Function at 0x405eb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], edx
lea ebx, [ebp - 0x74]
xor eax, eax
push ebp
push 0x4061f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004026a8
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x41
mov word [ebp - 0x18], 5
cmp byte [0x409aa8], 0
je 0x405f9e
mov edx, 0x40620c
lea eax, [ebp - 0x78]
call fcn.00402ccc
lea eax, [ebp - 0x7c]
mov edx, dword [0x409494]
call fcn.00402d54
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.00402da4
lea eax, [ebp - 0x78]
mov edx, 0x40623c
call fcn.00402da4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
mov edx, dword [0x409a7c]
call fcn.00402d54
mov edx, dword [ebp - 0x7c]
pop eax
call fcn.00402da4
lea eax, [ebp - 0x78]
mov edx, 0x406248
call fcn.00402da4
mov eax, dword [ebp - 0x78]
call fcn.00402f10
mov esi, eax
call fcn.00405e88
test al, al
je 0x40603e
lea eax, [ebp - 0x78]
mov edx, esi
call fcn.00402d54
lea eax, [ebp - 0x78]
mov edx, 0x406264
call fcn.00402da4
mov eax, dword [ebp - 0x78]
call fcn.00402f10
mov esi, eax
jmp 0x40603e
lea eax, [ebp - 0x78]
mov edx, 0x4094e8
mov ecx, 0x80
call fcn.00402d84
lea eax, [ebp - 0x78]
mov edx, 0x406274
call fcn.00402da4
mov eax, dword [ebp - 0x78]
call fcn.00402f10
call fcn.00403e2c
test al, al
je 0x405fd5
mov esi, 0x406280
jmp 0x405fda
mov esi, 0x406298
lea eax, [ebp - 0x78]
mov edx, esi
call fcn.00402d54
lea eax, [ebp - 0x78]
mov edx, 0x4062b8
call fcn.00402da4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
mov edx, dword [0x409494]
call fcn.00402d54
mov edx, dword [ebp - 0x7c]
pop eax
call fcn.00402da4
lea eax, [ebp - 0x78]
mov edx, 0x40623c
call fcn.00402da4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
mov edx, dword [0x409a7c]
call fcn.00402d54
mov edx, dword [ebp - 0x7c]
pop eax
call fcn.00402da4
mov eax, dword [ebp - 0x78]
call fcn.00402f10
mov esi, eax
mov eax, dword [0x409494]
call fcn.004024c4
call fcn.00402488
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4060b3
jmp 0x406089
cmp dword [ebx + 4], 0x12
jne 0x40607d
mov eax, dword [ebx + 8]
call fcn.00403484
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40606f
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 4], 0x103
je 0x406089
jmp 0x4060c8
push 0x10
mov eax, dword [0x4081f8]
push eax
mov eax, dword [0x4081fc]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
cmp byte [0x409aa8], 0
je 0x4061ba
mov edx, 0x40620c
lea eax, [ebp - 0x78]
call fcn.00402ccc
lea eax, [ebp - 0x7c]
mov edx, dword [0x409494]
call fcn.00402d54
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.00402da4
lea eax, [ebp - 0x78]
mov edx, 0x40623c
call fcn.00402da4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
mov edx, dword [0x409a7c]
call fcn.00402d54
mov edx, dword [ebp - 0x7c]
pop eax
call fcn.00402da4
lea eax, [ebp - 0x78]
mov edx, 0x4062e8
call fcn.00402da4
mov eax, dword [ebp - 0x78]
call fcn.00402f10
mov esi, eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x90
push 0
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4061ba
jmp 0x406180
mov eax, dword [ebx + 4]
cmp eax, 0x12
je 0x40616c
cmp eax, 0x11
jne 0x406174
mov eax, dword [ebx + 8]
call fcn.00403484
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40615f
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 4], 0x103
je 0x406180
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x78]
mov edx, 0x409568
mov ecx, pe_nt_image_headers32
call fcn.00402d84
mov eax, dword [ebp - 0x78]
call fcn.004024c4
call fcn.00402488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061fb
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.00402c58
ret