Function at 0x4036a0
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov eax, dword [0x427650]
sub esp, 0xc
test eax, eax
push edi
jne 0x403a19
mov eax, dword [0x427248]
mov edi, dword [0x427244]
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 4], edi
jbe 0x403a19
push ebx
push ebp
push esi
jmp 0x4036d9
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x16]
mov eax, dword [esp + 0x24]
mov esi, ecx
shr esi, 0x1b
and esi, 1
mov dword [esp + 0x18], esi
je 0x4036f9
cmp eax, 1
je 0x4039f3
jmp 0x403702
cmp eax, 2
je 0x4039f3
mov eax, dword [esp + 0x20]
mov edx, ecx
and edx, 0x7000000
cmp edx, eax
jne 0x4039f3
cmp eax, 0x3000000
ja 0x40375a
je 0x403765
cmp eax, 0x1000000
je 0x40372d
cmp eax, 0x2000000
jne 0x40377a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40374c
mov eax, dword [0x427654]
test eax, eax
je 0x40377a
test ecx, 0x80000000
jne 0x4039f3
jmp 0x40377a
test ecx, 0x80000000
je 0x4039f3
jmp 0x40377a
cmp eax, 0x4000000
jne 0x40377a
test esi, esi
jne 0x40377a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40377a
mov eax, dword [0x427654]
test eax, eax
jne 0x4039f3
test ecx, 0x40000000
je 0x403826
xor eax, eax
test esi, esi
setne al
add eax, 0x21
push eax
push 7
call fcn.00403580
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x403826
cmp byte [ebp], 0
je 0x403826
push 0
push edi
call fcn.00403a20
mov ebx, eax
push 0x5c
push ebx
call fcn.00418b20
add esp, 0x10
test eax, eax
je 0x4037c7
lea ebx, [eax + 1]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call fcn.00418c70
mov esi, eax
add esp, 4
test esi, esi
je 0x40381e
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x24
push esi
call fcn.00403540
xor ecx, ecx
cmp eax, 6
sete cl
push esi
mov edi, ecx
call fcn.00418dd3
add esp, 0x18
test edi, edi
je 0x4039ef
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
push edi
call fcn.0040d100
add esp, 4
test esi, esi
je 0x40389c
mov edx, dword [0x4271bc]
push 0
push edx
call fcn.00401040
add esp, 8
cmp eax, 0xffffffff
je 0x4039f3
push eax
call fcn.004012c0
mov eax, dword [0x4271bc]
push 0x2e
push eax
call fcn.00418b20
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40386f
mov esi, dword [0x4220a4]
mov ecx, dword [0x4271b8]
mov edx, dword [0x4271bc]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov eax, dword [0x4271b8]
push esi
push eax
call fcn.00402640
add esp, 8
jmp 0x4039f3
mov ecx, dword [0x427648]
push ecx
call fcn.00402090
mov edx, dword [0x427648]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov eax, dword [0x427648]
push eax
call fcn.00402040
mov ecx, dword [0x4271b8]
mov edx, dword [0x4271bc]
add esp, 4
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
push 8
push edi
call fcn.00403a20
mov ebp, eax
add esp, 8
mov ebx, ebp
cmp byte [ebp], 0
je 0x403917
push 0xffdc
push ebp
push 0
call fcn.0040bd90
lea esi, [eax + 1]
push esi
call fcn.00418c70
mov ebx, eax
push esi
push ebp
push ebx
call fcn.0040bd90
add esp, 0x1c
test dword [edi + 0x16], 0x10000000
je 0x403972
mov eax, dword [0x4271b8]
push 1
push ebx
push eax
call fcn.00402b30
mov eax, dword [edi + 0x16]
add esp, 0xc
test eax, 0x20000000
je 0x4039e0
mov ecx, dword [0x4271b8]
push ecx
call fcn.004190a0
add esp, 4
test eax, eax
je 0x4039e0
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [0x4271b8]
push edx
call fcn.004190a0
add esp, 4
jmp 0x4039e0
cmp byte [ebx], 0x30
je 0x4039d2
mov edi, 0x4222f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x4271b8]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x4271b8]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov eax, dword [0x4271b8]
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
cmp ebx, ebp
je 0x4039f3
push ebx
call fcn.00418dd3
add esp, 4
jmp 0x4039f3
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push edi
inc esi
mov dword [esp + 0x18], esi
call fcn.00403690
mov dword [esp + 0x14], eax
mov eax, dword [0x427248]
add esp, 4
cmp esi, eax
jb 0x4036d5
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret