Function at 0x40c158
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x40c160
push ecx
push ebx
push esi
push edi
mov eax, 0x40b854
call fcn.0040643c
xor eax, eax
push ebp
push 0x40c435
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40b8bc
call fcn.00404300
mov edx, dword [0x40d9d8]
mov eax, 0x40c448
call fcn.00404c34
mov ebx, eax
test ebx, ebx
jne 0x40c1a8
mov ebx, 0x201
push 0x40d9d8
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [0x40d9d8]
call fcn.00404be8
mov edx, dword [0x40d9dc]
mov eax, 0x40c450
call fcn.00404c34
mov ebx, eax
test ebx, ebx
jne 0x40c1da
mov ebx, 0x401
push 0x40d9dc
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [0x40d9dc]
call fcn.00404be8
xor eax, eax
push ebp
push 0x40c22b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004031ac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004079f4
mov edx, dword [ebp - 0x14]
mov eax, 0x40d9e4
call fcn.00404f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c23f
mov eax, 0x412d8c
xor ecx, ecx
mov edx, 0x44
call fcn.004032d4
mov dword [0x412d8c], 0x44
mov dword [0x412db8], 1
mov word [0x412dbc], 5
mov eax, dword [0x40d9dc]
xor edx, edx
call fcn.00404be0
je 0x40c290
mov eax, 0x40d9e0
mov ecx, dword [0x40d9dc]
mov edx, 0x40c458
call fcn.00404a98
call fcn.0040314c
test eax, eax
jle 0x40c2fa
call fcn.0040314c
mov esi, eax
test esi, esi
jle 0x40c2fa
mov ebx, 1
lea eax, [ebp - 0x24]
mov ecx, 0x40c460
mov edx, dword [0x40d9e0]
call fcn.00404a98
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00404f10
push dword [ebp - 0x20]
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004031ac
push dword [ebp - 0x28]
push 0x40c474
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004050b0
mov edx, dword [ebp - 0x1c]
mov eax, 0x40d9e0
call fcn.00404f24
inc ebx
dec esi
jne 0x40c2a9
lea eax, [ebp - 0x30]
mov ecx, dword [0x40d9d8]
mov edx, dword [0x40d9e4]
call fcn.00404a98
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.00404f10
mov eax, dword [ebp - 0x2c]
call fcn.004078d0
test al, al
jne 0x40c35e
push 0x10
push 0x40c478
push 0x40c488
push dword [0x40d9d8]
push 0x40c4b0
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404b14
mov eax, dword [ebp - 0x34]
call fcn.00404a88
push eax
push 0
call sub.user32.dll_MessageBoxW
jmp 0x40c3e8
xor eax, eax
push ebp
push 0x40c3de
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x412dd0
push 0x412d8c
lea eax, [ebp - 0x38]
call fcn.00407ae4
mov eax, dword [ebp - 0x38]
call fcn.00404d7c
push eax
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
push eax
push 0
push 0
push 0
push 0x40c4bc
push dword [0x40d9e4]
push dword [0x40d9d8]
push 0x40c4bc
push dword [0x40d9e0]
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00404b14
mov eax, dword [ebp - 0x3c]
call fcn.00404a88
push eax
push 0
call sub.kernel32.dll_CreateProcessW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c43c
lea eax, [ebp - 0x3c]
call fcn.004048f8
lea eax, [ebp - 0x38]
call fcn.00404ce0
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404ce8
lea eax, [ebp - 0x24]
call fcn.004048f8
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404ce8
ret