Function at 0x40d1f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6bc
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x63e
mov edi, edx
mov esi, ecx
lea edx, [ebp - 0x646]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x650], ebx
mov word [ebp - 0x648], cx
call fcn.00414930
add esp, 0xc
push 0x38
lea eax, [ebp - 0x690]
push ebx
push eax
call fcn.00414930
mov ecx, dword [ebp - 0x64c]
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x694], 0x3c
mov dword [ebp - 0x690], 0x40
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x674], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
cmp eax, ebx
je 0x40d2b5
lea edx, [ebp - 0x6b8]
push edx
call eax
movzx eax, word [ebp - 0x6b8]
cmp eax, ebx
je 0x40d374
cmp eax, 9
je 0x40d2d5
cmp byte [ebp - 0x651], bl
je 0x40d374
push str.Kernel32.dll
mov dword [ebp - 0x658], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x40d308
push str.Wow64DisableWow64FsRedirection
push esi
call edi
lea ecx, [ebp - 0x658]
push ecx
call eax
push esi
test eax, eax
jne 0x40d33c
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x648]
push 0x4235e8
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
lea eax, [ebp - 0x694]
push eax
jmp 0x40d37b
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x694]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x40d381
push str.Wow64RevertWow64FsRedirection
push esi
call edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40d381
lea ecx, [ebp - 0x694]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x65c]
imul eax, eax, 0x3e8
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x40d3e8
cmp eax, 0x102
mov eax, dword [ebp - 0x64c]
lea ecx, [ebp - 0x648]
push eax
je 0x40d3b7
push 0x423788
jmp 0x40d3bc
push 0x423728
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x65c]
lea eax, [ebp - 0x650]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x40d442
mov edx, dword [ebp - 0x64c]
push edx
lea eax, [ebp - 0x648]
push 0x423650
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x648]
add esp, 0xc
push ecx
call fcn.004033d0
mov eax, dword [ebp - 0x650]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x650]
mov eax, dword [ebp - 0x64c]
push edx
push eax
lea ecx, [ebp - 0x648]
push 0x4236e0
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
push edx
call fcn.004033d0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x650]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret