Function at 0x40e029
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4235d9
call fcn.00415c8c
sub esp, 0x140
mov eax, dword [0x4301c4]
push ebx
push ebp
push esi
push edi
or eax, 0x132
xor edi, edi
inc eax
mov ecx, 0x2e3
cmove eax, ecx
push 0x10
mov dword [0x4301c4], eax
lea eax, [esp + 0x7c]
push edi
push eax
mov dword [esp + 0x20], edi
call fcn.00415370
push 0x44
pop esi
push esi
lea eax, [esp + 0x11c]
push edi
push eax
call fcn.00415370
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x124], esi
mov esi, dword [esp + 0x17c]
add esp, 0x18
mov eax, dword [esi]
mov dword [esp + 0x10], 0x20
mov eax, dword [eax]
and eax, 0xf000
cmp eax, 0x2000
je 0x40e0c7
cmp eax, 0x8000
jne 0x40e16c
mov dword [esp + 0x10], 0x80
jmp 0x40e16c
mov edx, dword [0x4301c4]
push 0x4d
pop eax
cmp edx, eax
cmove edx, eax
shl edx, 0x18
or edx, 1
mov eax, 0x320
cmp edx, eax
cmove edx, eax
mov dword [esp + 0x10], 0x40
mov dword [0x4301c4], edx
test edx, edx
jne 0x40e100
push edi
call ebx
mov edx, dword [0x4301c4]
mov eax, 0x11d
cmp edx, eax
cmove edx, eax
mov eax, dword [0x4301c0]
mov ecx, eax
not ecx
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
mov dword [0x4301c4], edx
mov dword [0x4301c0], eax
test edx, edx
jne 0x40e160
push 0x32c
mov eax, 0x4317ec
push eax
push eax
push edi
call ebp
mov edx, dword [0x4301c4]
test edx, edx
jne 0x40e160
push 0x363
mov eax, 0x4317f0
push eax
push eax
push edi
call ebp
mov edx, dword [0x4301c4]
or edx, 0x389
mov dword [0x4301c4], edx
call fcn.0040e726
lea edi, [esi + 0x1c]
push edi
mov dword [esi + 0x10], eax
lea eax, [esp + 0x64]
push 0x4317f8
push eax
mov dword [esi + 0x14], edx
call fcn.0040af41
and dword [esp + 0x164], 0
push 0x4317f4
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0040aefa
mov ecx, eax
mov byte [esp + 0x170], 1
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [esp + 0xfc]
push eax
call fcn.0040aeb9
add esp, 0x24
mov byte [esp + 0x158], 3
lea ecx, [esp + 0x48]
call fcn.00401530
mov byte [esp + 0x158], 4
lea ecx, [esp + 0x60]
call fcn.00401530
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0040b2ba
mov byte [esp + 0x160], 5
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0040b2ba
add esp, 0x10
mov byte [esp + 0x158], 6
cmp dword [edi + 0x14], 0x10
jb 0x40e21d
mov eax, dword [edi]
jmp 0x40e21f
mov eax, edi
push 0
push eax
call fcn.004129fc
pop ecx
pop ecx
test al, al
jne 0x40e414
push dword [0x430228]
cmp dword [0x43022c], 0x10
mov eax, 0x430218
cmovae eax, dword [0x430218]
push 0
push eax
mov ecx, edi
call fcn.0040e6be
cmp eax, 0xffffffff
jne 0x40e414
lea eax, [esp + 0x88]
push str.PATH
push eax
call fcn.00413240
mov byte [esp + 0x160], 7
push 1
push 0x3b
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00414491
add esp, 0x18
mov byte [esp + 0x158], 9
lea ecx, [esp + 0x88]
call fcn.00401530
mov edx, dword [0x4301c4]
shl edx, 0x1d
or edx, 0x102d7
mov dword [0x4301c4], edx
jne 0x40e2ca
push 0x2d7
mov eax, 0x431804
push eax
push eax
push 0
call ebp
mov edx, dword [0x4301c4]
mov eax, dword [0x4301c0]
mov ecx, eax
not ecx
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
mov ecx, eax
not ecx
and ecx, 0x3b9
or edx, 0x16b
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
mov dword [0x4301c4], edx
mov dword [0x4301c0], eax
test edx, edx
jne 0x40e30f
push edx
call ebx
lea eax, [esp + 0x48]
push str.SYSTEMROOT
push eax
call fcn.00413240
mov byte [esp + 0x160], 0xa
cmp dword [esp + 0x64], 0x10
lea eax, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
push eax
lea eax, [esp + 0x94]
push str._sSYSTEM32
push eax
call fcn.0040813e
add esp, 0x14
mov byte [esp + 0x158], 0xb
push eax
lea ecx, [esp + 0x64]
call fcn.0040eaf9
mov byte [esp + 0x158], 0xa
lea ecx, [esp + 0x88]
call fcn.00401530
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x64]
call fcn.0040eb66
cmp dword [edi + 0x14], 0x10
jb 0x40e386
mov edi, dword [edi]
lea eax, [esp + 0x60]
push eax
push 0
lea eax, [esp + 0xfc]
push edi
push eax
call fcn.00413b92
mov byte [esp + 0x168], 0xc
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.0040b2ba
add esp, 0x18
mov byte [esp + 0x158], 0xd
push eax
lea ecx, [esp + 0x1c]
call fcn.0040b59e
mov byte [esp + 0x158], 0xc
push 0
push 1
lea ecx, [esp + 0x90]
call fcn.00401a93
mov byte [esp + 0x158], 0xa
lea ecx, [esp + 0xf4]
call fcn.00401530
mov byte [esp + 0x158], 9
lea ecx, [esp + 0x48]
call fcn.00401530
mov byte [esp + 0x158], 6
lea ecx, [esp + 0x60]
call fcn.0040c73e
mov eax, dword [esi]
test dword [eax], 0x600
je 0x40e5fe
call fcn.00413968
test al, al
jne 0x40e5fe
mov edx, dword [0x4301c4]
mov eax, 0x373
cmp edx, eax
cmove edx, eax
shl edx, 0x1b
or edx, 1
mov dword [0x4301c4], edx
jne 0x40e457
push 0
call ebx
mov edx, dword [0x4301c4]
mov eax, dword [0x4301c0]
mov ecx, eax
not ecx
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
shl edx, 6
or edx, 0x13f
mov dword [0x4301c0], eax
mov dword [0x4301c4], edx
jne 0x40e4ad
push 0x2e0
mov eax, 0x431820
push eax
push eax
push 0
call ebp
mov edx, dword [0x4301c4]
xor ebp, ebp
test edx, edx
jne 0x40e4af
push ebp
call ebx
mov edx, dword [0x4301c4]
jmp 0x40e4af
xor ebp, ebp
push 0x3c
pop edi
inc edx
mov eax, 0x3df
cmove edx, eax
push edi
lea eax, [esp + 0xa4]
or edx, 0xb8
push ebp
push eax
mov dword [0x4301c4], edx
call fcn.00415370
mov edx, dword [0x4301c0]
mov eax, edx
not eax
and eax, 0x3b9
add esp, 0xc
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov dword [esp + 0xa0], edi
mov edi, dword [0x4301c4]
mov eax, 0x120
cmp edi, eax
cmove edi, eax
mov eax, edx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
shl edi, 0x19
mov ecx, edx
not ecx
and ecx, 0x3b9
or edi, 1
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
cmp dword [esp + 0x2c], 8
mov dword [0x4301c0], eax
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
cmp dword [esp + 0x44], 8
mov dword [esp + 0xb0], eax
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
mov dword [esp + 0xa4], 0x4140
mov dword [0x4301c4], edi
mov dword [esp + 0xac], 0x431824
mov dword [esp + 0xb4], eax
test edi, edi
jne 0x40e5a5
push ebp
call ebx
mov edi, dword [0x4301c4]
test edi, edi
jne 0x40e5a5
push ebp
call ebx
mov edi, dword [0x4301c4]
lea eax, [esp + 0xa0]
or edi, 0x166
push eax
mov dword [0x4301c4], edi
mov dword [esp + 0xc0], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e5f2
cmp dword [esp + 0xc0], 0x20
jbe 0x40e5f2
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40e5e9
push ebp
push dword [esp + 0xdc]
jmp 0x40e661
mov eax, dword [esp + 0xd8]
jmp 0x40e650
mov eax, dword [esi]
test dword [eax], 0x400
jne 0x40e66a
jmp 0x40e600
xor ebp, ebp
cmp dword [esp + 0x44], 8
lea edx, [esp + 0x78]
push edx
lea edx, [esp + 0x110]
push edx
push ebp
push ebp
push dword [esp + 0x20]
lea ecx, [esp + 0x44]
cmovae ecx, dword [esp + 0x44]
cmp dword [esp + 0x40], 8
push ebp
push ebp
push ebp
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40e655
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40e64c
push ebp
push dword [esp + 0x7c]
jmp 0x40e661
mov eax, dword [esp + 0x78]
mov dword [esi + 8], eax
jmp 0x40e66a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esp + 0x18], eax
push ebp
push esi
call fcn.0040cf2c
add esp, 0xc
mov byte [esp + 0x158], 5
push ebp
push 1
lea ecx, [esp + 0x38]
call fcn.00401a93
mov byte [esp + 0x158], 4
push ebp
push 1
lea ecx, [esp + 0x20]
call fcn.00401a93
or dword [esp + 0x158], 0xffffffff
lea ecx, [esp + 0xdc]
call fcn.00401530
mov ecx, dword [esp + 0x150]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret