Function at 0x420858
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x420860
push ecx
push ebx
xor eax, eax
push ebp
push 0x420f2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x420f44
call fcn.0040488c
call fcn.004030f4
call fcn.0041b658
test al, al
je 0x420edf
lea eax, [ebp - 0x24]
call fcn.0041a8f8
cmp dword [ebp - 0x24], 0
je 0x420edf
lea eax, [ebp - 0x28]
call fcn.0041a97c
cmp dword [ebp - 0x28], 0
je 0x420edf
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x420f6c
call fcn.0040488c
call fcn.004030f4
mov bl, 1
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x420f94
call fcn.0041a1a0
call fcn.0041ab74
test al, al
je 0x42091b
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x420fa0
call fcn.0041a1a0
jmp 0x42092a
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x420fac
call fcn.0041a1a0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.0041afbc
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004044bc
mov eax, dword [ebp - 0x34]
mov edx, 0x420fb8
pop ecx
call fcn.0040c9c4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00404264
call fcn.0041aa94
test al, al
je 0x42099d
mov eax, dword [0x425e00]
cmp dword [eax], 1
je 0x42099d
lea eax, [ebp - 0x38]
call fcn.00419e04
mov eax, dword [ebp - 0x38]
push eax
call fcn.0041a020
push eax
lea eax, [ebp - 0x3c]
call fcn.00419f2c
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0040c324
mov ebx, eax
test bl, bl
je 0x420edf
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x420fcc
call fcn.0040488c
call fcn.004030f4
mov eax, 2
call fcn.0041b700
mov edx, 1
mov eax, 0x29
call fcn.0041b768
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
call fcn.0041a97c
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
call fcn.0041a8f8
mov eax, dword [ebp - 0x44]
mov cl, 2
pop edx
call fcn.0041fee4
mov ebx, eax
mov edx, 2
mov eax, 0x29
call fcn.0041b768
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x420ff4
call fcn.0041a1a0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
call fcn.0041afbc
mov ecx, dword [ebp - 0x4c]
mov edx, 0x420fb8
mov eax, dword [ebp - 8]
call fcn.0040c9c4
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 8]
call fcn.00404264
test bl, bl
je 0x420a8a
call fcn.0041ab74
test al, al
je 0x420a8a
mov eax, dword [0x425e00]
cmp dword [eax], 1
je 0x420a8a
lea eax, [ebp - 0x50]
call fcn.00419e04
mov eax, dword [ebp - 0x50]
push eax
call fcn.0041a020
push eax
lea eax, [ebp - 0x54]
call fcn.00419f2c
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0040c324
mov ebx, eax
test bl, bl
je 0x420edf
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x421000
call fcn.0040488c
call fcn.004030f4
lea eax, [ebp - 0x58]
call fcn.00419c00
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
call fcn.00419b84
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
call fcn.00419b08
mov eax, dword [ebp - 0x60]
pop edx
pop ecx
call fcn.00416b84
xor ebx, ebx
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
call fcn.0041af3c
mov eax, dword [ebp - 0x64]
mov cl, 1
mov edx, 0x421028
call fcn.004171c0
mov eax, dword [ebp - 0x18]
call fcn.0041d678
test al, al
je 0x420b0e
mov ebx, 1
lea eax, [ebp - 0x68]
call fcn.0041ad24
mov eax, dword [ebp - 0x68]
mov edx, 0x421034
call fcn.004045bc
jne 0x420b95
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x421050
call fcn.0041a1a0
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x18]
call fcn.0040733c
mov ecx, dword [ebp - 0x70]
mov edx, 0x420fb8
mov eax, dword [ebp - 8]
call fcn.0040c9c4
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 8]
call fcn.00404264
jmp 0x420b89
lea eax, [ebp - 0x74]
call fcn.00419e04
mov eax, dword [ebp - 0x74]
push eax
call fcn.0041a020
push eax
push 0
lea eax, [ebp - 0x78]
call fcn.00419fa4
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0040c290
mov eax, dword [ebp - 0x18]
call fcn.0041d678
test al, al
jne 0x420b60
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x42105c
call fcn.0040488c
call fcn.004030f4
lea eax, [ebp - 0x7c]
call fcn.0041ad24
mov eax, dword [ebp - 0x7c]
mov edx, 0x421084
call fcn.004045bc
jne 0x420bd8
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.0041da68
lea eax, [ebp - 0x80]
call fcn.0041ad24
mov eax, dword [ebp - 0x80]
mov edx, 0x42109c
call fcn.004045bc
jne 0x420bf9
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.0041dac4
lea eax, [ebp - 0x84]
call fcn.0041ad24
mov eax, dword [ebp - 0x84]
mov edx, 0x4210b4
call fcn.004045bc
jne 0x420c20
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.0041db20
lea eax, [ebp - 0x88]
call fcn.0041ad24
mov eax, dword [ebp - 0x88]
mov edx, 0x4210d4
call fcn.004045bc
je 0x420c45
mov eax, dword [ebp - 0x18]
call fcn.0041d5f8
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x4210ec
call fcn.0040488c
call fcn.004030f4
cmp ebx, 1
jne 0x420c7d
mov eax, dword [ebp - 0x18]
call fcn.0041d678
test al, al
jne 0x420c7d
mov ebx, 2
call fcn.0041ada4
test al, al
je 0x420c8b
cmp ebx, 2
je 0x420c8f
xor eax, eax
jmp 0x420c91
mov al, 1
mov byte [ebp - 0x1d], al
lea edx, [ebp - 0x8c]
mov al, 1
call fcn.0040cbd0
mov eax, dword [ebp - 0x8c]
push eax
lea eax, [ebp - 0x90]
call fcn.0041a97c
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x14]
pop edx
call fcn.004044bc
push 0x421114
lea eax, [ebp - 0x94]
call fcn.0041a890
push dword [ebp - 0x94]
push 0x421130
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404530
mov eax, 3
call fcn.0041b700
mov edx, 1
mov eax, 0x2a
call fcn.0041b768
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x42113c
call fcn.0040488c
call fcn.004030f4
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041ac54
xor al, 1
push eax
lea edx, [ebp - 0x98]
mov eax, dword [0x425d70]
mov eax, dword [eax]
call fcn.00413348
mov eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
call fcn.00419300
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x14]
pop ecx
call fcn.0041e24c
mov byte [ebp - 1], al
lea eax, [ebp - 0xa0]
call fcn.00419300
mov eax, dword [ebp - 0xa0]
xor edx, edx
call fcn.0041473c
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x421164
call fcn.0040488c
call fcn.004030f4
mov edx, 2
mov eax, 0x2a
call fcn.0041b768
cmp byte [ebp - 1], 0
je 0x420dc0
call fcn.0041b038
call fcn.0041a52c
mov eax, dword [ebp - 0x14]
call fcn.00407194
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x42118c
call fcn.0041a1a0
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x421198
call fcn.0041a1a0
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.0041afbc
mov ecx, dword [ebp - 0xa8]
mov edx, 0x420fb8
mov eax, dword [ebp - 8]
call fcn.0040c9c4
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 8]
call fcn.00404264
mov bl, 1
cmp byte [ebp - 1], 0
je 0x420eca
call fcn.0041ae70
test al, al
jne 0x420e3c
mov eax, dword [0x425e00]
cmp dword [eax], 1
jne 0x420eca
cmp byte [ebp - 0x1d], 0
je 0x420e92
lea eax, [ebp - 0xac]
call fcn.00419e04
mov eax, dword [ebp - 0xac]
push eax
call fcn.0041a020
push eax
lea eax, [ebp - 0xb0]
call fcn.00419f2c
mov eax, dword [ebp - 0xb0]
push eax
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004044bc
mov edx, dword [ebp - 0xb4]
mov eax, 1
pop ecx
call fcn.0040c324
mov ebx, eax
jmp 0x420eca
lea eax, [ebp - 0xb8]
call fcn.00419e04
mov eax, dword [ebp - 0xb8]
push eax
call fcn.0041a020
push eax
push 0
lea eax, [ebp - 0xbc]
call fcn.00419fa4
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 8]
mov eax, 1
call fcn.0040c290
test byte [ebp - 0x1d], bl
je 0x420edf
push 5
mov eax, dword [ebp - 0x18]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x4211a4
call fcn.0040488c
call fcn.004030f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420f33
lea eax, [ebp - 0xbc]
mov edx, 0x27
call fcn.004041f0
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004041f0
ret