eax, eax
je 0x408942
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408947
call fcn.004402b5
mov eax, dword [esi + 4]
cmp byte [ebx + eax + 0x70], 0
je 0x40899a
test eax, eax
je 0x408971
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408976
call fcn.004402b5
mov eax, dword [esi + 4]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x408986
mov eax, dword [eax + 4]
jmp 0x408989
add eax, 4
push eax
call fcn.0042d5d0
add esp, 4
test al, al
je 0x408834
mov ecx, esi
add edi, 1
add ebx, 0x74
call fcn.00407ef0
cmp edi, eax
jb 0x408720
mov al, 1
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044017c
add esp, 0x164
ret 4