Function at 0x616010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x78f4c8
call fcn.00405d90
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x7c1a4c
or ecx, 0xffffffff
mov bl, byte [eax + 2]
xor eax, eax
add esp, 4
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00419180
mov ecx, eax
call fcn.00418880
cmp ebx, 0x6e
ja case.0x616079.0
xor ecx, ecx
mov cl, byte [ebx + 0x6163f8]
jmp dword [ecx*4 + 0x616384]
push 4
jmp 0x6162cb
push 0x78f4ac
call fcn.00405d90
push 5
call fcn.00581bb0
add esp, 8
jmp 0x6162d3
push 0xf1
jmp 0x6162cb
push 0x108
jmp 0x6162cb
push 0x131
jmp 0x6162cb
push 0x1b6
call fcn.00581bb0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x76aed0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [ebp - 0x104]
push 2
push ecx
mov ecx, 0x7dabc0
call fcn.00509380
cmp eax, 0x7d
jne case.0x61612b.2
mov ecx, 0x814260
call fcn.00533740
mov eax, dword [0x81424c]
cmp eax, 3
ja case.default.0x61612b
jmp dword [eax*4 + 0x616468]
mov eax, dword [0x83e55c]
push 1
cmp eax, 1
push 0
push 0
jne 0x616196
push 0x51c
call fcn.00581bb0
mov edx, dword [0x83ec88]
add esp, 4
push eax
push 0x76b258
push edx
jmp 0x6161af
mov ecx, dword [0x83ec88]
push 1
push 0
push 0
push 0x78f0a0
push 0x76b258
push ecx
jmp 0x6161af
mov edx, dword [0x83ec88]
push 1
push 0
push 0
push 0x78f074
push 0x76b258
push edx
jmp 0x6161af
push 1
push 0
push 0
push 0x210
call fcn.00581bb0
add esp, 4
push eax
mov eax, dword [0x83ec88]
push 0x76b258
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [ebp - 0x104]
mov edi, 0x7c1a4c
jmp 0x6162db
push 0x1b7
jmp 0x6162cb
push 0x1b8
jmp 0x6162cb
push 0x211
jmp 0x6162cb
push 0x212
jmp 0x6162cb
push 0x23f
jmp 0x6162cb
push 0x240
jmp 0x6162cb
push 0x241
jmp 0x6162cb
push 0x242
jmp 0x6162cb
push 0x25e
jmp 0x6162cb
push 0x25f
jmp 0x6162cb
push 0x2a6
jmp 0x6162cb
push 0x463
jmp 0x6162cb
push 0x49a
jmp 0x6162cb
push 0x49b
jmp 0x6162cb
push 0x51d
jmp 0x6162cb
push 0x51e
jmp 0x6162cb
push 0x51f
jmp 0x6162cb
mov eax, dword [0x81424c]
test eax, eax
jne case.0x616079.25
push 9
push 0x595
call fcn.00581bb0
add esp, 4
lea ecx, [ebp - 0x1cc]
push eax
push ecx
call fcn.00711e28
lea edi, [ebp - 0x1cc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x62e
jmp 0x6162cb
push 0x62f
jmp 0x6162cb
push 0x635
jmp 0x6162cb
push 3
call fcn.00581bb0
add esp, 4
lea edx, [ebp - 0x104]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebx
je 0x616369
mov edx, dword [ebp + 8]
xor ecx, ecx
lea eax, [ebp - 0x104]
mov cl, byte [edx + 2]
push ecx
push eax
lea ecx, [ebp - 0x204]
push 0x78f344
push ecx
call fcn.00711e28
add esp, 0x10
lea edx, [ebp - 0x204]
mov ecx, 0x7dabc0
push 0x76aed0
push 0
push 1
push 1
push 0
push edx
call fcn.00509380
mov eax, dword [ebp - 4]
mov dword [0x8142c0], 0
mov dword [eax + 0xc], 3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov dword [0x8142c0], 0
mov dword [ecx + 0xc], 3
mov esp, ebp
pop ebp
ret 4