Function at 0x65b688
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 9
push 0
push 0
dec ecx
jne 0x65b691
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x65bc81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x65bc98
call fcn.00405094
jne 0x65b934
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
add eax, 0x220
mov edx, 0x65bc98
call fcn.00404cec
push 1
push 0x65bcb4
push 0x65bcb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x220]
call fcn.00405148
push eax
push 0x65bcb8
mov eax, dword [ebp - 4]
call fcn.00455b70
push eax
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x20
ja case.0x65b727.0
mov al, byte [eax + 0x65b72e]
jmp dword [eax*4 + 0x65b74f]
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bcc0
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bcf4
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bd18
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bd3c
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bd58
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bd94
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bdc8
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65be28
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65be44
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65be90
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bec4
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bf00
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x30
push 0x65bcb4
push 0x65bf38
push 0
call sub.user32.dll_MessageBoxExA
jmp case.0x65b727.0
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov byte [ebp - 0x19], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x21], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x1d], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404d30
mov eax, dword [ebp - 4]
add eax, 0x360
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x65bf54
call fcn.0040528c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004051a8
mov edx, dword [ebp - 0xc]
mov eax, 0x65bf54
call fcn.0040528c
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004051e8
mov eax, dword [ebp - 4]
add eax, 0x358
mov edx, dword [ebp - 0xc]
call fcn.00404cec
mov eax, dword [ebp - 4]
add eax, 0x35c
mov edx, dword [ebp - 0xc]
call fcn.00404cec
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
mov edx, 0x65bf60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.00448eac
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 0x35c
call fcn.00404cec
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
mov edx, 0x65bf70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.00448eac
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
add eax, 0x35c
call fcn.00404cec
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x35c]
mov eax, 0x65bf80
call fcn.0040528c
test eax, eax
jle 0x65ba64
mov eax, dword [ebp - 4]
add eax, 0x35c
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x35c]
mov eax, 0x65bf80
call fcn.0040528c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.004051a8
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.00409540
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
add eax, 0x35c
call fcn.00404cec
mov eax, dword [ebp - 4]
cmp dword [eax + 0x35c], 0
je 0x65bb5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, 0x65bf8c
call fcn.00405094
je 0x65bb5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
mov al, byte [eax]
call fcn.0048c288
test al, al
jne 0x65bafd
mov eax, dword [ebp - 4]
add eax, 0x35c
push eax
mov edx, dword [0x6ebc58]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
call fcn.0040528c
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00404f50
add eax, 7
add ebx, eax
mov edx, ebx
mov eax, dword [0x6ebc58]
mov eax, dword [eax]
mov ecx, 2
call fcn.004051a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x35c]
mov eax, 0x65bf80
call fcn.0040528c
test eax, eax
jle 0x65bb3d
lea eax, [ebp - 0x38]
push eax
xor ecx, ecx
mov edx, 0x65bf80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.00448eac
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
add eax, 0x35c
call fcn.00404cec
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.00409540
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
add eax, 0x35c
call fcn.00404cec
lea eax, [ebp - 0x40]
push eax
xor ecx, ecx
mov edx, 0x65bf70
mov eax, dword [ebp - 0xc]
call fcn.00448eac
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0xc]
call fcn.00404d30
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0xc]
call fcn.00409540
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0xc]
call fcn.00404d30
mov eax, dword [ebp - 4]
add eax, 0x358
mov edx, dword [ebp - 0xc]
call fcn.00404cec
lea eax, [ebp - 0x14]
push eax
mov edx, dword [0x6ec4bc]
mov edx, dword [edx]
lea eax, [ebp - 0x48]
mov ecx, 0x65bf9c
call fcn.00404f9c
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00499468
test al, al
je case.0x65b727.0
mov eax, dword [0x6ebf44]
push eax
mov al, byte [ebp - 0x19]
push eax
lea eax, [ebp - 0x21]
push eax
mov eax, dword [0x6ec3d4]
push eax
mov edx, dword [0x6ec4bc]
mov edx, dword [edx]
lea eax, [ebp - 0x4c]
mov ecx, 0x65bf9c
call fcn.00404f9c
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0049a70c
test al, al
je case.0x65b727.0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x334], 0
jne 0x65bc2d
mov dl, 1
mov eax, dword [0x42726c]
call fcn.0042d8dc
mov edx, dword [ebp - 4]
mov dword [edx + 0x334], eax
mov edx, dword [0x6ec3d4]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.0042eb10
mov eax, dword [ebp - 4]
mov byte [eax + 0x355], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov edx, dword [eax]
call dword [edx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65bc88
lea eax, [ebp - 0x4c]
mov edx, 9
call fcn.00404cbc
lea eax, [ebp - 0xc]
call fcn.00404c98
ret