Function at 0x40a710
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x45a8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4747c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x30], 1
call fcn.0042263d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a759
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x30], 2
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x1c]
push 0x462dc0
push edx
call fcn.00401360
add esp, 0xc
call fcn.0042263d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a79f
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x30], 3
cmp dword [esp + 0x44], 0
lea ebx, [esp + 0x44]
jne 0x40a7d0
push 0x10
call fcn.0041ac20
add esp, 4
mov byte [esp + 0x30], 4
jmp 0x40a7df
push 0x19
call fcn.0041ac20
add esp, 4
mov byte [esp + 0x30], 5
push eax
lea ecx, [esp + 0x18]
call fcn.0040c110
mov byte [esp + 0x30], 3
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a80e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.0040b9b0
mov byte [esp + 0x40], 6
mov edi, dword [esp + 0x24]
add esp, 8
add edi, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push edi
mov dword [esp + 0x2c], edi
call fcn.0040c3d0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x38], 3
call fcn.0041bf60
add esp, 8
test eax, eax
je 0x40aa2d
cmp dword [esp + 0x40], 0
je 0x40aa2d
call fcn.0042263d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a886
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0x30], 7
call fcn.0042263d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a8b5
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
push 0x1a
lea ebx, [esp + 0x20]
mov byte [esp + 0x34], 8
call fcn.0041ac20
add esp, 4
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x34], 9
call fcn.0040c110
mov byte [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a90c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x29
push 0x462ae8
lea ecx, [esp + 0x4c]
call fcn.0040c440
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x44]
push ecx
push ebp
lea edx, [esp + 0x48]
push 0x462db4
push edx
call fcn.00401360
add esp, 0x10
call fcn.0041bf00
mov ebx, dword [esp + 0x40]
test eax, eax
je 0x40a994
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.0040b9b0
mov eax, dword [eax]
add esp, 0xc
push 1
push 0
push 0
push eax
push 0x462dd0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a9eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40a9eb
push ecx
lea eax, [ebx - 0x10]
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.0040c3d0
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x2c], esp
mov esi, esp
push eax
mov byte [esp + 0x3c], 0xa
call fcn.0040c3d0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x38], 8
call fcn.0041bf60
add esp, 8
test eax, eax
je 0x40a9eb
mov ecx, dword [esp + 0x38]
push 0
push ebx
xor edi, edi
call fcn.00419b80
mov edi, dword [esp + 0x28]
add esp, 8
lea eax, [ebx - 0x10]
mov byte [esp + 0x30], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x30], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa4b
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aabd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10