Function at 0x406ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40735f
cmp byte [edi], 0
je 0x40735f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40735f
cmp byte [esi], 0
je 0x40735f
mov ecx, 0x435f7c
mov eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407050
test dl, dl
je 0x40704c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407050
add eax, 2
add ecx, 2
test dl, dl
jne 0x407030
xor eax, eax
jmp 0x407055
sbb eax, eax
sbb eax, 0xffffffff
push ebx
test eax, eax
je 0x407351
lea ecx, [ebp - 8]
call fcn.00410680
lea ecx, [ebp - 0x18]
call fcn.00410680
push esi
lea ecx, [ebp - 0x10]
call fcn.00410900
push 0x2e
lea ecx, [ebp - 0x10]
call fcn.00410730
mov esi, eax
lea ecx, [ebp - 0x10]
cmp esi, 0xffffffff
je 0x40733c
push 0x436984
call fcn.00410690
sub eax, esi
dec eax
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00410f20
mov ecx, eax
call fcn.00403820
test eax, eax
lea ecx, [ebp - 0x20]
sete bl
call fcn.004108e0
test bl, bl
je 0x407194
lea ecx, [ebp - 0x20]
call fcn.00410680
lea ecx, [ebp - 0x28]
call fcn.00410680
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0040cf60
add esp, 8
test eax, eax
jge 0x4070f9
lea ecx, [ebp - 0x28]
call fcn.004108e0
lea ecx, [ebp - 0x20]
jmp 0x407334
push 0x4362c0
lea ecx, [ebp - 8]
call fcn.004109d0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 8]
call fcn.00410d90
push 0x436980
lea ecx, [ebp - 8]
call fcn.00410d30
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 8]
call fcn.00410d90
push 0x4362bc
lea ecx, [ebp - 8]
call fcn.00410d30
push 5
call fcn.00401000
mov ecx, eax
call fcn.00412e60
push eax
lea ecx, [ebp - 0x18]
call fcn.004109d0
push 0x4362bc
lea ecx, [ebp - 8]
call fcn.00410d30
push 0x4362c0
lea ecx, [ebp - 8]
call fcn.00410d30
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00410d90
push 0x436980
lea ecx, [ebp - 8]
call fcn.00410d30
lea ecx, [ebp - 0x28]
call fcn.004108e0
lea ecx, [ebp - 0x20]
call fcn.004108e0
jmp 0x407209
push 0x4362c0
lea ecx, [ebp - 8]
call fcn.004109d0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.00410d90
push 0x4362c0
lea ecx, [ebp - 8]
call fcn.00410d30
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0xe4]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00413440
mov ecx, eax
call fcn.00413690
mov ecx, eax
call fcn.004134d0
push eax
lea ecx, [ebp - 0x18]
call fcn.00410920
lea ecx, [ebp - 0x20]
call fcn.004108e0
lea ecx, [ebp - 0xe4]
call fcn.00413500
lea ecx, [ebp - 0xb4]
call fcn.00413500
push 0x4362bc
lea ecx, [ebp - 8]
call fcn.00410d30
push edi
lea ecx, [ebp - 8]
call fcn.00410d30
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x407241
cmp byte [esi], 0
je 0x407241
push 0x4362bc
lea ecx, [ebp - 8]
call fcn.00410d30
push esi
lea ecx, [ebp - 8]
call fcn.00410d30
push 0x44
lea ecx, [ebp - 0x84]
push 0
push ecx
call fcn.0041b530
xor eax, eax
mov edx, 1
add esp, 0xc
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x84], 0x44
mov dword [ebp - 0x58], 0x81
mov word [ebp - 0x54], dx
call fcn.00410680
mov bl, 0xff
lea eax, [ebp - 8]
cmp byte [ebp - 1], bl
jne 0x407291
mov eax, dword [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x30]
push str.Running_event___s__with_command_line:__s
push eax
call fcn.00411430
lea ecx, [ebp - 0x30]
push ecx
push 1
call fcn.0040d770
add esp, 0x18
lea ecx, [ebp - 0x18]
cmp byte [ebp - 0x11], bl
jne 0x4072ba
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 8]
cmp byte [ebp - 1], bl
jne 0x4072c5
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x84]
push edx
push ecx
mov ecx, dword [ebp + 0x14]
neg ecx
push 0
sbb ecx, ecx
and ecx, 0x20
add ecx, 0x20
push ecx
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x407331
mov edx, dword [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x3c]
push eax
call esi
lea ecx, [ebp - 0x30]
call fcn.004108e0
lea ecx, [ebp - 0x10]
call fcn.004108e0
lea ecx, [ebp - 0x18]
call fcn.004108e0
lea ecx, [ebp - 8]
call fcn.004108e0
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x30]
call fcn.004108e0
lea ecx, [ebp - 0x10]
call fcn.004108e0
lea ecx, [ebp - 0x18]
call fcn.004108e0
lea ecx, [ebp - 8]
call fcn.004108e0
pop ebx
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0x10