Function at 0x4096d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x524
push ebp
mov ebp, ecx
push esi
push edi
lea edi, [ebp + 4]
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov eax, dword [edi + 4]
cmp eax, esi
je 0x409712
push 0xffffffffffffffff
push 0
push edi
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x40970b
inc word [edi + 8]
mov dword [edi + 4], esi
jmp 0x409720
cmp eax, 0x80
jne 0x409718
inc word [edi + 8]
jmp 0x409720
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp + 0x40]
mov ecx, dword [esp + 0x534]
xor esi, esi
test eax, ecx
mov dword [esp + 0x10], esi
je 0x409916
xor ecx, ecx
xor edi, edi
lea edx, [ebp + 0xb4]
push ebx
mov ebx, dword [esp + 0x544]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edx
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x538]
test ecx, eax
je 0x4098e6
test dword [ebp + 0x40], eax
je 0x40978b
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
mov edx, 4
mov dword [ecx], eax
add eax, 0xc
add ecx, 4
dec edx
jne 0x40977e
jmp 0x4097b2
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4097b2
test dword [edx + 0x40], eax
je 0x4097b2
lea eax, [edi + edx + 0xb4]
lea ecx, [esp + 0x24]
mov edx, 4
mov dword [ecx], eax
add eax, 0xc
add ecx, 4
dec edx
jne 0x4097a7
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.00416c50
test eax, eax
jne 0x409836
mov eax, dword [esi]
test eax, eax
jne 0x4097cc
mov eax, 0x41eae8
mov edx, dword [esp + 0x540]
mov ecx, dword [esp + 0x53c]
push ebx
push edx
mov edx, dword [esp + 0x1c]
add edx, ecx
mov ecx, ebp
push edx
push eax
call fcn.00409940
cmp eax, 0xffffffff
je 0x409836
mov edi, 0x41d474
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x53c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x53c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x18]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.00416c50
test eax, eax
jne 0x40985e
mov eax, dword [esi]
test eax, eax
jne 0x409850
mov eax, 0x41eae8
push 0x20001
push 0
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.00416c50
test eax, eax
jne 0x4098e6
mov byte [esp + 0x134], al
mov eax, dword [esi]
test eax, eax
jne 0x40987f
mov eax, 0x41eae8
mov ecx, dword [esp + 0x540]
push ebx
lea edx, [esp + 0x38]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00409940
mov esi, dword [esp + 0x30]
mov ecx, esi
call fcn.00416c50
test eax, eax
jne 0x4098c8
mov eax, dword [esi]
test eax, eax
jne 0x4098af
mov eax, 0x41eae8
mov ecx, dword [esp + 0x540]
push ebx
lea edx, [esp + 0x138]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00409940
push 5
lea eax, [esp + 0x138]
push 0
lea ecx, [esp + 0x3c]
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edi, 0x30
inc ecx
add edx, 0x30
cmp edi, 0x1e0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edx
jl 0x409756
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
pop ebx
dec word [edi + 8]
cmp word [edi + 8], 0
jne 0x409931
mov edx, dword [edi]
mov dword [edi + 4], 0
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x524
ret 0x10